[UNITY]how to unpack live2d file from Revived Witch

[Baam]

nekodata file can't extract with AssetStudio.
https://drive.google.com/file/d/1SnNzcgM8KtV-pLO1IedQhN74ghi7a6iX/view?usp=sharing

[aluigi]

In my opinion this is an archive containing various unity files.
The "magic" is "pixelneko filesystem" followed by a 32bit zero, an 8bit 0x01 and then the lz4 compressed data of the first file (I didn't check if it's really lz4, just saw the 0xfx byte).
I don't see any index table with information about the archived files so I suppose it's stored in another file with a different extension, that's what we need..

[Baam]

In my opinion this is an archive containing various unity files.
The "magic" is "pixelneko filesystem" followed by a 32bit zero, an 8bit 0x01 and then the lz4 compressed data of the first file (I didn't check if it's really lz4, just saw the 0xfx byte).
I don't see any index table with information about the archived files so I suppose it's stored in another file with a different extension, that's what we need..

I see, i only found these files in the game folder.
I apologize if i was late to reply.

[aluigi]

So the table is probably encrypted at the end of the nekodata file.
Currently I can't help but if someone will provide the details I would easily write the script.
In the meantime I confirm that all the archived files are compressed with lz4.

[Baam]

So the table is probably encrypted at the end of the nekodata file.
Currently I can't help but if someone will provide the details I would easily write the script.
In the meantime I confirm that all the archived files are compressed with lz4.

This person said this about extracting the files.

[Lico]

So the table is probably encrypted at the end of the nekodata file.
Currently I can't help but if someone will provide the details I would easily write the script.
In the meantime I confirm that all the archived files are compressed with lz4.

This person said this about extracting the files.

That person is me, I have open sourced my tool already https://github.com/lico-n/unneko
It's probably not a very SEO friendly name but when else do you have the chance to fill your code basis with neko.

[aluigi]

@Lico
Smart way for bypassing the (I guess) missing/encrypted index
So you search the compressed json that contains the table (like '{"files'), brute force its decompression increasing the size, brute force the size of each file sequentially until the obtained checksum matches the one in the json, and use the name and compressed/uncompressed sizes there for dumping it.

But is the real index stored somewhere?

[Lico]

@Lico
Smart way for bypassing the (I guess) missing/encrypted index
So you search the compressed json that contains the table (like '{"files'), brute force its decompression increasing the size, brute force the size of each file sequentially until the obtained checksum matches the one in the json, and use the name and compressed/uncompressed sizes there for dumping it.

But is the real index stored somewhere?

There is a pretty sizable datablock at the end of the nekodata file. It's pretty high entropy and not part of any decompressed file.
It grows with the number of files contained in the nekodata.

I guess this is the index but I didn't reverse engineer it. The functions to do that are in a ndk lib and trying to understand what it is doing is pain.
As long as my method is working I don't really see a need do it either way. I might take a look at it again if they break it.