Total War: Attila - pak

[AlphaTwentyThree]

Hi there!
Can somebody take a look at the pak archives from this game? I don't know how to read the TOC. :\
Here's a sample snippet: http://*USE_ANOTHER_FILEHOSTING*/c37bc64 ... a/sound.7z
Thanks!

[aluigi]

http://aluigi.org/papers/bms/others/tot ... attila.bms

[AlphaTwentyThree]

Thanks Luigi!

[AlphaTwentyThree]

There seems to be a problem with the music archive: http://*USE_ANOTHER_FILEHOSTING*/0bb0da3 ... .pack_16mb
Are the files encrypted?

[aluigi]

I'm not really sure if it's obfuscated.
For sure it's not a block cipher algorithm and not a compression.
Maybe it's just a particular codec?

[AlphaTwentyThree]

The weird thing is that the wem and bnk files have the same structure (16bytes repeating structure at the start) but of course the bnk files should begin with a BKHD identifier. Take a look: http://*USE_ANOTHER_FILEHOSTING*/1f93014 ... wem_bnk.7z
That's why I suspected some kind of encryption.
The problem only occurs with the music.pack and music_en_shared_rome2.pack.

[AlphaTwentyThree]

Here are samples of both types of bnk archives: http://*USE_ANOTHER_FILEHOSTING*/f7ca0f8 ... samples.7z

[aluigi]

Ok, it's an obfuscation.
The files are xored with a sequence of bytes that starts with: f2 6d 59 bf a6 67 bb b0 82 dd 24 ba ...
The key is the same for both bnk and wem files but I think it's generated at runtime.

[AlphaTwentyThree]

Is it possible to obtain that key through the executable file? http://*USE_ANOTHER_FILEHOSTING*/9d514b9 ... /Attila.7z

[aluigi]

I already tried it (attila.dll)

[Mygoshi]

I wanted to help you but I don't think I'm experienced enough ^^

[AlphaTwentyThree]

Well, thanks for trying anyway

[Mygoshi]

:/