DragonSlayerOnline

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
omfgpota
Posts: 3
Joined: Tue Aug 26, 2014 10:43 pm

DragonSlayerOnline

Post by omfgpota »

Greetings everyone!

There's a new game from XLegends(most aeriagames developer), I've used the (http://aluigi.altervista.org/papers/bms/aeriagames.bms) script from their past games and it's working great but to this new one, It doesn't, I think they changed the compression method?(zlib) as in the error it shows,

Image

here are the files that you might need in checking it out,

https://www.sendspace.com/file/yn4gcp

thank you so much for the support and help!

regards
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: DragonSlayerOnline

Post by aluigi »

I have updated the script to skip the 0x88 0x1c header and footer but there is for sure something like an obfuscated or truncated compressed bytes somewhere in the compressed file so some files will not be decompressed by quickbms and other may be incomplete.

It tooks me some time to analyze the problem because I got some results with offzip but in reality it was just a partial result (offzip is made to extract anything, even invalid).

Take an extracted file like "biology\animation\M009_Bip01 _condition02.kf", as you can see it doesn't contain the Gamebryo data.
offzip tells us that it was able to extract 0x00004982 compressed bytes.
I tried to cut some bytes around 0x4000 but nothing changed.

I'm sure this is the correct way, I just don't know the exact offset and what operation is performed.
omfgpota
Posts: 3
Joined: Tue Aug 26, 2014 10:43 pm

Re: DragonSlayerOnline

Post by omfgpota »

thank you for the effort sir luigi! yes sir, I tried offzip on it too, just gives me with these error.

Image

as with respect to this game's cbt, I pm'ed you the client DL if you're interested sir.

thank you so much!
omfgpota
Posts: 3
Joined: Tue Aug 26, 2014 10:43 pm

Re: DragonSlayerOnline

Post by omfgpota »

hi guys!

I've successfully got pre-patched? samples from the game on with underscores ,

looks like just like the results on the sacred online thread here, the problem seems to be the NIF file format that are contained in the pkg archives, I think they are rehashed it in the idx or re-encrypted them in a way to work on their latest engine build(old one was 20.2.0.6, new one is 20.2.0.8)?

anyway here are the samples for you to see,
https://www.sendspace.com/file/vbkrxk

this as far as I can go, since my skills for these kinda work is close to none.

thank you very much!
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: DragonSlayerOnline

Post by aluigi »

Script 0.1.2 released.
yuzumi
Posts: 2
Joined: Sat Sep 20, 2014 11:48 am

Re: DragonSlayerOnline

Post by yuzumi »

aluigi wrote:Script 0.1.2 released.


Hello..My English is not very good,Please do not take offense..

I use QuickBMS Unpack Fantasy Frontier Online(Chinese Version) GameRes.. download:(http://filesty.changyou.com/hxsy/gw/HXS ... 140708.zip)
This script (http://aluigi.altervista.org/papers/bms/aeriagames.bms) success unpack head is 0x7801 and Most 0x881c..However, some 0x881c head file unpack is fail..I look Zdata like zlib.Similar is deform..

some unpack fail File:
\data\db\t_textindex.ini
\data\db\t_item.ini
\data\db\t_itemmall.ini
\data\db\t_biology.ini
\biology\texture\m74001.dds
\biology\texture\m74051.dds
\biology\texture\m74052.dds

GameRes is too big..I picked one can't unpack file to upload..

So I would like in this forum looking for your help..Thank you very much..~
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: DragonSlayerOnline

Post by aluigi »

That extracted data\db\t_itemmall.ini file is expected to be compressed but it doesn't containg compressed data.
The proof is that using offzip -S -z -15 returns nothing.
Currently I don't know how to handle these files.
yuzumi
Posts: 2
Joined: Sat Sep 20, 2014 11:48 am

Re: DragonSlayerOnline

Post by yuzumi »

aluigi wrote:That extracted data\db\t_itemmall.ini file is expected to be compressed but it doesn't containg compressed data.
The proof is that using offzip -S -z -15 returns nothing.
Currently I don't know how to handle these files.


This GameProgram seemingly not packers (game.bin)
I use Ollydbg open game.bin (Command Line:game.bin Easyfun) Breakpoints ASCII .\data\db\BiologyList.ini (This File is 0x881c unpack fail)
I do not really understand Ollydbg..

Run the game after the break in this
Image

The call is unpack 0x881c key point?
yuzumi2015
Posts: 4
Joined: Fri Jan 23, 2015 1:28 pm

Re: DragonSlayerOnline

Post by yuzumi2015 »

yuzumi wrote:
aluigi wrote:Script 0.1.2 released.


Hello..My English is not very good,Please do not take offense..

I use QuickBMS Unpack Fantasy Frontier Online(Chinese Version) GameRes.. download:(http://filesty.changyou.com/hxsy/gw/HXS ... 140708.zip)
This script (http://aluigi.altervista.org/papers/bms/aeriagames.bms) success unpack head is 0x7801 and Most 0x881c..However, some 0x881c head file unpack is fail..I look Zdata like zlib.Similar is deform..

some unpack fail File:
\data\db\t_textindex.ini
\data\db\t_item.ini
\data\db\t_itemmall.ini
\data\db\t_biology.ini
\biology\texture\m74001.dds
\biology\texture\m74051.dds
\biology\texture\m74052.dds

GameRes is too big..I picked one can't unpack file to upload..

So I would like in this forum looking for your help..Thank you very much..~



There files is used deflate64 zlib format Compression (Zlib Default in deflate32).. Quickbms Can UnCompression There Files?
How is Edit Zlib Source code it support deflate64 format?
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: DragonSlayerOnline

Post by aluigi »

quickbms supports also deflate64, yes.
yuzumi2015
Posts: 4
Joined: Fri Jan 23, 2015 1:28 pm

Re: DragonSlayerOnline

Post by yuzumi2015 »

aluigi wrote:quickbms supports also deflate64, yes.


comtype deflate64 ?
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: DragonSlayerOnline

Post by aluigi »

Yes. The full list of available compression algorithms is in quickbms.txt.
yuzumi2015
Posts: 4
Joined: Fri Jan 23, 2015 1:28 pm

Re: DragonSlayerOnline

Post by yuzumi2015 »

i'm use comtype deflate64 unpackfiles.. but Prompt error..
Image

I modify the file head (0x88,0x1c) is 0x78,0x9c and 0x78,0x01..This Game is Read success
pkg571 Z_size:542456 size:1036928

I need to upload this simplify game?
yuzumi2015
Posts: 4
Joined: Fri Jan 23, 2015 1:28 pm

Re: DragonSlayerOnline

Post by yuzumi2015 »

I use comtype deflate64 unpack this file.. It's Fail..
But I to know zip format and use HaoZip(http://haozip.2345.com/ this soft support deflate64 Compression to zip) create new zip (Zip Compression is 0x09 == deflate64).. use winhex del zipdata and add filedata..(use 0x08 == deflate extracted is fail)
use haozip extracted this zip (use Retain the damaged file mode)..
The extracted file is incomplete..head is DDS.. pic width is 1920(0x0780) Height is 1080(0x0438) DXT1.. This information is correct .. But behind the data is corrupted
Image
The deflate64 metod is were altered?
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: DragonSlayerOnline

Post by aluigi »

The deflate64 algorithm in quickbms works perfectly.
Create a zip with 7-zip using deflate64 and you can use zip.bms with it.
Darkboy140
Posts: 2
Joined: Fri Aug 21, 2015 6:59 am

Re: DragonSlayerOnline

Post by Darkboy140 »

Hey are you guys still working on this any update on this project would be great I really need to be able to get into X-legend new files :c
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: DragonSlayerOnline

Post by aluigi »

The technical reason behind the decompression issues was simply that the developers modified the zlib library to allow more than 30 distance bits.
I found the problem by using the great tinf library and debugging (with the library, not a debugger) a file till the occurrence of the malformed bytes.

I have released the script 0.2 that works at 100% with the current games::
http://aluigi.org/bms/aeriagames.bms
drx
Posts: 5
Joined: Wed Oct 01, 2014 4:14 pm

Re: DragonSlayerOnline

Post by drx »

Thanks Luigi!
Paj30
Posts: 3
Joined: Thu Dec 03, 2015 4:27 pm

Re: DragonSlayerOnline

Post by Paj30 »

Greetings.

Sorry for being a total noob, Aluigi (and for unearthing a two months old topic) but I used the great script Aeriagames pkg.idx/pkg???.pkg (0.2) with QuickBMS in order to extract data (mainly textures) from Dragon Slayer Online (which worked properly) but when I tried to use the reimport.bat from QuickBMS with my modded *.dds files, it gave me that (see below). I know I'm the stupid one making mistakes but would you be kind enough to tell me what I did wrong ? Thank you so much.

Image

Thanks for reading. Regards.
Ekey
Posts: 1383
Joined: Sat Aug 09, 2014 2:34 pm

Re: DragonSlayerOnline

Post by Ekey »

This script not supported for reimport.