WarInc, WarZ/Infestation, DeadZ, StargateZ and others

[aluigi]

It's a custom obfuscation so no way to figure out it easily without reverse engineering.
But it's possible to (ab)use a bug in the obfuscation and a particular feature of the format for guessing the 128 bytes used for encrypting the data, in fact this sort of key changes for every entry so it's necessary to calculate the new one every time... you have been very lucky this time.
Download the script version 0.1.21
http://aluigi.org/bms/warinc.bms

[arowsky]

Dude, you are crazy Thanks man!

[aluigi]

Script 0.1.21a, it's an important fix so redownload the script and run it again.
Now ALL the files are correctly extracted except 32 files (directx shaders cache) that are skipped... 32 on 30900 is not bad at all

[mariana12]

https://ufile.io/nl91d

Update script.

[aluigi]

@mariana12
please upload the 2 files generated by http://aluigi.org/bms/filecutter.bms on ez_01.bin

[tiktokzzz]

sir aluigi can you help me please.
i can't exctract .bin file.
this file https://drive.google.com/file/d/19tseJv ... sp=sharing
Error: unknown TYPE 99, contact me

- 0 files found in 0 seconds
coverage file 0 2199% 6748904 306786 . offset 0000001c
coverage file 1 0% 0 1073741822 . offset 00000000
coverage file -1 0% 865 4612864 . offset 00000128

Press ENTER or close the window to quit

[aluigi]

@tiktokzzz
same thing I wrote in my previous post

[tiktokzzz]

[tiktokzzz]

this last version warinc.bms don't work.

[tiktokzzz]

[aluigi]

please upload the 2 files generated by http://aluigi.org/bms/filecutter.bms on ez_01.bin

[tiktokzzz]

Here it is https://drive.google.com/file/d/15E22rk ... sp=sharing
Thank you very much.

[aluigi]

The format can't be supported because the OFFSET field used in it is fake.
Example of the data meant to be at the real offset 0x150ac but said to be at 0x8ba7:

Code: Select all

. 00000378 getdstr NAME       "avutil-50.dll" 260
    61 76 75 74 69 6c 2d 35 30 2e 64 6c 6c 00 00 00   avutil-50.dll...
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00                                       ....
. 0000047c get     TYPE       0x00000063 1
.
. 0000047d get     PACK       0x00000000 1
. 0000047e get     SIZE       0x00017a0e 4
. 00000482 get     OFFSET     0x00008ba7 4
. 00000486 get     CRC        0x988dbb38 4
. 0000048a get     ZSIZE      0x0000d5ba 4
. 0000048e getdstr DUMMY      "" 18
    01 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00                                             ..

[tiktokzzz]

What should I do for extract this file.

[aluigi]

Anyway I have updated the script for ignoring the error with type 99 just in case the file provided by you and the other user are not related, that would explain why the offset is different
http://aluigi.org/bms/warinc.bms

[tiktokzzz]

:'(

[Gamerioder]

Hello.
ViralHZ not unpack don't working.


VHZ_00.bin = https://ufile.io/5xhag

help me!

[oneped555]

https://ufile.io/4nwgc

Update script.

[aluigi]

@oneped555
At line 324 of the script replace 0x12 with 0x62:
getdstring DUMMY 0x62 MEMORY_FILE

[oneped555]

Thank You

https://ufile.io/7c3n6

Update script.