Unreal Engine 4 pak-file Unpacker / unreal_tournament_4.bms [UE4 global topic]

[ronnan2009]

Any way of making this work with Transformers online game, .pak files? http://tfol.qq.com/main.shtml

[aluigi]

Use the filecutter on the pak archive and upload the 2 generated files:
http://aluigi.org/bms/filecutter.bms

[mbit555]

Hey. I'm having a problem with the Fortnite game, it looks like encryption is used.
I enclose exe and two files of 10 mb through the program filecutter.bms (http://zalil.su/7613466)

This game uses the system of dividing pak into pieces (http://prntscr.com/hnhwpb) This is what the unreal_tournament_4 script produces.bms when I select the file pakchunk0-WindowsClient.pak (http://prntscr.com/hnhxhg)

I tried to find the encryption key through the HEX editor (http://prntscr.com/hnhzyl) but it did not help. Maybe I'm doing something wrong? AES key is: VWSUATAUAVA

UPD: I was mistaken, the real key is: y298qjSb115NqQ3Agad30DWn2QYrTI8CT6aP05l2PBV9Qe92S94PdoVCCy06A38L
but unpack using unreal_tournament_4 script fails, gets stuck half way. It seems that the script does not correctly determine the structure of the .pak file

[Sydie]

Hey. I'm having a problem with the Fortnite game, it looks like encryption is used.
I enclose exe and two files of 10 mb through the program filecutter.bms (http://zalil.su/7613466)

This game uses the system of dividing pak into pieces (http://prntscr.com/hnhwpb) This is what the unreal_tournament_4 script produces.bms when I select the file pakchunk0-WindowsClient.pak (http://prntscr.com/hnhxhg)

I tried to find the encryption key through the HEX editor (http://prntscr.com/hnhzyl) but it did not help. Maybe I'm doing something wrong? AES key is: VWSUATAUAVA

Thanks guys - I've successfully unpacked Paragon!
Thanks . for his awesome quickbms!
Thanks @mbit555 for the information above, you almost had it - the key is VWSUATAUAVAW

I wanted know how the heroes in Paragon are setup. I've watched all Unreal Engine Twitch streams, but I had to see it for myself.
This game is made by great artists, optimized using innovative techniques and developed by amazing devs!
Therefore I needed to rip the original models myself and not simply download one of the available ripped models, since most of them are modified.

I've tried using "UE4 pak-file Unpacker by Haoose v0.5", but it was crashing when trying to unpack "pakchunk0-WindowsClient.pak", therefore I switched to aluigi's quickbms.

Here's what I used:
1. Used quickbms_4gb_files.exe [0.8.1] with unreal_tournament_4.bms [0.4.13]. It said that the .pak is encrypted and asked for a key
2. Opened OrionClient-Win64-Shipping.exe with hex editor, searched for AES, found the key - VWSUATAUAVAW
3. Enter the key in cmd from step 1
4. Repeat for all .pak in the folder - pakchunk0-WindowsClient.pak is first, then pakchunk0_s1-WindowsClient.pak, then pakchunk0_s2-WindowsClient.pak, etc.
5. Done!

Extracted models using UMODEL by Gildor - select "Override game detection" checkbox, select "Unreal Engine 4" and version "4.18".
Umodel was crashing when trying to open characters - something to do with skeletons - I just moved all files ending with _Skeleton to a backup folder in case this is fixed in the future, but you can delete them.



Here are the game names:
Venus - THE FEY
Mambo - MORIGESH
Vamp - COUNTESS
Sparrow - SPARROW
Gadget - GADGET
Femme - YIN
Ice - AURORA
Fallen Angel - SERATH
Medic - ???
Mudang - ???
Muriel - MURIEL
Phase - PHASE
Tacticia - LT-BELICA
Totem - DEKKER

PS: I'm just a technical artist, I don't know how this worked I'm just happy it did and you guys made some great tools for that!

[milk]

how to download 0.5 version?

[ZENHAXnumba1]

Hey. I'm having a problem with the Fortnite game, it looks like encryption is used.
I enclose exe and two files of 10 mb through the program filecutter.bms (http://zalil.su/7613466)

This game uses the system of dividing pak into pieces (http://prntscr.com/hnhwpb) This is what the unreal_tournament_4 script produces.bms when I select the file pakchunk0-WindowsClient.pak (http://prntscr.com/hnhxhg)

I tried to find the encryption key through the HEX editor (http://prntscr.com/hnhzyl) but it did not help. Maybe I'm doing something wrong? AES key is: VWSUATAUAVA

Thanks guys - I've successfully unpacked Paragon!
Thanks . for his awesome quickbms!
Thanks @mbit555 for the information above, you almost had it - the key is VWSUATAUAVAW

I wanted know how the heroes in Paragon are setup. I've watched all Unreal Engine Twitch streams, but I had to see it for myself.
This game is made by great artists, optimized using innovative techniques and developed by amazing devs!
Therefore I needed to rip the original models myself and not simply download one of the available ripped models, since most of them are modified.

I've tried using "UE4 pak-file Unpacker by Haoose v0.5", but it was crashing when trying to unpack "pakchunk0-WindowsClient.pak", therefore I switched to aluigi's quickbms.

Here's what I used:
1. Used quickbms_4gb_files.exe [0.8.1] with unreal_tournament_4.bms [0.4.13]. It said that the .pak is encrypted and asked for a key
2. Opened OrionClient-Win64-Shipping.exe with hex editor, searched for AES, found the key - VWSUATAUAVAW
3. Enter the key in cmd from step 1
4. Repeat for all .pak in the folder - pakchunk0-WindowsClient.pak is first, then pakchunk0_s1-WindowsClient.pak, then pakchunk0_s2-WindowsClient.pak, etc.
5. Done!

Extracted models using UMODEL by Gildor - select "Override game detection" checkbox, select "Unreal Engine 4" and version "4.18".
Umodel was crashing when trying to open characters - something to do with skeletons - I just moved all files ending with _Skeleton to a backup folder in case this is fixed in the future, but you can delete them.



Here are the game names:
Venus - THE FEY
Mambo - MORIGESH
Vamp - COUNTESS
Sparrow - SPARROW
Gadget - GADGET
Femme - YIN
Ice - AURORA
Fallen Angel - SERATH
Medic - ???
Mudang - ???
Muriel - MURIEL
Phase - PHASE
Tacticia - LT-BELICA
Totem - DEKKER

PS: I'm just a technical artist, I don't know how this worked I'm just happy it did and you guys made some great tools for that!

stupid to ask but where to put the AES key ? im a noob in this forum . thank you in advance

[aluigi]

quickbms will ask you to insert a password or choosing one from a list displayed on screen, so when prompted just copy the key and paste it on the console (press the right button of the mouse)

[ZENHAXnumba1]

quickbms will ask you to insert a password or choosing one from a list displayed on screen, so when prompted just copy the key and paste it on the console (press the right button of the mouse)

ohhh ok now i understand. thank you again

[Sybex]

Hey. I'm having a problem with the Fortnite game, it looks like encryption is used.
I enclose exe and two files of 10 mb through the program filecutter.bms (http://zalil.su/7613466)

This game uses the system of dividing pak into pieces (http://prntscr.com/hnhwpb) This is what the unreal_tournament_4 script produces.bms when I select the file pakchunk0-WindowsClient.pak (http://prntscr.com/hnhxhg)

I tried to find the encryption key through the HEX editor (http://prntscr.com/hnhzyl) but it did not help. Maybe I'm doing something wrong? AES key is: VWSUATAUAVA

UPD: I was mistaken, the real key is: y298qjSb115NqQ3Agad30DWn2QYrTI8CT6aP05l2PBV9Qe92S94PdoVCCy06A38L
but unpack using unreal_tournament_4 script fails, gets stuck half way. It seems that the script does not correctly determine the structure of the .pak file

Hey there,
i tried the same thing and also getting an error, it seems unresponsive after a while you get an not enough memory error (didn't screenshot the error msg).

You have any chance to check this? I need the fortnite files, too.

Thanks in advance
Sybex

[MrMe]

. can you retrieve the AES key of the paks from this game? I tried to find it using IDA but that failed.

Game binary: https://mega.nz/#!rx1UGKAY!GWA_9UOK6cgz ... w67Dyj0DzU
Pak cut (used filecutter.bms): https://mega.nz/#!XoMExKxI!9Ojce5W8Ykmq ... IabaScOlxI

- Edit

Looks like I found it, but it doesn't work. I referenced GalGun*VR code to FN to find it.
-

[imdoubletrouble]

I too am looking into doing this for Fortnite. I've bookmarked this page if anymore progress is made.

[aluigi]

Can you upload the first 100Mb of the archive?

[MrMe]

Can you upload the first 100Mb of the archive?

Ofcourse, https://mega.nz/#!2pUSHLaJ!Zt3HrxeOpFPl ... Nn21ViIy0A

Also, because the quickbms script did not work I started working on my own tool to unpak using your script and unreal engine 4.19 as reference.
I noticed a things that were missing from your script (not sure if on purpose).

The script currently parses the trail (footer?) incorrectly, it should be like this:

Code: Select all

EncryptedIndex = reader.ReadByte();
Magic = reader.ReadUInt32();
Version = reader.ReadInt32();
IndexOffset = reader.ReadInt64();
IndexSize = reader.ReadInt64();
IndexHash = reader.ReadBytes(20);

If EncryptedIndex equals 1, the name index is AES encrypted.

Edit: Yup, works fine in my program.

[Sybex]

Edit: Yup, works fine in my program. https://i.imgur.com/0ADW4xO.png

Can you please explain what to do?

Thanks

[aluigi]

I noticed a things that were missing from your script (not sure if on purpose).
The script currently parses the trail (footer?) incorrectly, it should be like this:
EncryptedIndex = reader.ReadByte();

The script covers older versions of the format (before encryption was implemented) and some customized versions, I have to find a way to add support for the encrypted toc and still remaining compatible with all the versions and options.

[aluigi]

Ok problem solved by a feature I implemented yesterday in the upcoming quickbms 0.8.3 (what a luck, just in time) and I confirm that now the extraction is correct.
Thanks for the feedback to MrMe and all the users who are contributing with keys and suggestions (less work for me).

I have uploaded the new script that obviously can't be used with the current quickbms 0.8.2a.
If you are in rush replace all the references to TOC_FILE with MEMORY_FILE10 and remove the "quickbmsver" line, it should take you few seconds to edit.

[MrMe]

Ok problem solved by a feature I implemented yesterday in the upcoming quickbms 0.8.3 (what a luck, just in time) and I confirm that now the extraction is correct.
Thanks for the feedback to MrMe and all the users who are contributing with keys and suggestions (less work for me).

I have uploaded the new script that obviously can't be used with the current quickbms 0.8.2a.
If you are in rush replace all the references to TOC_FILE with MEMORY_FILE10 and remove the "quickbmsver" line, it should take you few seconds to edit.

Awesome! I'll give it a try when 0.8.3 is out, got my own tool for the time being.

[aluigi]

0.8.3 is out and everything worked perfectly here.

[peupuppy]

Please, does anyone have encryption key for PUBG?

[zanzaman]

...