UMD/ASS

[juniocruz]

hey all
I'm with Splinter Cell Conviction, need to decompress files .UMD
how make this?

Not want make mods,,just want to decrypt and return files to the game folder,Uncompressed...
to repack Game.

I already try with Gildor.org UnUMD.exe -unpack
and returned files decrypted to the game directory, but the game does start.....


and Splinter Cell® Blacklist™
.asstrm
.ass
sounds .uax

PLS

[aluigi]

Some information from my side, in case someone wants to help or is interested.
There is a zlib compressed header at the beginning but contains only strange data that seem like 32bit obfuscated integers.
The rest is unknown data.

Trying with UEViewer returns an error about an unknown tag.

If you want post the link to the sample you sent me.

[juniocruz]

thank luigi
I discovered the problem in the gildor.org site
but do not know how to solve,,I think you and the solution...
UEViewer not support these two games....
after removing the compression with the tool Gildor and need added XOR....

this link one User says the following: http://www.gildor.org/smf/index.php/topic,458.60.html

QuickBMS extractor fails on some files like dynamicxbox.umd. Because Ubisoft mixes LZX + Zlib.
Just letting people know for future.

all data are encrypted with simple XOR key 0xB7. Add unpacked file with 0xB7 after the position 0x20000
and then put that file back to a game.

it was that I understood,,,but how to do this?? need to add xor with BMS
I do not understand anything.....

[aluigi]

Considering that the guys on gildor are working on this, it's better if they continue.
I pass.

[juniocruz]

hmmm
this and old they not answer my messages...
how to use the tool QuickBMS?? to do this....
I not understand,,,You can discover it better than I.....
has two attachment BMS files to used with QuickBMS.
scc_conviction_table.bms
scc_conviction_data.bms
but I do not know how to do this....what is QuickBMS??

QuickBMS scripts created for SCC.
- Have to run 1 file at a time
- table.bms = some header file
- data.bms = actual UMD data unpacked

Doesn't work on every file but many. Still need to xor the data using gildor's key 0xB7.

xor start:
01_Market.umd = 0x20000
C05_Antonov.umd = 0x20000
Conviction.umd = 0x60000
loc-int.umd = not needed
menu.umd = 0x20000
PEC-Main.umd = 0x20000
T08_SecretLabs.umd = 0x80000

edit:
QuickBMS extractor fails on some files like dynamicxbox.umd. Because Ubisoft mixes LZX + Zlib.
Just letting people know for future.

Thanks gildor

dynamicxbox.umd
(0001) 1A4 - 593C = 0 - 10000 (10000) <-- ms lzx
..
(0011) 2EBF6 - 313F8 = A0000 - B0000 (10000) <-- ms lzx
(0012) 313F8 - 2043DA = B0000 - 2D0000 (220000) <-- this is Zlib compress, not ms lzx
(rest is ms lzx)

[aluigi]

I spent some time to make a script that does EXACTLY what the Gildor's one does but is faster and automatically "tries" to find and xor the data.

Code: Select all

# original code from Gildor

idstring "EPCK"
get DUMMY long
get UNPACKED_SIZE long
get OFFSET long
goto OFFSET
get XSIZE long
get SIZE long
get ZSIZE long
savepos OFFSET
#clog MEMORY_FILE OFFSET ZSIZE SIZE  # unused? zlib compression
math OFFSET += XSIZE
goto OFFSET

endian big
comtype xmemdecompress

get EPCK_SIZE asize
putvarchr MEMORY_FILE UNPACKED_SIZE 0
log MEMORY_FILE 0 0
append
for OFFSET = OFFSET < EPCK_SIZE
    math NEXT_OFFSET = OFFSET
    math SIZE = 0
    for STOP = 0 == 0
        goto NEXT_OFFSET
        get CHUNK_ZSIZE byte
        if CHUNK_ZSIZE == 0xFF
            get CHUNK_SIZE short
            get CHUNK_ZSIZE short
            math STOP = 1
        else
            goto NEXT_OFFSET
            get CHUNK_ZSIZE short
            math CHUNK_SIZE = 0x8000
        endif
        math SIZE += CHUNK_SIZE
        savepos NEXT_OFFSET
        math NEXT_OFFSET += CHUNK_ZSIZE
    next
    math NEXT_OFFSET += 5
    xmath ZSIZE "NEXT_OFFSET - OFFSET"
    clog MEMORY_FILE OFFSET ZSIZE SIZE
    math OFFSET = NEXT_OFFSET
next
append

set NAME string "dump_scc_data.bin"
get SIZE asize MEMORY_FILE
goto 0 MEMORY_FILE
findloc OFFSET binary "\0\0\0\0\0\0\0\0" MEMORY_FILE "" 
if OFFSET == ""
    log NAME 0 SIZE MEMORY_FILE
else
    math OFFSET x= 0x10000
    log MEMORY_FILE2 0 OFFSET MEMORY_FILE
    append
    filexor 0xb7
    xmath TMP "SIZE - OFFSET"
    log MEMORY_FILE2 OFFSET TMP MEMORY_FILE
    append
    filexor ""
    log NAME 0 SIZE MEMORY_FILE2
endif

I guess you already have the script for extracting the output file.

[juniocruz]

thank you luigi
but how can I run this script??
this will run on all files at once or one by one???
this script have to save extension with .bat ???



only to reinforce that Gildor.org spoke to me::
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
I published 2 versions of tool - with and without XOR.
Some people are used some script for some Hex editor which removed XOR key,
patched the file, and then put XOR back.
Most likey data should start at offset 0x20000.
If you have possibility, you may try to XOR all data in unpacked file with 0xB7 after the position 0x20000
and then put that file back to a game.


Conviction uses Microsoft compression library for XBox360 (XMemCompress, wrapper around LZX),
not zlib. It even uses big-endian data storage.
I don't know why they're used XBox library for PC, but it's a fact.
They should link PC game executable with XDK ...
/////////////////////////////////////////////////////////////////////////////////////////////////////

I think and this it has to be made
await contact luigi....

[aluigi]

Are you asking how to use quickbms?
There is an explanation in quickbms.txt, anyway just copy&paste:

Code: Select all

- double-click on quickbms.exe

- select the script or the plugin for the type of archive you want to
  extract, for example zip.bms if it's a zip file

- select the input archive or multiple files
  you can also select a whole folder by entering in it and then typing
  * or "" in the "File name:" field, and select Open

- select the output folder where extracting the files
  you can specify any filename, it will be ignored because only the
  directory is taken

- watch the progress status of the extraction

[juniocruz]

then this script and run with your quickbms??
only this tool I have to download??
QuickBMS generic files extractor and reimporter 0.6 (quickbms)

I have to save this script loke a simple text (.bms)???

sorry friends for questions
I do not know much these things just if someone show me how make...

Tak......

[aluigi]

yes, save it as .txt or .bms. and it will generate the output archive (that you need to extract with other tools/script)

[spider91]

aluigi

It seems he want game to work with decompressed files, but it wouldn't work that way, couse your script only extracts data without toc. not even sure thats possible, but if it is toc must be changed to way game accept decompressed EPCK files.

[juniocruz]

Tks..
yes i want it for PC,, only remove the original compression,, to do repack the game with my compressor FreeArc...

I executed the script with the bms but nothing occurs....




detail
not need extract all file umd,, stay enormous size and not will work
only decrypt so using: unpackumd.exe -unpack
and then generated the same file,, however doubles the size.....

[aluigi]

I don't know what 01_Market.umd you passed to quickbms but that's for sure wrong, it's NOT an EPCK archive.
The 01_Market.umd you provided in a link is an EPCK one.

[juniocruz]

zzzZZZzzzZZZ

[juniocruz]

hmmm
then need run the script on file umd original??? without -unpack......

I executed with original file,, so changed the extension to bin,, is this? dump_scc_data.bin

and now what to do?? need back to umd now??



hey luigi only the first file is running 01_Market.umd,,, others are giving error .....

[aluigi]

Sorry I'm no longer interested in this thing.
Contact Gildor.

[juniocruz]

okay
I no will insist ...
if this is difficult,, then i will try take the compression of audios....

you can answer my new topic: how to remove the compression audios???
http://zenhax.com/viewtopic.php?f=6&t=270


seems you have the tool to cpk?

thank luigi..

[aluigi]

I don't think that the files have been created with the CRI middleware (in that case yes you can use cpk.bms).

I think that you need DecUbiSndGui like the other Splinter Cell and Ubisoft games:
https://bitbucket.org/Zenchreal/decubisnd/downloads

[juniocruz]

DecUbiSndGui just extract the files,, but not know how repackage files again....
need back to original format???

I tried with also quickbms cpk.bms
http://aluigi.altervista.org/papers/bms/cpk.bms

but not extracted files.....

[makc_ar]

I spent some time to make a script that does EXACTLY what the Gildor's one does but is faster and automatically "tries" to find and xor the data.

Code: Select all

# original code from Gildor

idstring "EPCK"
get DUMMY long
get UNPACKED_SIZE long
get OFFSET long
goto OFFSET
get XSIZE long
get SIZE long
get ZSIZE long
savepos OFFSET
#clog MEMORY_FILE OFFSET ZSIZE SIZE  # unused? zlib compression
math OFFSET += XSIZE
goto OFFSET

endian big
comtype xmemdecompress

get EPCK_SIZE asize
putvarchr MEMORY_FILE UNPACKED_SIZE 0
log MEMORY_FILE 0 0
append
for OFFSET = OFFSET < EPCK_SIZE
    math NEXT_OFFSET = OFFSET
    math SIZE = 0
    for STOP = 0 == 0
        goto NEXT_OFFSET
        get CHUNK_ZSIZE byte
        if CHUNK_ZSIZE == 0xFF
            get CHUNK_SIZE short
            get CHUNK_ZSIZE short
            math STOP = 1
        else
            goto NEXT_OFFSET
            get CHUNK_ZSIZE short
            math CHUNK_SIZE = 0x8000
        endif
        math SIZE += CHUNK_SIZE
        savepos NEXT_OFFSET
        math NEXT_OFFSET += CHUNK_ZSIZE
    next
    math NEXT_OFFSET += 5
    xmath ZSIZE "NEXT_OFFSET - OFFSET"
    clog MEMORY_FILE OFFSET ZSIZE SIZE
    math OFFSET = NEXT_OFFSET
next
append

set NAME string "dump_scc_data.bin"
get SIZE asize MEMORY_FILE
goto 0 MEMORY_FILE
findloc OFFSET binary "\0\0\0\0\0\0\0\0" MEMORY_FILE "" 
if OFFSET == ""
    log NAME 0 SIZE MEMORY_FILE
else
    math OFFSET x= 0x10000
    log MEMORY_FILE2 0 OFFSET MEMORY_FILE
    append
    filexor 0xb7
    xmath TMP "SIZE - OFFSET"
    log MEMORY_FILE2 OFFSET TMP MEMORY_FILE
    append
    filexor ""
    log NAME 0 SIZE MEMORY_FILE2
endif

I guess you already have the script for extracting the output file.

How about to .bin script?