Unreal Engine 4 pak-file Unpacker / unreal_tournament_4.bms [UE4 global topic]

[spiritovod]

@TNT: Oh, sorry, I didn't notice that you've posted different key. Then the key is correct, but pak format changed. I suppose filecutter will not help in this case, so any full pak is required to investigate it further. If there are many of them, smallest one will be fine too.

Update: Disregard that, pak format is still the same, but finder produces false-positive result.
Update 2: I thought that the exe is probably protected, but it seems they've changed decryption routine as well, since the key is stored in the same place as in the demo. Not sure if it's possible to dump the exe because of denuvo, but I can't find out more than that at this point. Will check a few other things later.

[TNT]

There are 45 total chunks. I uploaded the smallest as requested, but it's only a couple MB, so I also uploaded a 100 MB chunk in case you need more to work with. I honestly have no idea what filecutter is or if it would be useful here. This game (and the demo) led to my introduction to quickBMS.

Smallest: https://mega.nz/file/pOpmCAYK#uU4ZJPZiE ... 1Cs55-IBm0
~100 MB: https://mega.nz/file/oOw0yKIb#ShNdOnk9c ... dM2g4QyHKI

[spiritovod]

@TNT: Updated my previous post. If you want to help, try to dump the exe - it's explained in corresponding section of rin's topic ("how to dump exe for protected games"). Not sure it will work though.

[WhiteLightning76]

Hello I'm also new to this, and i would like to share my experience with Tony Hawk.

I will describe what i did, and what the end result is.

First i tried to dump the game .exe with x64dbg.

This is the log file

Code: Select all

Analyzing E:\Epic Games\Games\TonyHawksProSkater\Base\Binaries\Win64\THPS12.exe
Module parsing: C:\Windows\System32\ntdll.dll
Module parsing: C:\Windows\System32\kernel32.dll
Module parsing: C:\Windows\System32\KernelBase.dll
Module parsing: C:\Windows\System32\apphelp.dll
Module parsing: C:\Windows\System32\advapi32.dll
Module parsing: C:\Windows\System32\msvcrt.dll
Module parsing: C:\Windows\System32\sechost.dll
Module parsing: C:\Windows\System32\rpcrt4.dll
Module parsing: C:\Windows\System32\ucrtbase.dll
Module parsing: C:\Windows\System32\crypt32.dll
Module parsing: C:\Windows\System32\bcrypt.dll
Module parsing: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.20206.1000_none_920ad637be4d6a07\comctl32.dll
Module parsing: C:\Windows\System32\gdi32.dll
Module parsing: C:\Windows\System32\user32.dll
Module parsing: C:\Windows\System32\win32u.dll
Module parsing: C:\Windows\System32\gdi32full.dll
Module parsing: C:\Windows\System32\d3d11.dll
Module parsing: C:\Windows\System32\msvcp_win.dll
Module parsing: C:\Windows\System32\d3d9.dll
Module parsing: C:\Windows\System32\imm32.dll
Module parsing: C:\Windows\System32\dinput8.dll
Module parsing: C:\Windows\System32\combase.dll
Module parsing: C:\Windows\System32\dsound.dll
Module parsing: C:\Windows\System32\normaliz.dll
Module parsing: C:\Windows\System32\ole32.dll
Module parsing: C:\Windows\System32\dwmapi.dll
Module parsing: C:\Windows\System32\oleaut32.dll
Module parsing: C:\Windows\System32\dxgi.dll
Module parsing: C:\Windows\System32\setupapi.dll
Module parsing: C:\Windows\System32\shell32.dll
Module parsing: C:\Windows\System32\hid.dll
Module parsing: C:\Windows\System32\kernel.appcore.dll
Module parsing: C:\Windows\System32\shlwapi.dll
Module parsing: C:\Windows\System32\IPHLPAPI.DLL
Module parsing: C:\Windows\System32\msvcp140.dll
Module parsing: C:\Windows\System32\Wldap32.dll
Module parsing: C:\Windows\System32\RESAMPLEDMO.DLL
Module parsing: C:\Windows\System32\powrprof.dll
Module parsing: C:\Windows\System32\ws2_32.dll
Module parsing: C:\Windows\System32\winmmbase.dll
Module parsing: C:\Windows\System32\opengl32.dll
Module parsing: C:\Windows\System32\UIAutomationCore.dll
Module parsing: C:\Windows\System32\vcruntime140.dll
Module parsing: C:\Windows\System32\winhttp.dll
Module parsing: C:\Windows\System32\wininet.dll
Module parsing: C:\Windows\System32\winmm.dll
Module parsing: C:\Windows\System32\vcruntime140_1.dll
Module parsing: C:\Windows\System32\msdmo.dll
Module parsing: C:\Windows\System32\X3DAudio1_7.dll
Module parsing: C:\Windows\System32\glu32.dll
Module parsing: C:\Windows\System32\XAPOFX1_5.dll
Module parsing: C:\Windows\System32\XInput1_4.dll
Module parsing: C:\Windows\System32\cfgmgr32.dll
Module parsing: C:\Windows\System32\devobj.dll
Module parsing: C:\Windows\System32\umpdc.dll
Module parsing: C:\Windows\System32\InputHost.dll
Module parsing: C:\Windows\System32\CoreMessaging.dll
Module parsing: C:\Windows\System32\bcryptprimitives.dll
Module parsing: C:\Windows\System32\SHCore.dll
Module parsing: C:\Windows\System32\windows.storage.dll
Module parsing: C:\Windows\System32\profapi.dll
Module parsing: C:\Windows\System32\cryptsp.dll
Module parsing: C:\Windows\System32\rsaenh.dll
Module parsing: C:\Windows\System32\cryptbase.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\NVIDIA\NVaftermath\Win64\GFSDK_Aftermath_Lib.x64.dll
Module parsing: C:\Windows\System32\sspicli.dll
Module parsing: C:\Windows\System32\uxtheme.dll
Module parsing: C:\Windows\System32\nsi.dll
Module parsing: C:\Windows\System32\dhcpcsvc6.dll
Module parsing: C:\Windows\System32\dhcpcsvc.dll
Module parsing: C:\Windows\System32\msasn1.dll
Module parsing: C:\Windows\System32\mswsock.dll
Module parsing: C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooks64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\Win64\EOSSDK-Win64-Shipping.dll
Module parsing: C:\Windows\System32\wintrust.dll
Module parsing: C:\Windows\System32\secur32.dll
Module parsing: C:\Windows\System32\clbcatq.dll
Module parsing: C:\Windows\System32\netprofm.dll
Module parsing: C:\Windows\System32\netsh.exe
Module parsing: C:\Windows\System32\npmproxy.dll
Module parsing: C:\Windows\System32\imagehlp.dll
Module parsing: C:\Windows\System32\gpapi.dll
Module parsing: E:\Epic Games\Launcher\Portal\Extras\Overlay\EOSOVH-Win64-Shipping.dll
Module parsing: C:\Windows\System32\D3DCompiler_47.dll
Module parsing: C:\Windows\System32\version.dll
Module parsing: C:\Windows\System32\NapiNSP.dll
Module parsing: C:\Windows\System32\pnrpnsp.dll
Module parsing: C:\Windows\System32\dnsapi.dll
Module parsing: C:\Windows\System32\winrnr.dll
Module parsing: C:\Windows\System32\wshbth.dll
Module parsing: C:\Windows\System32\mf.dll
Module parsing: C:\Windows\System32\mfplat.dll
Module parsing: C:\Windows\System32\RTWorkQ.dll
Module parsing: C:\Windows\System32\MFPlay.dll
Module parsing: C:\Windows\System32\gameux.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PxFoundation_x64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PhysX3Common_x64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PxPvdSDK_x64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PhysX3_x64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\ApexFramework_x64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\APEX_Legacy_x64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\APEX_Clothing_x64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PhysX3Cooking_x64.dll
Module parsing: C:\Windows\System32\nvapi64.dll
Module parsing: C:\Windows\System32\msctf.dll
Module parsing: C:\Windows\System32\TextInputFramework.dll
Module parsing: C:\Windows\System32\ExplorerFrame.dll
Module parsing: C:\Windows\System32\directxdatabasehelper.dll
Module parsing: C:\Windows\System32\cryptnet.dll
Module parsing: C:\Windows\System32\nvspcap64.dll
Module parsing: C:\Windows\System32\ntmarta.dll
Module parsing: C:\Windows\System32\DXCore.dll
Module parsing: C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_3978b22f036c14a1\nvldumdx.dll
Module parsing: C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_3978b22f036c14a1\nvwgf2umx.dll
Module parsing: C:\Windows\System32\DataExchange.dll
Module parsing: C:\Windows\System32\twinapi.appcore.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\NvCloth_x64.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Base\Content\Bink\binkpluginw64.dll
Module parsing: C:\Windows\System32\mfcore.dll
Module parsing: C:\Windows\System32\mfmp4srcsnk.dll
Module parsing: C:\Windows\System32\MMDevAPI.dll
Module parsing: C:\Windows\System32\AudioSes.dll
Module parsing: C:\Windows\System32\ResourcePolicyClient.dll
Module parsing: C:\Windows\System32\CompPkgSup.dll
Module parsing: C:\Windows\System32\Windows.Media.dll
Module parsing: C:\Windows\System32\Windows.ApplicationModel.dll
Module parsing: C:\Windows\System32\rmclient.dll
Module parsing: C:\Windows\System32\AppXDeploymentClient.dll
Module parsing: C:\Windows\System32\MSAudDecMFT.dll
Module parsing: C:\Windows\System32\mfperfhelper.dll
Module parsing: C:\Windows\System32\COLORCNV.DLL
Module parsing: C:\Windows\System32\msmpeg2vdec.dll
Module parsing: C:\Windows\System32\Windows.UI.dll
Module parsing: C:\Windows\System32\WindowManagementAPI.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\APEX_Destructible_x64.dll
Module parsing: C:\Windows\System32\Windows.Networking.dll
Module parsing: C:\Windows\System32\FWPUCLNT.DLL
Module parsing: C:\Windows\System32\rasadhlp.dll
Module parsing: C:\Windows\System32\OneCoreCommonProxyStub.dll
Module parsing: C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
Module parsing: C:\Windows\System32\dcomp.dll
Module parsing: C:\Windows\System32\wdmaud.drv
Module parsing: C:\Windows\System32\ksuser.dll
Module parsing: C:\Windows\System32\avrt.dll
Module parsing: C:\Windows\System32\msacm32.drv
Module parsing: C:\Windows\System32\msacm32.dll
Module parsing: C:\Windows\System32\midimap.dll
Module parsing: C:\Windows\System32\XAudio2_9.dll
Module parsing: E:\Epic Games\Games\TonyHawksProSkater\Base\Content\Bink\bink2w64.dll
Module parsing: C:\Windows\System32\msxml6.dll
Module parsing: C:\Windows\System32\iertutil.dll
Module parsing: C:\Windows\System32\OnDemandConnRouteHelper.dll
Module parsing: C:\Windows\System32\urlmon.dll
Module parsing: C:\Windows\System32\winnsi.dll
Module parsing: C:\Windows\System32\dpapi.dll
Module parsing: C:\Windows\System32\schannel.dll
Module parsing: C:\Windows\System32\mskeyprotect.dll
Module parsing: C:\Windows\System32\ntasn1.dll
Module parsing: C:\Windows\System32\ncrypt.dll
Module parsing: C:\Windows\System32\ncryptsslp.dll
Module parsing: C:\Windows\System32\TextShaping.dll
Module parsing: C:\Windows\System32\webio.dll
Loading modules done.
Imagebase: 0000000140000000 Size: 1A8A0000
IAT Search Adv: Found 1 (0x1) possible IAT entries.
IAT Search Adv: Possible IAT first 000000015A8761F8 last 000000015A8761F8 entry.
IAT Search Adv: IAT VA 000000015A8761F8 RVA 000000001A8761F8 Size 0x0008 (8)
IAT Search Nor: IAT not found at OEP 000000015A874020!
IAT parsing finished, found 1 valid APIs, missed 0 APIs
DIRECT IMPORTS - Found 0 possible direct imports with 0 unique APIs!
Dump success D:\_TEST\AES_finder_0.9f\THPS12_dump.exe

The exe size came out exactly the same as the original exe.

AES Finder also returned the exact same key: 0x94DEC78FBD9762E1674A3418BFE8637587659532C1C053D1F4AA650E2176286C

When i used Quickbms with the unreal_tournament_4_0.4.23.1a_tony_hawk.bms and this key i get the following

Code: Select all

QuickBMS generic files extractor and reimporter 0.10.1 (64bit test)
by Luigi Auriemma
e-mail: me@aluigi.org
web:    aluigi.org
        (Oct 20 2019 - 14:45:05)

                          quickbms.com  Homepage
                            zenhax.com  ZenHAX Forum
                     @zenhax @quickbms  Twitter & Scripts

- GUI mode activated, remember that the tool works also from command-line
  where are available various options like folder scanning, filters and so on

- select BMS script. type ? for using the content of clipboard like a script
- select input archives/files, type * for the whole folder and subfolders
- select output folder where extracting files
- filter string: "*"
  *
- filter   1: *
- start the scanning of the input folder: E:\Epic Games\Games\TonyHawksProSkater\Base\Content\Paks
- open input file E:\Epic Games\Games\TonyHawksProSkater\Base\Content\Paks\.\pakchunk0-WindowsNoEditor.pak
- open script D:\_TEST\quickbms\unreal_tournament_4_0.4.23.1a_tony_hawk.bms
- set output folder D:\_TEST\Output

  offset           filesize   filename
--------------------------------------
The archive is encrypted, select the number of the key to use or type yours:
0: KIWIKIWIKIWIKIWIKIWIKIWIKIWIKIWI
1: _aS4mfZK8M5s5KWC2Lz2VsFnGKI7azgl
2: bR!@nbR0wnc@rychR!$d@nd@v3d3R3kj!mj0$hk3v!nm!ch@3lm!k3s3@nst3v3t!m
3: casd#55@#$%323!$^#b%05sa5W|hhaf4365s52ss51|55m!|{55s^@@36f233|-|0w@%3g8hssDk35/!Nm|_|%ds23%a32d5&23as3%12p|-|y$t3ds562d23fav3c@dyw38#49
4: C8C4847F3B4FA52D4AAD57A52358CDBC
5: k14z0ZLR8a7jNm49uyBzxXYY9LpTHcehLSNiC3jAkzBsffPuy8YsTa72RLD9KWIn
6: E7@[dZfoYCW;+YWR;0JK^{9tt:yU0_T&
7: E1A1F2E4AA066C54BD5090F463EDDF58D01684243672B3CE809FF47FF473B04A
8: I0vV6wr0TFbg3m23QuSIwnYC1sI0AIDq
9: y298qjSb115NqQ3Agad30DWn2QYrTI8CT6aP05l2PBV9Qe92S94PdoVCCy06A38L
10: b9uW0RKNY91be8HN3Lemi68j6Xsi2l7fQJYsp5oR4al4C4c9kY5E0l90411l9P3L
11: 45DD15D6DD2DA50AEB71CE7A5284CF8EA498B2EC3D52B7E336F3EA0071CE44B3
12: MRZpemumg6t2AXExrMQs6TSoZRG+YSABK338oc6F8kTXu4k6QffJgYAzKl65Tk2L
13: 0x9D8C9A4A4FA082F213EED604B6E756237181685EEDA82216437617D7AA5231AF
14: press RETURN for no encryption (Lineage 2 Revolution)

- please insert the content for the variable KEY:
  0x94DEC78FBD9762E1674A3418BFE8637587659532C1C053D1F4AA650E2176286C
KEY: ��Ǐ��b�gJ4��cu�e�2��S��e!v(l

Error: incomplete input file -10:
       Can't read 8 bytes from offset 0000000000976190.
       Anyway don't worry, it's possible that the BMS script has been written
       to exit in this way if it's reached the end of the archive so check it
       or contact its author or verify that all the files have been extracted.
       Please check the following coverage information to know if it's ok.

  coverage file -10 100%   9920912    9920912    . offset 0000000000976190

Last script line before the error or that produced the error:
  152 get CHUNK_END_OFFSET longlong TOC_FILE

Press ENTER or close the window to quit

Is it possible the script needs adjusting ?

[spiritovod]

@WhiteLightning76: Well, the point was to post that dumped exe here, but considering the log I'd say it's still protected. Like it was already said above, while the key is stored in the same place and in the same way as in demo, but it doesn't work "as is" with the script (it should at least decrypt index properly, but it doesn't), I came to the conclusion that they've changed decryption routine - for example, key can be additionally transformed before the use. But since that part of the code is protected, I can't check it at runtime, because I don't own the game - that's why properly dumped exe is required (with de-virtualized parts). Usually denuvo only protects its own stuff and leave the rest more or less untouched.

P.S. It's not like required parts are really protected, but some values can be obtained only at runtime.

Update: I've managed to investigate it further and can confirm that the key is correct (that "94DE..." posted above), but the game is using custom AES for decryption - at least, some of values are additionally xored with 0x55555555 and 0xAAAAAAAA, and also some values order is reversed. It's out of my league for now, but if you know how it works, samples in the attachment.

[Tgames]

Hi, i tried to extract Dead by Daylight 4.2.0 (Windows Store) paks with no luck with the lastest script.
It works only with steam build. But not with Windows Store build.

Paks are build with Unreal Engine 4.25.1 but it's like they use sort of custom structure for names.

Here is a example of pakchunk24-WinAnvil.pak.

Since 4.2.0, it seems they changed pak structure on Windows Store build only.

Can someone help me ? Thanks.

[einherjar007]

Do you know the AES key for the mobile game "engage souls"? I've searched on AES finder mobile for over 80 minutes,
but can't find it. I posted to the rin forum, but my writing was not approved or was not reflected.

[Amort]

Hullo folks, I'm in need of a hand and I thinkthis is the right topic to look for answers in.

I recently came into possession of some .pak files from a game called Fable Legends, now long since cancelled in a near-complete state.
These .paks have associated .log text files with them, which I assume list their contents, and I can't extract the contents of the .paks using the UT4.bms script and QuickBMS. Whenever I try to extract anything from any pak, it throws up an error: "the uncompressed data (-1) is bigger than the allocated buffer (131072)" and I was wondering if someone more technically skilled than me had a clue as to how to get in. I've also tried opening the paks in Umodel (which displays a filelist but crashes on trying to open or export them) and Game Extractor (which can extract the files, but they contain only names and no data).

I'll provide a sample .pak file as an example, if that helps. Thanks in advance!

[ili]

got this result on Necromunda -

Code: Select all

- please insert the content for the variable KEY:
  0x6402EBDE9E8128FAF87A0866107FB6DC74A74342E8A0BF1DBB4546E28EE8E1BD
KEY: dޞ(ftCB蠿EF

Error: incomplete input file 0: M:\Necromunda - Underhive Wars\Necromunda\Content\Paks\Necromunda-WindowsNoEditor.pak
       Can't read 4870361522024480781 bytes from offset 22824e0800000030.
       Anyway don't worry, it's possible that the BMS script has been written
       to exit in this way if it's reached the end of the archive so check it
       or contact its author or verify that all the files have been extracted.
       Please check the following coverage information to know if it's ok.

[spiritovod]

@Tgames: Since Gildor already answered in the game topic, why it can be problematic to implement support for this format, I can also confirm that I will not support it for now, because steam version of the game is using usual format and contents are the same in both versions (reference for others).

It's a bit unrelated, but I noticed that current bms script doesn't support proper extraction of raw data from modern paks (in most cases it can be extracted without index, but also without proper filenames and extensions), especially if dynamic padding is used. It's about time to make something with this.

@einherjar007: Yes, on rin forum first one or two posts will be pre-moderated - it seems mod staff are just busy at the moment. Back on topic, I'm not sure why you couldn't find anything, latest mobile finder worked fine here, so Engage Souls key is now in the list. Note that the key is for playmarket version and it may be different for qooapp version (but it can be the same, not tested).
Not sure what the problem is, but in some cases mobile finder can probably work longer than maximum registered time (70 minutes on my 2-core laptop). For example, a laptop can significantly reduce maximum CPU usage available for Java VM based on power settings, especially when it's working on battery, so the total search time will be increased accordingly.

@Amort: It seems some of game archives are additionally compressed with lz4, like your example. Specific script for Fable Legends is added to the scripts bundle (see my signature). The script should work with all game paks, and also it produces full correct paths for extracted files, which is not an issue since like 4.11 engine.

Maybe it will be also helpful for other old games, where full path or root folder is stripped from the resulted files. I've included BASE_PATH_INCLUDED option to the script, if it's set to 0, the script will try to add base path to files (it's default value). For all modern games it should be 1, but you can always test stuff.

@ili: I suppose you're using outdated bms script, incompatible with 4.25 games. Please use the latest one from my signature.

[ili]

True @spiritovod Thank's !

[Amort]

@spiritovod Thank you so much for the script! It works a treat, I really appreciate it

[einherjar007]

@spiritovod thanks AES key! It's works!
In some other games, key.txt was generated in 42-47 minutes and the result was obtained. So far, only Engage Souls haven't had good results. Maybe the pak I used wasn't good. I used the pak included in the apk.

[sinnerclown380]

Necromunda Underhive Wars Aes key pls spiritovod

[spiritovod]

@sinnerclown380: It was already in the list. Next time please check the list first.

[sinnerclown380]

@sinnerclown380: It was already in the list. Next time please check the list first.

sorry spiritovod thanks.

[tyoripoko]

The extracted necromunda locres file is corrupted.
It seems that large sized text is not unpaked.
Do you know any good way?

[spiritovod]

@tyoripoko: Why do you think it's "corrupted"? If some text is not present in locres file, it can be in other assets, for example in Content\StringTables. Locres files themselves are totally fine and can be converted with usual locres tools (proof).

[tyoripoko]

@spiritovod:very thanks! As you say, locres wasn't broken.

but, When I played locres translated into Japanese, the phenomenon that the timing of the sound was shifted in the intro movie occurred.
To be precise, this phenomenon occurs just by exporting and playing pak.
Is there a solution other than reimport?

Please help me...

[spiritovod]

@tyoripoko: I don't quite understand what you're talking about. If you mean that audio is desynchronized with translated subtitles in locres file, it's possible that the game has some hardcoded values for audio playback. In that case I doubt you can do anything, since such stuff is usually stored in the exe, not in assets.
Make a test locres with translated strings of the same size as in original file and check for synchronization issues. In general, pak format is not related to in-game issues, if you don't replace already existing paks, but using mod paks.