Elminage .bin

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Elminage .bin

Post by Arcane »

Here's four samples from one of the folders of Elminage Original for PSP's data files.

parts.bin: No idea.
scp.bin: A lot of strings. Dialogue, I think.
etc.bin: A lot more strings. Quests and towns?
btl.bin: tga files, gimconv stuff?

There are alternate versions in another folder, but those seem to be encrypted and.. backups? or something.

This game makes no sense, ingame or out. It'd be cool to have some ability to poke around, though.
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

There are csv files in the archive. Here's Items.csv from the DS version, which is contained in etc.bin, except the DS version is untranslated.

File syntax is the same, though.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Elminage .bin

Post by aluigi »

The table from offset 0x18 of the bin archives is obfuscated.
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

It turns out Gothic works the same way. It has a PC English release, and the entire game's text is in script files.

Maybe it's less obfuscated.

Attached are two samples, one from the compressed folder (the scripts the game actually reads) and the uncompressed folder (the ones the game doesn't read, basically source), as well as an extra file that comes with the game's patch, also in the uncompressed folder.

edit: It's very possible that this is a DRM issue. Decrypting doesn't seem to be a problem, whereas re-encrypting is.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Elminage .bin

Post by aluigi »

Can you upload also the executable?
Maybe it's just a fixed long xor key, don't know.
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

No problem! Here's the eboot, already decrypted.

the key for parts.bin according to JPCSP is 31fd9ec29ebf0d31b1c97233b94ea65e. It previously told users to use the PSP to decrypt files with a plugin, but now it's doing decryption without posting a log of it.

There's some source that I haven't been able to wrap my head around at https://code.google.com/p/jpcsp/source/ ... o/PGD.java

and here's this thing from another forum:

[PGD File header]:
Code:
0x00: 00 50 47 44 01 00 00 00 01 00 00 00 00 00 00 00 -> " PGD" and three bit fields that act as flags for version and encryption mode.
0x10: AES-128 bit hash key used for header decryption.
0x20: Generated hash from the 0x10 key.
0x30 - 0x50: Encrypted header of the PGD which when decrypted reveals a new hash key and four bit fields. The first is NULL, the second represents the decrypted data size, the third is the decrypting chunk size and the fourth is the data hash address.
0x60: File hash.
0x70: Hash generated from the sceIoIoctl key.
0x80: Encrypted hash generated from the sceIoIoctl key.
0x90: Data hash.
0xA0: Encrypted data hash.
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

er, whoops. The Gothic PC version doesn't load compressed files, and the PSP version does. The stuff I've uploaded has been for the PSP version.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Elminage .bin

Post by aluigi »

Don't you have the Gothic PC exe?
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

This is the EXE for the PC version. It loads files from a different format, .bra. Something it does that the PSP version unfortunately doesn't is loading loose files and overriding the archive's versions.

The idea of this whole thing is to use the PC version's scripts that I've extracted to translate the PSP version by editing the scripts, and then encrypting them again and inserting them in the ISO.

edit: It's also dumping the same encrypted copies I was wanting to inject into an install folder, so it'll be possible to get this to work on a legit PSP/Vita if this all works out.

No idea how I missed the install folder. It doesn't prompt the user to make one or anything, and it's like 300mb.

Swapping in unencrypted copies doesn't work, sadly.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Elminage .bin

Post by aluigi »

It's encrypted with Valve DRM while the eboot file doesn't have references to Mps2.
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

Yeah, the EXE is pretty much useless in any form. There's a tool called BRA Unpacker for the PC version that handles the PC version's stuff. It's the PSP version I'm trying to get at.

It's just the PGD encryption that I need to be able to do. Decryption works fine. I've got all the info I can find on PGD decryption in that post a few back.

The actual MPS2 bin filesystem is kind of a mystery, but everything important to porting the game's translation to the PSP is in plaintext stored in etc.bin/btl.bin, I believe. Once I've gotten the ability to either bypass the PGD restriction or encrypt files and have the game accept them, I should just be able to overwrite those contents with the contents of the PC version's files. Transplanting things the other way worked out, and the PC version even fell back on the PSP's old font for kanji/katakana.

I'm sorry for being confusing. I've been having a lot of trouble keeping thoughts straight together lately.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Elminage .bin

Post by aluigi »

Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

That was quick and impressive! :D I can now extract files for both Original and Gothic. Thank you.

Now I know the only file that matters whatsoever is etc.bin, which contains all of the scripting. Do you know if there's any way to stuff it into a pgd given the data I've given/any other data I can give?

edit: Nope, something's off on dumping files. GIM files are getting garbage at the beginning and have to be trimmed. I can get enough from the CSV files still to get what I need already, but I figured I'd mention it.

I think it's dumping GIM files as invalid GMO files. Or at least, Noesis can't touch them.

It might be the Mps2 files that are garbage and texter is pulling them out with brute force by detecting the beginning header.

This is a sample from btl.bin extracted by Texter and by the BMS script.

This game is this confusing to play, by the way.


edit:

I don't think it's even feasible to get the PGD part working, but I'm curious about the PGD extraction's GIM output. I kinda want to dump the game's art because it's gorgeous and apparently I am the only human who cares about the games :lol:
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

http://i.imgur.com/ndCjVy9.png

:D I have stuff loading ingame.

How hard is it to expand the mps2 file and increase file sizes?

Also: mps2 files aren't being decompressed properly at all. text files are working, nothing else seems to be

if you want a sample file with a lot of gim/gmo files, i can upload one
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Elminage .bin

Post by aluigi »

Yes give me a sample and I will check it.
Arcane
Posts: 11
Joined: Thu Feb 26, 2015 9:47 pm

Re: Elminage .bin

Post by Arcane »

Here you go! It's kind of a big one, but it's by far the most important file so I figured it would be the best one to use.

http://www.filedropper.com/anime

I was going to attach it, but Time Warner and forum uploads are not compatible.

time warner and basically anything aren't compatible. grumble grumble
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Elminage .bin

Post by aluigi »

It's not an error of the script.
It looks like there is a sort of obfuscation on the first 0x20 bytes of the file but I don't understand exactly how it's made.
Take a look at offset 0xe000 of anime.bin, the file is not compressed.