kingdom under fire 2 .PKG

[godskin]

Web : http://kuf2.changyou.com/main.shtml



Need unpack .PKG
Sample File : https://drive.google.com/open?id=0B0b7s ... nZaUnlTMVU

[aluigi]

http://aluigi.org/bms/kingdom_under_fire_2.bms

[godskin]

http://aluigi.org/bms/kingdom_under_fire_2.bms

thank you ^ ^

[Googlemo]

I don't know why but it isn't working... Here is an error I get while trying to open the same file(but from the latest client):
http://prntscr.com/fhdl1z

Here is file from latest client:
https://yadi.sk/d/yNBlRNES3JwPaP

[aluigi]

Unfortunately it looks like now the table with the information about the archived files is encrypted.
offzip -a -c 65536 can be a good work-around to extract the files anyway.

[paercen]

Hi, I also have a question
I can't find KUF2 game icons in files.
Icon - that's images of skills, items and etc. They usually have size 64x64.

I use "offzip -a -c 65536" as you said. Sometimes I see errors with text "try offzip -z 15" but that doesn't work
I check DDS files, PNG and BMP in all packages and no result.
Maybe offzip skips some files?

Link to file that gives an error - https://cloud.mail.ru/public/9eJb/uCUWVhmoj

ERROR:
. 0x0005f0be
- zlib Z_DATA_ERROR, the data in the file is not in zip format
or uses a different windowBits value (-z). Try to use -z -15

[aluigi]

It's all correct, you can ignore that message.

[paercen]

Thanks.
Maybe somebody helps with icons? Where are they?

[Googlemo]

Here is links to the whole client:
https://yadi.sk/d/pcJa_jXt3K5Dwe
https://yadi.sk/d/Op0SizYg3K5Dz4

Would be awesome if someone can direct me to game icons...

[lelicopter]

today was update KUF2. link above not so actual. (but update was installed at this client well)

[dron4938]

Need unpack .PKG please
Sample File : https://yadi.sk/d/Hr384ciw3NvCMf

[aluigi]

That file seems to have an encrypted TOC (the table with information about the archived files).
That's why the script doesn't work on it.
The only solution is using offzip -a.

[dron4938]

after unpacking a bunch of files with random names.
how to decode .bsv and how to pack back?
thank you
Sample File .bsv : https://yadi.sk/d/qOo7hw0D3Nxvoz

[Ekey]

That file seems to have an encrypted TOC (the table with information about the archived files).
That's why the script doesn't work on it.
The only solution is using offzip -a.

Yeah, there two tables is encrypted. I wrote two functions for decrypt their.

Code: Select all

uint32_t kuf2_fs_decrypt_entry(uint8_t *pBuffer, uint32_t dwTableSize, uint32_t dwArchiveSize)
{
   uint32_t dwResult1;
   uint32_t dwResult2;
   uint32_t dwResult3;
   uint32_t dwResult4;
   uint32_t dwSeed = dwArchiveSize;

   uint32_t dwBlockSize = 24;
   uint32_t dwBlockCount = dwTableSize / dwBlockSize;

   for (uint32_t i = 0; i < dwBlockCount; i++, pBuffer += dwBlockSize) 
   {
      dwResult1 = 0x19660D * dwSeed + 0x3C6EF35F;
      *(uint64_t *)(pBuffer + 0) += dwResult1;

      dwResult2 = 0x19660D * dwResult1 + 0x3C6EF35F;
      *(uint32_t *)(pBuffer + 8) += dwResult2;

      dwResult3 = 0x19660D * dwResult2 + 0x3C6EF35F;
      *(uint32_t *)(pBuffer + 12) += dwResult3;

      dwResult4 = 0x19660D * dwResult3 + 0x3C6EF35F;
      *(uint32_t *)(pBuffer + 16) += dwResult4;

      dwSeed = 0x19660D * dwResult4 + 0x3C6EF35F;
      *(uint32_t *)(pBuffer + 20) += dwSeed;
   }
   return dwSeed;
}

Code: Select all

void kuf2_fs_decrypt_subentry(uint8_t *pBuffer, uint32_t dwTableSize, uint32_t dwSeed)
{
   uint32_t dwResult1;
   uint32_t dwResult2;
   uint32_t dwResult3;

   uint32_t dwBlockSize = 12;
   uint32_t dwBlockCount = dwTableSize / dwBlockSize;

   for (uint32_t i = 0; i < dwBlockCount; i++, pBuffer += dwBlockSize) 
   {
      dwResult1 = 0x19660D * dwSeed + 0x3C6EF35F;
      *(uint32_t *)(pBuffer + 0) += dwResult1;

      dwResult2 = 0x19660D * dwResult1 + 0x3C6EF35F;
      *(uint32_t *)(pBuffer + 4) += dwResult2;

      dwSeed = 0x19660D * dwResult2 + 0x3C6EF35F;
      *(uint32_t *)(pBuffer + 8) += dwSeed;
   }
}

First function for decrypt table with values:

Code: Select all

    get SOME_CRC longlong
    get ZSIZE long
    get SIZE long
    get ID long
    get ZERO long

Second for

Code: Select all

        get CHUNK_OFF long
        get CHUNK_ZSIZE long
        get CHUNK_SIZE long

Sample:

Code: Select all

//First table
dwSeed = kuf2_fs_decrypt_entry(pBuffer, dwTableSize, dwArchiveSize);

//Second table
kuf2_fs_decrypt_subentry(pBuffer, dwTableSize, dwSeed);

Sorry for necropost

[aluigi]

Excellent job as usual
Script 0.2:
http://aluigi.org/bms/kingdom_under_fire_2.bms

[noazett]

Hi, the US version of the game has been released this week. so i'm posting a sample pkg file. I really hope someone can look to the package and make and extractor tool for it.
https://drive.google.com/file/d/1JXr2nC ... sp=sharing
Thank you

[WollieWoltaz]

Doesn't the tool Aluige provided work?
Btw.. is this game made with Unreal Engine or?

[Amagakuro]

Quickbms works although files have no names and "useless" extension apart from the .dds, maybe the tables have a different encyption?

Doesn't the tool Aluige provided work?
Btw.. is this game made with Unreal Engine or?

Sadly no... it uses the old engine (Blueside engine), what a pity, i was really looking forward an engine change.

[Ekey]

Quickbms works although files have no names and "useless" extension apart from the .dds, maybe the tables have a different encyption?

Archives do not contain file names, only hashes. Therefore, QuickBMS unpack files with unknown names

[Pepita]

Sadly the old Script wont work anymore. I uploade example File + Binary just in Case someone of you can take a look!

https://mega.nz/#!XMpyzAwA!NkeuiTS0jhJ9 ... RYE2DSZeKg