Nightmare Creatures 2 (PSX/Dreamcast) *.LVL extraction

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
Wasabi
Posts: 29
Joined: Thu Jul 30, 2015 5:39 pm

Nightmare Creatures 2 (PSX/Dreamcast) *.LVL extraction

Post by Wasabi »

Nice day, my folks. I want to claw an axe into this particular game, rip it's guts apart and get its resources (maps, models & textures)
while learning how it works/is built.
It looks like I'm dealing with some kind of encryption here and, because of it, I'll apreciate your guidance.
So let me know if you people have any clue for the next one. Almost for sure it's a common type with an already avaliable bms script,
but without an stupid header telling how to decode it this time.
First, for saving time to many of you, I'm going right to the bone leaving further explanations for a second post.
Here's the thing, there's a common pattern repeating all over the *.LVL files (all PSX/DC NTSC-U&PAL releases):
It looks like an encrypted header with first 7 bytes randomly changing while the 8th byte has always a "64" value.
ImageImage
Already tried Universal Extractor, because it supports an encryption called base64; and the bms script for base64/zlib, but no success so far.
I know that the 64 value doesn't necesary means it's Base64, but that's my skill. Also, I don't know if used the bms script properly.
Also, apart of the above and the boot flow, the only relevant thing I've found was the strings Loading.....Inside RTC and RTCdata at PSX SLUS; starting at offsets (h)00002F80 and (h)00099810. No clever idea for what could it be, but I've found few references for PSX gamepads functions/drivers googling.
I'll stay in tune to your findings. Thanks in advance, amigos!
attached-pics.zip

file sample with useless stuff removed:
https://mega.nz/#!WpMWHRjQ!EsQdRJbArSsFXRjnTNEFouPepoT7YSaLq8Z3CiahdXA
Wasabi
Posts: 29
Joined: Thu Jul 30, 2015 5:39 pm

Re: Nightmare Creatures 2 (PSX/Dreamcast) *.LVL extraction

Post by Wasabi »

And now, some schemes about NC2 boot procedures and the whole "why its almost 100% accurate that LVL files stores all 3D geometry/texture data" part
(acting similar to Quake1 PAK/PK3 and BSP).
This is the untouched disc root directory struct, with all the important files red-marked (files needed for a level to be loaded) and leaving the rest unmarked (screen overlays, audio/video, dummy file, etc.) The 3MIN.DMY (dummy) is a zero-padded file with a RIFF-WAVE header.
Image
If you want to learn a little more about WINCE\ folder present in DC release, take a look at my thread here https://assemblergames.com/threads/dev-tools-in-nightmare-creatures-2-gdrom.66005/

Each LEVEL\ directory looks like the next picture, with exceptions for MENU\ and LEVEL0\.
Image
LEVEL0\ lacks *.SLF, which exists in all the others LEVEL folder. I don't know what's this file's purpose, but we can assume it's only necesary from 2nd level onwards/going?. Why? What could be needed in a game to be loaded in all levels except for the first one?
MENU\ lacks the mentioned *.SLF plus *.SZX/*.EXP, because there's no external resources to call [i.e. *.CPT enemy scripts] and the rest like screen overlays has been already called by the SLUS).
Note: *.CPT files are enemy scripts.

For the next, I used the PSX main executable as reference. Searching for the key-strings "level" & "lvl" plus a bit of mouse-scrolling brought many results and I think recognized and correctly set-up the boot-scheme, for Dreamcast I just guessed swapin' formats:
main loading
PSX: *.CFG autorun file>SLUS main executable>INTRO\(logos,misc.videos,menu.txt)>BOARD\(fonts,MC icon,gui)>MENU\
DC: *.REG>0WINCEOS>INTRO\>BOARD\>MENU\
Note: MENU its actually the first level and it links to the rest of the game world. Again, kind of Quake1 hub "start.bsp" but with less movement freedom.

level loading
PSX: *.SZX (resource fetcher)>*.LGC (level logics?)>*.STR (introductory video)>*.TIM(loading screen)>*.LST(enemy list)>*.VAG/*.XA/*.VH/*.VB/*.DSC(level audio)>*.SLF(no idea)>*.TXT(static entities script)>*.LVL (menu,hopital,circle,circle2,castel,paris,museum,lachaise,catacombes,eiffel; 10+1 levels with "Therapy/training" mode one)
DC: *.EXP>*.LGC>*.SFD>*.PVR>*.LST>*.XM/*.WAV/*.DSC>*.SLF>*.TXT>*.LVL

Now, take a look at the *.LVLs size... almost matching the introductory videos size.
That's too big for just a game map; considering that,by the release date (year 2000!), a single 3D map used to be about 500kb-1mb and same with models, made of an average 800-1000 polygons/quads.
Of course, I'm talking about PSX specs here and the Dreamcast port is a direct conversion (with a bilinear filter option as main addition).
With the rest of resources already located outside the file, this must be the game's bulk.
There's no sense for the devs hiding data outside the disc visible tables (ala Xenogears) while leaving scripts in plain text there for your sight.
Scanning *.LVL with PSXPrev will bring broken textures and it seems like almost gets 3d meshes, but fails at last with messages like "unknown primitive error".
Wasabi
Posts: 29
Joined: Thu Jul 30, 2015 5:39 pm

Re: Nightmare Creatures 2 (PSX/Dreamcast) *.LVL extraction

Post by Wasabi »

Bonus, thanks to edgbla's gpubladesoft:
Image
images instead of animated gif:
bonus.zip
Wasabi
Posts: 29
Joined: Thu Jul 30, 2015 5:39 pm

Re: Nightmare Creatures 2 (PSX/Dreamcast) *.LVL extraction

Post by Wasabi »

I've found a file definition here https://fileinfo.com/extension/lvl but using those tools are useless because they point to specifical data (i.e. dds textures) and I got no single pointer to anything. I don't even know if the games is using TMD, PMD, HMD or other 3d format variant.
There's also a Starwars Battlefront .LVL bms script which maybe could do the work for this by editing it.
Is there any way of decypher the big file like a scanning tool with a compression/encryption database to just know which kind is using as starting point? Im completely lost and it's kind of strange to me not finding a tool like that.
Sorry for typos and thank you all.