TTARCH versions of the games [Telltale Games / ttarch / ttarch2]

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
quckly
Posts: 2
Joined: Mon Oct 19, 2015 4:55 pm

Re: TTARCH versions of the games

Post by quckly »

For properly encrypt lua from minecraft:

Code: Select all

int ttarch_import_lua(u8 *ext, u8 *buff, int size, u8 **outBuff, int *outSize, int encrypt) {
    if(ext && (!stricmp(ext, ".lua") || !stricmp(ext, ".lenc"))) {
        if((size >= 3) && (IS_LUA(buff) || (encrypt && gamenum >= 58))) {
         (*outBuff) = buff;
         (*outSize) = size;

         if (gamenum >= 58) {
            u8 *newbuff = malloc(sizeof(u8) * (size + 4));
            memcpy(newbuff, "\x1bLEo", 4);
            memcpy(newbuff + 4, buff, size);
            blowfish(newbuff + 4, size, encrypt);

            (*outBuff) = newbuff;
            (*outSize) = size + 4;

            //blowfish(buff, size, encrypt);
         } else if (gamenum >= 56) {
                memcpy(buff, "\x1bLEn", 4);
                blowfish(buff + 4, size - 4, encrypt);
            } else {
                blowfish(buff, size, encrypt);
            }
         return 0;
        }
    }
    return -1;
}


Code: Select all

u64 crypt_it(FILE *fd, u8 *fname, u64 offset, int wanted_size /*signed!*/, int encrypt) {
...
   u8      *outBuff = NULL;
   int      outSize = 0;
...

if(wanted_size < 0) {
        if(ttarch_import_lua(ext, buff, size, &outBuff, &outSize, encrypt) < 0) {
            blowfish(buff, size, encrypt);
        }
    } else {
        if(ttarch_import_lua(ext, buff + offset, wanted_size, &outBuff, &outSize, encrypt) < 0) {
            blowfish(buff + offset, wanted_size, encrypt);
        }
    }

   if (outBuff != NULL) {
      dumpa(fname, outBuff, outSize, NULL, 0);
      return(outSize);
   }

    dumpa(fname, buff, size, NULL, 0);
    return(size);
}


When use:
ttarchext -o -e 0 58 file.lua ..\Output
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

Thanks for the info.
Godxon 1
Posts: 37
Joined: Sat Feb 13, 2016 8:52 am

Re: TTARCH versions of the games

Post by Godxon 1 »

example batman ttarch.rar
¨
Hello Aluigi,
can you please update your tools for new Batman game?

Thank you
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

Currently the only obstacle is the compression used on the "eCTT" archives like the one you provided.

What I mean is that the chunks like the one attached to this post should decompress to 65536 bytes but I don't know what's the algorithm used.

P.S.: please note that I don't have the game
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

Uhmmm oodle...
And it's oodle 2.3.0 that still uses the same algorithms of 2.2.0 (already available in quickbms) BUT the data compressed with kraken is no longer compatible with the kraken algorithm of 2.2.0:
http://www.radgametools.com/oodlehist.htm
I guess we have the culprit even if I have made no tests yet.

*edit* it's oodle, confirmed at 100%.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

I confirm that it's necessary oodle 2.3.0 for correctly decompressing the data (exactly as I said before about kraken).
Everything works perfectly, the only downside is that I have to release ttarchext as a 64bit application because the only oodle 2.3.0 available is 64bit.
It's not a problem (Batman is 64bit only), so I guess I will finish the new version of the tool and I will release it.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

Melkor
Posts: 2
Joined: Tue Jan 05, 2016 11:26 pm

Re: TTARCH versions of the games

Post by Melkor »

aluigi wrote:Done, ttarchext 0.2.10:
http://aluigi.altervista.org/papers.htm#ttarchext


Thanks!
I know you are familiar with "You are AWESOME!" but i have to say it! YOU ARE AWESOME!!!1!!!
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

:D
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

A little note about the audio files extracted from the *ms.ttarch2 archives, the FSB files are not real fsb and the bank files contain a FEV file and FSB archive at certain offsets.
The codec of the data in the FSB archives is ogg so fsbext is not good for the job, I suggest to use this tool:
viewtopic.php?f=17&t=1901

You can use this simple script for dumping the FSB archive from the bank file:

Code: Select all

findloc OFFSET string "FSB5"
get SIZE asize
math SIZE - OFFSET
get NAME basename
string NAME + ".fsb"
log NAME OFFSET SIZE

I don't know if this confusing fsb/riff/bank/fev+fsb solution was adopted also in the previous games from Telltale.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

The idea comes from an user while I realized the script for decrypting the chunks of the eCTT/ECTT ttarch archives.

Code: Select all

# Decrypts all the chunks of the input eCTT/ECTT ttarch archive
# Usage:
# quickbms -C -w ttarch_test.bms batman\BM_pc_Arabic_txmesh.ttarch2
# The input file will be modiefied so use a backup!!!
Haoose
Posts: 68
Joined: Thu Aug 07, 2014 9:43 pm

Re: TTARCH versions of the games

Post by Haoose »

aluigi
The Walking Dead A New Frontier

Code: Select all

ttarchext.exe -k A60B31D1ACB5DF98DB72FD2FB7DF1AD0EDAFE1B8967E266A45907CBA997F2CF14799A124F76C91B3E2F2010816FC8E85D8206963694E57 0 "c:\ttarchext\WD3_pc_Boot_data.ttarch2" WD3\

- open file c:\ttarchext\WD3_pc_Boot_data.ttarch2
- set output folder WD3\
- set custom blowfish key
- found 3 compressed chunks

Error: the compressed zlib/deflate input at offset 0x0000002c (1059 -> 65536) is wrong or
incomplete

Sample: http://rgho.st/6D7V9mBBK
EXE: http://rgho.st/8JGsKrdrX
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

Haoose
Posts: 68
Joined: Thu Aug 07, 2014 9:43 pm

Re: TTARCH versions of the games

Post by Haoose »

aluigi
Perfect. Thanks!
sfaas
Posts: 14
Joined: Mon Jan 02, 2017 6:56 am

Re: TTARCH versions of the games

Post by sfaas »


hi aluigi
I want to localization for my friends. however, korean font is not supported.
i want to know how to change .font file or how to create.
Is it possible?
(i'm try localization for minecraft story mode)
meganmi
Posts: 5
Joined: Thu Dec 22, 2016 6:04 am

Re: TTARCH versions of the games

Post by meganmi »

Marvel's Guardians of the Galaxy

Code: Select all

86DE8EA688D594B1E59DA59479DAB4C9CD938EE5B0A6669FAC96D0C79DD5C2A2D276627FA8D89ADED9DDD9DAAA63829F8CD887A5D4DBA0
dixen18
Posts: 4
Joined: Tue Dec 13, 2016 7:37 pm

Re: TTARCH versions of the games

Post by dixen18 »

Hi)
How decrypt ttarch2 from TWD New Frontier Complete Season (Episode 5) without unpack? Thx
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

As far as I remember it's not possible because it's not just one unique compressed file, it's composed by various parts that are encrypted and aren't.
Anyway the command-line option is -d 0 (0 is the offset you have to specify), hopefully other users are able to help you but I think that someone else already asked something similar.
ExPlayer
Posts: 5
Joined: Tue Jun 23, 2015 3:45 pm

Re: TTARCH versions of the games

Post by ExPlayer »

aluigi, when you can add the game Marvel's Guardians of the Galaxy: The Telltale Series in the program ttarchext?
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: TTARCH versions of the games

Post by aluigi »

You can specify the key of that game with the option:
-k 86DE8EA688D594B1E59DA59479DAB4C9CD938EE5B0A6669FAC96D0C79DD5C2A2D276627FA8D89ADED9DDD9DAAA63829F8CD887A5D4DBA0

https://forum.xentax.com/viewtopic.php?p=129874#p129874
That option makes everything easy (moreover for me eh eh eh), that's why I have not updated the tool yet.
Anyway I'm aware of a new episode two so maybe I can update it adding also the key of this new one.