Killzone 2 - .core files bms script?

[n1nonly1]

hello,
i have been trying to extract models from killzone 2 for a long time (renderdoc is successful but no uvs) so im turning to a quickbms script.
using these scripts

Code: Select all

 Killzone Shadow Fall \x83\xc1\x10\xcb compressed files
# script for QuickBMS http://quickbms.aluigi.org

comtype lz4
idstring "\x83\xc1\x10\xcb"
get CHUNK_SIZE long
get SIZE longlong
getdstring DUMMY 0x10

get NAME basename
get EXT extension
string NAME p "%s_unpack.%s" NAME EXT

xmath CHUNKS "SIZE / CHUNK_SIZE"
if SIZE % CHUNK_SIZE
    math CHUNKS + 1
endif

savepos TMP
xmath OFFSET "TMP + (CHUNKS * 4)"

log NAME 0 0
append
for x = 0 < CHUNKS
    get CHUNK_ZSIZE long
    if CHUNK_ZSIZE == 0 # ???
        math CHUNK_ZSIZE = CHUNK_SIZE
    endif
    if CHUNK_ZSIZE >= CHUNK_SIZE
        log NAME OFFSET CHUNK_SIZE  # ???
    else
        clog NAME OFFSET CHUNK_ZSIZE CHUNK_SIZE
    endif
    math OFFSET + CHUNK_ZSIZE
next x
append

Code: Select all

# Killzone Liberation (script 0.2.2)
# script for QuickBMS http://quickbms.aluigi.org

get ARCHIVE_NAME basename

get INFO_SIZE long
get DUMMY long
get DUMMY long
get DUMMY long
get ZERO long
get ZERO long

get NAMES_SIZE long
savepos OFFSET
log MEMORY_FILE OFFSET NAMES_SIZE

math OFFSET + NAMES_SIZE
goto OFFSET

get INFO_SIZE long
savepos OFFSET
log MEMORY_FILE2 OFFSET INFO_SIZE

get ENTRIES long MEMORY_FILE2
savepos OFFSET MEMORY_FILE2
set PATH string ""
set NAME string ""
putarray 0 0 0  # nested function
callfunction EXTRACT

startfunction EXTRACT
    savepos BCK_OFF MEMORY_FILE2
    goto OFFSET MEMORY_FILE2
    string PATH + NAME
    string PATH + /
    for CUR_ENTRIES = ENTRIES > 0
        get NAME_OFF long MEMORY_FILE2
        math FLAGS = NAME_OFF
        xmath NAME_OFF "NAME_OFF & ((1 << 23) - 1)"
        goto NAME_OFF MEMORY_FILE
        get NAME string MEMORY_FILE
        get OFFSET long MEMORY_FILE2
        if FLAGS & 0x80000000
            get ENTRIES long MEMORY_FILE2
            callfunction EXTRACT
        else
            callfunction HANDLE_PACK_NUM 1
            get SIZE long MEMORY_FILE2
            string NAME p "%s%s" PATH NAME
            set EXT extension NAME
            if EXT == "core" && ARCHIVE_NAME == "psp"
                goto OFFSET
                get ZERO long   # probably XSIZE64
                get XSIZE long
                reverselong XSIZE
                math OFFSET + 8
                math SIZE   - 8
                clog NAME OFFSET SIZE XSIZE
            else
                log NAME OFFSET SIZE
            endif
        endif
    prev CUR_ENTRIES
    goto BCK_OFF MEMORY_FILE2
endfunction

startfunction HANDLE_PACK_NUM
    xmath PACK_NUM "(FLAGS >> 23) & 0x1f"
    getarray LAST_PACK_NUM 0 0
    if PACK_NUM != LAST_PACK_NUM
        putarray 0 0 PACK_NUM
        get EXT extension
        if PACK_NUM == 0
            string TMP p "%s.%s" ARCHIVE_NAME EXT
        else
            string TMP p "%s%02d.%s" ARCHIVE_NAME PACK_NUM EXT
        endif
        open FDSE TMP
    endif
endfunction

however, these 2 scripts have proven unsucessful, (im guessing because the RTTIbin version is different) so im turning to the community for help. any other way to extract this model? samples are available in this drive https://drive.google.com/drive/folders/ ... sp=sharing
please pm me if you have any questions, or reply to this post.

[n1nonly1]

im aware that one particular user (luxox18) manage to extract various models from the game, and im trying to replicate what he did however i just cant find enough information. im guessing this has to do with my experience too (not very experienced)
with renderdoc, after stretching and deleting double vertices, you can get something like this:https://imgur.com/a/B0eYITP
but the problem is the uv's...https://imgur.com/a/XseS3Ha
so thats one of the main problems. however renderdoc does give you the textures (model textures, normal maps, etc)

[h3x3r]

Those bms scripts are not for *.core files. That's the reason why you can't unpack it.

[n1nonly1]

yes im aware. (.core files from killzone sf are a whole different format)

[n1nonly1]

please do correct me if im wrong, but i think i found the start of vertices https://imgur.com/a/lWzepOt
and the end of vertices https://imgur.com/a/olpCdJV

some (a lot of) lines above we have what i assume are face indices (start) https://imgur.com/a/vKeU2zo

i will definitely need some help here so again, please do correct me if im wrong.

edit: also im unsure if its data type is sequencial or blocked (seperate or structured)

[h3x3r]

I am doing full struct research. But BigEndian make it worse. For FACE INDICES you are right. But still don't know if they are tri strips.
Sems like "00 00 00 ? 00 00 00 21 00 00 00" is involved as magic for vertices/uv's/normals and maybe more... If you search this as hex with Wildcarts you get atleast estimated offset.