EVE Echoes - Netease - npk/nxpk

[h0m3us3r]

Trying to extract the resources of the newly released EVE Echoes game by Netease. It appears to be using .npk (NXPK), but the http://aluigi.altervista.org/bms/nxpk.bms failed. Full OOB sample here: https://mega.nz/file/9v4nybKQ#CP0puuSF1FpDzMsTvQSbYyDeNaO2gfuTAvwhZH7jGCs. There is no "script.npk", all files are "resX.npk" where X is 0..12

QuickBMS output:

Code: Select all

QuickBMS generic files extractor and reimporter 0.10.1
by Luigi Auriemma
e-mail: me@aluigi.org
web:    aluigi.org
        (Oct 20 2019 - 14:53:23)

                          quickbms.com  Homepage
                            zenhax.com  ZenHAX Forum
                     @zenhax @quickbms  Twitter & Scripts

- GUI mode activated, remember that the tool works also from command-line
  where are available various options like folder scanning, filters and so on

- select BMS script. type ? for using the content of clipboard like a script
- select input archives/files, type * for the whole folder and subfolders
- select output folder where extracting files
- open input file ...\main.36.com.netease.eve.en\res0.npk
- open script ...\main.36.com.netease.eve.en\nxpk.bms
- set output folder ...\main.36.com.netease.eve.en\res0

  offset   filesize   filename
--------------------------------------
- enter in folder ...\main.36.com.netease.eve.en
- open input file ...\main.36.com.netease.eve.en\res0.hash
- enter in folder ...\main.36.com.netease.eve.en
- open input file ...\main.36.com.netease.eve.en\res0.npk.info
- enter in folder ...\main.36.com.netease.eve.en
- open input file ...\main.36.com.netease.eve.en\res0.npk.map
  00060e98 2818       00000000.dat

Error: the compressed zlib/deflate input is wrong or incomplete (-3)
Info:  algorithm   1
       offset      00060e98
       input size  0x0111de7c 17948284
       output size 0x00000b02 2818
       result      0xffffffff -1

Error: the uncompressed data (-1) is bigger than the allocated buffer (2818)
       It usually means that data is not compressed or uses another algorithm

Last script line before the error or that produced the error:
  198 clog NAME OFFSET ZSIZE SIZE FILENUM

Press ENTER or close the window to quit

Filelist:


Hex:


EDIT:
Found "script.npk" in the apk itself. Link: https://mega.nz/file/tqJgHYoB#VeR_fT8apQ3sSswlo7oLhCwTnWd9YgyRAhobPyHDnYY. Unfortunately, "nxpk.bms" still fails with same output.

EDIT2:
From the game logs:

Code: Select all

...
[18:28:23.408] M [CLIENT] Initializing client....
[18:28:23.410] M [GAME] Init utils.dll (1063838562)
[18:28:23.438] M [CLIENT] needRemoveShader : 0
[18:28:23.446] M [GAME] NeoXRoot is /storage/emulated/0/Android/data/com.netease.eve.en/files/neox
[18:28:23.446] M [GAME] NeoXRoot is /storage/emulated/0/Android/data/com.netease.eve.en/files/neox
[18:28:23.455] M [FILESYSTEM] Succeeded to create FileLoader, opener os, loader discrete, root \storage\emulated\0\Android\data\com.netease.eve.en\files\neox\Documents\res, depth 0
[18:28:23.456] M [FILESYSTEM] Succeeded to create FileLoader, opener os, loader evepatch, root \storage\emulated\0\Android\data\com.netease.eve.en\files\neox\Documents\0\1, depth 0
[18:28:23.456] M [FILESYSTEM] Succeeded to create FileLoader, opener os, loader discrete, root \storage\emulated\0\Android\data\com.netease.eve.en\files\neox\res, depth 0
[18:28:23.456] M [FILESYSTEM] Succeeded to create FileLoader, opener asset, loader discrete, root res, depth 0
[18:28:24.241] M [FILESYSTEM] Package res12.npk (size 76533152) under opener zip is loaded.
[18:28:24.241] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res12, depth 0
[18:28:24.244] M [FILESYSTEM] Package res11.npk (size 165473704) under opener zip is loaded.
[18:28:24.244] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res11, depth 0
[18:28:24.245] M [FILESYSTEM] Package res10.npk (size 144654512) under opener zip is loaded.
[18:28:24.245] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res10, depth 0
[18:28:24.246] M [FILESYSTEM] Package res6.npk (size 157695224) under opener zip is loaded.
[18:28:24.247] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res6, depth 0
[18:28:24.248] M [FILESYSTEM] Package res7.npk (size 113660916) under opener zip is loaded.
[18:28:24.248] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res7, depth 0
[18:28:24.250] M [FILESYSTEM] Package res5.npk (size 167323528) under opener zip is loaded.
[18:28:24.250] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res5, depth 0
[18:28:24.257] M [FILESYSTEM] Package res4.npk (size 128455124) under opener zip is loaded.
[18:28:24.257] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res4, depth 0
[18:28:24.262] M [FILESYSTEM] Package res0.npk (size 112135812) under opener zip is loaded.
[18:28:24.262] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res0, depth 0
[18:28:24.268] M [FILESYSTEM] Package res1.npk (size 67163716) under opener zip is loaded.
[18:28:24.268] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res1, depth 0
[18:28:24.274] M [FILESYSTEM] Package res3.npk (size 84132652) under opener zip is loaded.
[18:28:24.274] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res3, depth 0
[18:28:24.279] M [FILESYSTEM] Package res2.npk (size 71766996) under opener zip is loaded.
[18:28:24.279] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res2, depth 0
[18:28:24.281] M [FILESYSTEM] Package res9.npk (size 188010980) under opener zip is loaded.
[18:28:24.281] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res9, depth 0
[18:28:24.283] M [FILESYSTEM] Package res8.npk (size 188059712) under opener zip is loaded.
[18:28:24.283] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader npk, root res8, depth 0
[18:28:24.284] M [FILESYSTEM] Succeeded to create FileLoader, opener obb, loader discrete, root res, depth 0
[18:28:24.284] M [FILESYSTEM] Succeeded to create FileLoader, opener os, loader evepatch, root \storage\emulated\0\Android\data\com.netease.eve.en\files\neox\Documents\0\0, depth 0
[18:28:24.288] M [FILESYSTEM] Package script.npk (size 10838012) under opener asset is loaded.
[18:28:24.288] M [FILESYSTEM] Succeeded to create FileLoader, opener asset, loader npk, root script, depth 0
[18:28:24.289] M [GAME] Init utils.dll (1063838562)
[18:28:24.289] M [GAME] Start utils.dll
[18:28:24.289] M [GAME] Init render.dll (1202430036)
...

[Ekey]

The data in the file you uploaded is encrypted.

[h0m3us3r]

Which file as I uploaded quite a few? "script.npk"?

[Ekey]

Which file as I uploaded quite a few? "script.npk"?

Yep, i was look only this file

[Ekey]

Code: Select all

# EVE Echoes NPK (NXPK) format
# Modified version of http://aluigi.altervista.org/bms/nxpk.bms
# script for QuickBMS http://quickbms.aluigi.org

idstring "NXPK"
get FILES long
get VER1 long
get VER2 long
get VER3 long

math INFO_SIZE = 0x28
get OFFSET long

# if I used this work-around it means it was necessary in a sample, don't know what sample...
get NXPK_SIZE asize
if OFFSET u> NXPK_SIZE
    xmath OFFSET "NXPK_SIZE - (FILES * INFO_SIZE)"
endif

goto OFFSET
for i = 0 < FILES
    get NAME_CRC longlong
    get OFFSET long
    get ZSIZE long
    get SIZE long
    get ZCRC long
    get CRC long

    get DUMMY long
    get DUMMY long
    get ZFLAGS long

    if ZFLAGS == 2
        comtype lz4
    else    # 0
        comtype zlib
    endif

    if SIZE == ZSIZE
        log "" OFFSET SIZE
    else
        clog "" OFFSET ZSIZE SIZE
    endif
next i

PS: script.npk not supported because it is encrypted, also there no file names (only hashes).

Edited*: I looked at part of the code of loading files and see RC4 or XOR are used as encryption (neox::Npk2Reader::Load)
I don't see a static key, probably it's dynamic



Edited2*: > You can also follow to this project > https://github.com/xforce/neox-tools

[h0m3us3r]

Thank you!

Quick question: how to skip the extraction of file with a specific magic?

EDIT: Also, encryption type is determined by the 0x26 byte of the file, and is is ZERO for all files in the script.npk. Also, all files extracted from it have 1D 04 magic. Also, a txt file was extracted which Im attaching. This suggests that decryption is handled elsewhere...

[Ekey]

I found encryption algo for scripts, this is rotor + fliping bytes. The TXT you attached is a list of files in the archive, since it does not contain names, only hashes. For decrypt script files use next script :

Code: Select all

# EVE Echoes (scripts decryptor)
# script for QuickBMS http://quickbms.aluigi.org

set MEMORY_FILE10 string "
void neox_flip(unsigned char *lpBuffer, int dwSize)
{
   for(int i = 0; i < 128; i++){
      lpBuffer[i] ^= 0x9A;
   }

   int j = dwSize - 1;
   for(int i = 0; i < dwSize / 2; i++, j--){
      unsigned char bTemp1 = lpBuffer[i];
      unsigned char bTemp2 = lpBuffer[j];
      lpBuffer[i] = bTemp2;
      lpBuffer[j] = bTemp1;
   }
}"

comtype zlib_noerror
encryption rotor "j2h56ogodh3sej2h56ogodh3sej2h56ogodh3sej2h56ogodh3se=dziaq.j2h56ogodh3se|os=5v7!\"-234=dziaq.j2h56ogodh3se|os=5v7!\"-234=dziaq.j2h56ogodh3se|os=5v7!\"-234=dziaq.j2h56ogodh3se|os=5v7!\"-234=dziaq.j2h56ogodh3se|os=5v7!\"-234!#=dziaq.=dziaq.=dziaq.=dziaq.=dziaq.=dziaq.=dziaq.|os=5v7!\"-234|os=5v7!\"-234*&'"
get ZSIZE asize
clog MEMORY_FILE 0 ZSIZE ZSIZE
encryption "" ""

get SIZE asize MEMORY_FILE
calldll MEMORY_FILE10 "neox_flip" "tcc" RET MEMORY_FILE SIZE

get NAME basename
string NAME += ".dec"
log NAME 0 SIZE MEMORY_FILE

Have fun

[h0m3us3r]

Cool! One step closer. Unfortunately, this produces pyc with all opcodes mangled. One extra step is necessary to unmangle the opcodes... https://github.com/rking152/NeteaseUnpackTools/tree/master/NeteasePycObject produces almost good results, but uncompyle6 still crashes..

[Ekey]

Cool! One step closer. Unfortunately, this produces pyc with all opcodes mangled. One extra step is necessary to unmangle the opcodes... https://github.com/rking152/NeteaseUnpackTools/tree/master/NeteasePycObject produces almost good results, but uncompyle6 still crashes..

Probably they changed them for this game, anyway no ideas, sorry.

[xforce]

Cool! One step closer. Unfortunately, this produces pyc with all opcodes mangled. One extra step is necessary to unmangle the opcodes... https://github.com/rking152/NeteaseUnpackTools/tree/master/NeteasePycObject produces almost good results, but uncompyle6 still crashes..

They use a cuatomized Python version, most of the changes are the same as older games, basically just changing the opcode ids.
There are however at least 1 "new" custom opcode, which can't be mapped just by changing it.
So I have been working on getting it all done (still have to test with the latest apk release), and did have quite a bit of success.

Current state/progress can be found in this commit https://github.com/xforce/neox-tools/commit/58396369a05c9b273b34de27ba16747060ecadb3
Documentation/insturctions are lacking, I know, just have been busy with work and even getting those things working.
But more coming very soon

[CaptainJackas]

Did you by any chance managed to read the .sd files included in the .obb file?

[aener]

Did you by any chance managed to read the .sd files included in the .obb file?

Asking the right questions.
I have been trying to unpack the .sd's for a while now.

Some part from the head is "ascii" readable:

and then byte stuff follows.

Also found some old code for static data from EVE:Online https://github.com/ntt/reverence but damn that code is dense.
The important part is the fsd.py file as it does contain some words from the sd files, though it seems the static data from EO uses some kind of yaml schema - something from a comment in that code, alas there are no .sd files in EVE:Online installation.

Nothing more from me:(

[xforce]

.sd file stuff can be found here https://github.com/xforce/eve-echoes-tools