Unreal Engine 4 pak-file Unpacker / unreal_tournament_4.bms [UE4 global topic]

[Nobody]

@Nobody
Do you mean that my script http://aluigi.org/papers/bms/others/unr ... ment_4.bms version 0.4.7 doesn't work? I doubt.

My mistake Aluigi. Script work perfect. Thanks a lot.

[tristo]

Hello aluigi and the zenhax community!

I tested your latest script (0.4.7) with Marvel vs Capcom Infinite and I get this error message:

Code: Select all

Error: incomplete input file 0: F:\MVCI\pakchunk0-WindowsNoEditor.pak
       Can't read 4 bytes from offset 786e636d000001c2.
       Anyway don't worry, it's possible that the BMS script has been written
       to exit in this way if it's reached the end of the archive so check it
       or contact its author or verify that all the files have been extracted.
       Please check the following coverage information to know if it's ok.

  coverage file 0     0%   44         24203445315 . offset 786e636d000001c2

Last script line before the error or that produced the error:
  185 get NAMESZ signed_long

There are 2 pak files in the game's folder and I get the exact same error with both, so I assume it's due to encryption (I don't even get to chose a key when running the script, it gives the error message directly).

I uploaded the big exe and the 2 files obtained with filecutter.bms with a MEGABYTES variable set to 10: http://www31.zippyshare.com/v/MszvgXTc/file.html

If you could find the key and update the ue4 bms script, I would be very grateful, it looks like there are many things to mess with in those files.

If you need more files I'd be glad to provide them.

[aluigi]

Weird format.
It has absolutely nothing in common with the UE4 pak format and the only clear-text fields are 3 64bit fields at the end without a meaning.
The rest is obfuscated probably using a part of the 32 bytes string at the end of the archive.

I will not spend time on this, sorry.

[tristo]

No problemo, I'm already glad that you took the time to look into the files so promptly.

It looks like most of the files are encrypted with the same method, not only pak files, but acb, acf, usm and uasset too.

Capcom really didn't want people to mess with their game (and that's understandable after the Street Fighter V constant datamining and leaks), but I'm not sure that making the game hard to mod will help the abysmal sales of the game on Steam (not even 15k players since release if steamspy is to be trusted and the game can already be found for less than 25$ on some sites...).

At least the game is fun to play but some part of it are so ugly (most of the UI); it would have been nice to be able to edit it.

[TerryXX]

Here's some more information about Marvel vs Capcom Infinite, the files that are encrypted in the end they have this same string mcnxyxcmvmcxyxcmskdldkjshagsdhfj (here is a sample file) http://www11.zippyshare.com/v/mddSJhW5/file.html
In the exe file there is a reference to that key:
ˆ úH....ÁÁÁÁ.Í[.ˆ úH..../sK...G¨‡.}ç7SÚ¥Á....... 0úH....Pš.I....@š.I.... 0úH.....dfpc...user32.dll......ntdll.dll.......kernelbase.dll..mcnxyxcmvmcxyxcmskdldkjshagsdhfj....\\.\........\\?\hid#........msvcrt.dll.........I.
The exe file has Denuvo inside it and this format SHA256 openssl.org now I do not know if they used the same encryption for the .pak file.

Edit1: Here is the exe file dumped during a game http://www14.zippyshare.com/v/RZ2xSjME/file.html
you can already notice the files that have been uploaded during the game /Game/..000./.G.a.m.e./.C.h.a.r.a./.%.s./.M.e.s.h./.P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t._.%.s...P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t

[godskin]

Here's some more information about Marvel vs Capcom Infinite, the files that are encrypted in the end they have this same string mcnxyxcmvmcxyxcmskdldkjshagsdhfj (here is a sample file) http://www11.zippyshare.com/v/mddSJhW5/file.html
In the exe file there is a reference to that key:
ˆ úH....ÁÁÁÁ.Í[.ˆ úH..../sK...G¨‡.}ç7SÚ¥Á....... 0úH....Pš.I....@š.I.... 0úH.....dfpc...user32.dll......ntdll.dll.......kernelbase.dll..mcnxyxcmvmcxyxcmskdldkjshagsdhfj....\\.\........\\?\hid#........msvcrt.dll.........I.
The exe file has Denuvo inside it and this format SHA256 openssl.org now I do not know if they used the same encryption for the .pak file.

Edit1: Here is the exe file dumped during a game http://www14.zippyshare.com/v/RZ2xSjME/file.html
you can already notice the files that have been uploaded during the game /Game/..000./.G.a.m.e./.C.h.a.r.a./.%.s./.M.e.s.h./.P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t._.%.s...P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t

[Darko]

Here's some more information about Marvel vs Capcom Infinite, the files that are encrypted in the end they have this same string mcnxyxcmvmcxyxcmskdldkjshagsdhfj (here is a sample file) http://www11.zippyshare.com/v/mddSJhW5/file.html
In the exe file there is a reference to that key:
ˆ úH....ÁÁÁÁ.Í[.ˆ úH..../sK...G¨‡.}ç7SÚ¥Á....... 0úH....Pš.I....@š.I.... 0úH.....dfpc...user32.dll......ntdll.dll.......kernelbase.dll..mcnxyxcmvmcxyxcmskdldkjshagsdhfj....\\.\........\\?\hid#........msvcrt.dll.........I.
The exe file has Denuvo inside it and this format SHA256 openssl.org now I do not know if they used the same encryption for the .pak file.

Edit1: Here is the exe file dumped during a game http://www14.zippyshare.com/v/RZ2xSjME/file.html
you can already notice the files that have been uploaded during the game /Game/..000./.G.a.m.e./.C.h.a.r.a./.%.s./.M.e.s.h./.P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t._.%.s...P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t

Script??

[godskin]

## Marvel VS Capcom - Infinite ##

MvCI file decrypter + pak extraction script

https://github.com/AltimorTASDK/dfpslayer/releases

Usage: dfpslayer [file path]

Code: Select all

Example:
dfpslayer "C:\Program Files (x86)\Steam\steamapps\common\MARVEL VS. CAPCOM INFINITE\MVCI\Content\Paks\pakchunk0-WindowsNoEditor.pak"

dfpslayer will output the decrypted file with ".decrypted" appended to the path. Once you've decrypted it you can extract pak contents with QuickBMS.
dfpslayer also works on other files within the MVCI/Content folder, not just the paks.

BMS script :
https://gist.githubusercontent.com/AltimorTASDK/a89d03d4c9c54c440756d0e5778bf2c8/raw/d6060548591622d4691a48a69e3bbbca629047f7/mvci.bms
Use with aluigi's QuickBMS. I can't link it here because reddit filters it for some reason.
Using QuickBMS to extract the pak contents is the same as SFV.
The game will load decrypted files.

Use -game=ue4.15 with UE viewer.

[TerryXX]

Godskin thx man for your work
P.S. question, create these "dumps" of exe files are they useful or do not serve anything?

[aluigi]

Apparently the encryption algorithm is very simple and the final header of 0x1c2 bytes is useless.
I have made a script and it works well but I don't know why the final data of the rebuilt filecutted file doesn't match what I expected, anyway I don't see errors:
http://aluigi.org/bms/mvci_dec.bms

P.S.: I have seen the key in the edited bms that has been posted but in the 10Mb filecutted sample I have here all the files were not-encrypted, is that key necessary only for some files? (some UE4 games needed a key for some ini files so that's perfectly possible here too)

[godskin]

Apparently the encryption algorithm is very simple and the final header of 0x1c2 bytes is useless.
I have made a script and it works well but I don't know why the final data of the rebuilt filecutted file doesn't match what I expected, anyway I don't see errors:
http://aluigi.org/bms/mvci_dec.bms

P.S.: I have seen the key in the edited bms that has been posted but in the 10Mb filecutted sample I have here all the files were not-encrypted, is that key necessary only for some files? (some UE4 games needed a key for some ini files so that's perfectly possible here too)

and how to extract .uexp (sound File) ?

[pepodmc]

## Marvel VS Capcom - Infinite ##

MvCI file decrypter + pak extraction script

https://github.com/AltimorTASDK/dfpslayer/releases

Usage: dfpslayer [file path]

Code: Select all

Example:
dfpslayer "C:\Program Files (x86)\Steam\steamapps\common\MARVEL VS. CAPCOM INFINITE\MVCI\Content\Paks\pakchunk0-WindowsNoEditor.pak"

dfpslayer will output the decrypted file with ".decrypted" appended to the path. Once you've decrypted it you can extract pak contents with QuickBMS.
dfpslayer also works on other files within the MVCI/Content folder, not just the paks.

BMS script :
https://gist.githubusercontent.com/AltimorTASDK/a89d03d4c9c54c440756d0e5778bf2c8/raw/d6060548591622d4691a48a69e3bbbca629047f7/mvci.bms
Use with aluigi's QuickBMS. I can't link it here because reddit filters it for some reason.
Using QuickBMS to extract the pak contents is the same as SFV.
The game will load decrypted files.

Use -game=ue4.15 with UE viewer.

where to put the files extracted from the PAK files?

[pepodmc]

Apparently the encryption algorithm is very simple and the final header of 0x1c2 bytes is useless.
I have made a script and it works well but I don't know why the final data of the rebuilt filecutted file doesn't match what I expected, anyway I don't see errors:
http://aluigi.org/bms/mvci_dec.bms

P.S.: I have seen the key in the edited bms that has been posted but in the 10Mb filecutted sample I have here all the files were not-encrypted, is that key necessary only for some files? (some UE4 games needed a key for some ini files so that's perfectly possible here too)

and how to extract .uexp (sound File) ?

This guy find a way aparently:

https://www.youtube.com/watch?v=nx49UfC ... Aw&index=1

[UncleFestor]

Apparently the encryption algorithm is very simple and the final header of 0x1c2 bytes is useless.
I have made a script and it works well but I don't know why the final data of the rebuilt filecutted file doesn't match what I expected, anyway I don't see errors:
http://aluigi.org/bms/mvci_dec.bms

P.S.: I have seen the key in the edited bms that has been posted but in the 10Mb filecutted sample I have here all the files were not-encrypted, is that key necessary only for some files? (some UE4 games needed a key for some ini files so that's perfectly possible here too)

I keep getting an error when I try to reimport a texture in MvCI using the eaxtractor script.

Code: Select all

- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/005_RSMA.ubulk"
< 00000000146c419b 53566      MVCI\Content\Chara\005\Mesh\005_RSMA.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/005_RSMA.ubulk"
< 00000000146d12d9 52028      MVCI\Content\Chara\005\Mesh\005_RSMA.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/005_RSMA.ubulk"
< 00000000146dde15 55863      MVCI\Content\Chara\005\Mesh\005_RSMA.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/005_RSMA.ubulk"
< 00000000146eb84c 15071      MVCI\Content\Chara\005\Mesh\005_RSMA.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.uasset"
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 00000000146f1ae9 32929      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 00000000146f9b8a 37504      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 0000000014702e0a 39092      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 000000001470c6be 39705      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 00000000147161d7 38536      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 000000001471f85f 38623      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
- compressed size too big, I try using the zopfli method (may be slow)
- compressed size too big, I try using the uberflate/kzip method (may be very slow!)

-------------------
*EXCEPTION HANDLER*
-------------------
An error or crash occurred:

*EH* ExceptionCode      c0000005 access violation
*EH* ExceptionFlags     00000000
*EH* ExceptionAddress   747386b0
                        746B0000 + 000886b0 msvcrt.dll
*EH* NumberParameters   00000002
*EH*                    00000000
*EH*                    d5619db8

Last script line before the error or that produced the error:
  65  clog MEMORY_FILE CHUNK_OFFSET CHUNK_ZSIZE CHUNK_SIZE

L:\Program Files (x86)\Marvel VS Capcom - Infinite\MVCI\Content\Paks>pause
Press any key to continue . . .

I don't understand how the script can think the modded file is too big. Original file is 0x2AA000 Bytes - Modded File is 0x2AA000 Bytes --->Exact same size

[MerlinSVK]

It says "compressed size too big" so your modded file, can't be compressed to original size (written in the archive). That's why it's using other compression variants.

[aluigi]

Chunked files... it would probably not work anyway.

[UncleFestor]

EDIT:

The game will run from unpacked files, so disregard my inquiry.

[smartypamore]

## Marvel VS Capcom - Infinite ##

MvCI file decrypter + pak extraction script

https://github.com/AltimorTASDK/dfpslayer/releases

Usage: dfpslayer [file path]

Code: Select all

Example:
dfpslayer "C:\Program Files (x86)\Steam\steamapps\common\MARVEL VS. CAPCOM INFINITE\MVCI\Content\Paks\pakchunk0-WindowsNoEditor.pak"

dfpslayer will output the decrypted file with ".decrypted" appended to the path. Once you've decrypted it you can extract pak contents with QuickBMS.
dfpslayer also works on other files within the MVCI/Content folder, not just the paks.

BMS script :
https://gist.githubusercontent.com/AltimorTASDK/a89d03d4c9c54c440756d0e5778bf2c8/raw/d6060548591622d4691a48a69e3bbbca629047f7/mvci.bms
Use with aluigi's QuickBMS. I can't link it here because reddit filters it for some reason.
Using QuickBMS to extract the pak contents is the same as SFV.
The game will load decrypted files.

Use -game=ue4.15 with UE viewer.

Video Tutorial please.. thanks...

[lolwatt]

Faith of Danschant is currently not compatible with the script/UModel.
I would like to share the exe and PAK, but the thing is 3gb.

Is there an easier way or just upload the entire thing?

[aluigi]

Use this script to generate 2 files to upload:
http://aluigi.org/bms/filecutter.bms