Destiny PKG

[brendan19]

PKG file from Destiny on PS3 and Xbox 360 version.

Destiny PS3 PKG

Destiny Xbox 360 PKG

[brendan19]

Added an Xbox 360 PKG to the OP.

EDIT: From what I've looked at, the PKG files aren't compressed or encrypted as I have extracted files out of it.

[aluigi]

Are you sure they are not encrypted/compressed?

I took a look at both the archives and I see chunks of data with high entropy (sequences of different bytes), no formats recognized.

[brendan19]

I managed to rip out audio files from other PKG archives. Here's a 10MB sample from the globals audio package on the Xbox 360 version.

http://www53.zippyshare.com/v/47474961/file.html

[happyend]

PS3 and Xbox 360 audio files use wwwise,ww2ogg support，RIFX head

[brendan19]

I don't know if the game uses the Wwise middleware

Xbox 360 uses XMA as I've already managed to convert some of the audio.

I am unsure about the PS3's audio codec however as I haven't looked into it.

But an unpacker or BMS of some description would be welcome

[aluigi]

I don't see fields like offset and size unfortunately.

[ili]

someone can help any new

[brendan19]

Looking at the game's credits, it uses the following software/tools

Havok
CRIWARE
Speedtree
FaceFX
Umbra3 Visibility Solution
ZLIB Library
Freetype project
Granny Animation
Dolby Digital
Audiokinetic Wwise
Oodle

It's using either Oodle, ZLIB or CRIWARE compression. I also found the "@UTF" inside a PKG file. It's more likely Oodle or ZLIB as I think CRIWARE only helped Bungie out on making the in game cinematics using their tech.

[cra0]

Ill post this here too when I have my main pc setup ill take another look

Code: Select all

//--------------------------------------
// File: .pkg (BIG Endian)
// Author: Cra0(Cra0kalo)
// Revision: 1
// Purpose: Research
//--------------------------------------

typedef struct
{ 
  uint32    magic;  //Always 00 18 00 03
  uint16    nElementCount; 
  uint16    version; 
  uint32    unknownA;
  uint32    unknownB;
  uint32    blankA;
  uint32    flagA;
  uint32    constValA; //doesnt change?
  uint32    constValB; //count maybe const
  byte      stampText[132];
} PK_Header; 



//File Attribute Table (FAT) ???
typedef struct
{ 
  uint32    unknownA;
  uint32    unknownB;
  uint32    unknownC;
  uint32    dataPointer; //points to data
  uint32    unkParA;
  uint32    unkParB;
  byte      chunk[20];
} PK_FATEntryA; 

typedef struct
{ 
  uint32    unknownA;
  uint32    dataPointer; //points to data
  byte      chunk[20];
} PK_FATEntryB; 


BigEndian();
PK_Header header;
PK_FATEntryA entry1;
PK_FATEntryB entry2;
PK_FATEntryB entry3;

[aluigi]

Apparently the format was very simple.
The only problem are the encrypted files.
Script:
http://aluigi.org/papers/bms/others/destiny.bms

[ili]

nice some wav have already readable other get rifx in middle files
wavscan bms work

[cra0]

so they store it in blocks up to 256kb hmm interesting

updated 010 editor script

Code: Select all

//--------------------------------------
// File: .pkg (BIG Endian)
// Author: Cra0kalo, Aluigi 
// Revision: 1
// Purpose: Research
//--------------------------------------

typedef struct
{ 
  uint32    magic;  //Always 00 18 00 03
  uint16    nElementCount; 
  uint16    version; 
  uint32    unknownA;
  uint32    unknownB;
  uint32    blankA;
  uint32    flagA;
  uint32    constValA; //doesnt change?
  uint32    constValB; //count maybe const
  byte      stampText[132];
} PK_Header; 



//File Attribute Table (FAT) ???
typedef struct
{ 
  uint32    unknownA;
  uint32    unknownB;
  uint32    unknownC;
  uint32    dataPointer; //points to data
  uint32    unkParA;
  uint32    unkParB;
  byte      chunk[20];
} PK_FATStringTableDesc; 


//Points the ArcEntries?
typedef struct
{ 
  uint32    entryBlockCount;
  uint32    entryBlockLocation; //points to entry start
  byte      chunk[20];
} PK_FATEntryDesc; 

typedef struct
{
  uint32    offset;
  uint32    size;
  uint32    flag; //256-> encrypted
  byte      hash[20];
} PK_Entry;


typedef struct
{
  uint32    flagA;
  uint32    flagB;
  byte      text[60];
} PK_UnknownTag;



BigEndian();
PK_Header header;
PK_FATStringTableDesc strTable; //Encrypted (Prob file names?)
PK_FATEntryDesc entryDescriptor; //Chunks or entries
PK_FATEntryDesc entryText; //??


FSeek(entryDescriptor.entryBlockLocation);
local int i;
for(i=0;i < entryDescriptor.entryBlockCount; i++)
{
    PK_Entry pkentry;
}

FSeek(entryText.entryBlockLocation);
local int j;
for(j=0;j < entryText.entryBlockCount; j++)
{
    PK_UnknownTag pktxt;
}

Luigi take a look at the string dump from the xex
http://www.cra0.net/crude/Str_dump.zip

just looking through it quickly things of interest

Code: Select all

.rdata:820D90A8  00000014 C pk\\rsa\\rsa_import.c    
.rdata:82006130  0000004B C If you see this, email andrea@bungie.com now and DO NOT TOUCH YOUR DEVKIT!   (< hehe)
.rdata:820D93D8  00000042 C c:\\bungie\\external_libraries\\libtom-work-1.1\\hashes\\sha2\\sha224.c  

[aluigi]

I think that for the hashing of the strings they used just sha1 because sha224 should be 28 bytes long.

[LordNazo]

I managed to rip out audio files from other PKG archives. Here's a 10MB sample from the globals audio package on the Xbox 360 version.

http://www53.zippyshare.com/v/47474961/file.html

Which PKG archive did you rip the audio from and how did you manage to do it? I only keep getting .DAT files when using the Destiny BMS script. Please help!

Also, has anyone extracted the compatibility packs for the Xbox 360? I'm interested in grabbing some of the audio from The Taken King, The Dark Below, and House of Wolves DLCs.

[apollon08170]

Hello

It's possible to decrypt the name of files with Hashcat if i find the hash inside the Pkg ?

I try with a HEX tool, but it's hard to understand where is complete hash in PKG files

Do you have an idea please ?
Or is a work with no issue ?