Forza Method 22 (.zip)

[umisery]

Would anyone know how to extract Forza zips with compression method 22?

Here's an example zip:

[DISsumSAUCE]

^^^^Seconded, it'd be a HUUUUGE help if anyone can figure this out.

[PsYcHo_RaGE]

let's figure it out what it has.....intresting content

[aluigi]

Considering the minimum compressed size being 0x234 even if the uncompressed size is smaller, I suspect there is some encryption/obfuscation (dictionary?) involved.
offset, comp_size, uncomp_size:

Code: Select all

0x0000002e 0x00000234 0x00000430
0x0000029c 0x00000234 0x000002ac
0x00000510 0x00000234 0x000000ba
0x00000770 0x00000444 0x000026a6
0x00000bee 0x00000864 0x0000477a
0x00001481 0x00000c84 0x00007bf8
0x0000213a 0x00000654 0x000025c2
0x000027b7 0x000010a4 0x00008551
0x00003886 0x00000234 0x00000436
0x00003ae8 0x00000234 0x00000432
0x00003d4e 0x00000444 0x00000b25
0x000041c3 0x00000a74 0x000051ab
0x00004c66 0x00000654 0x00002b8c
0x000052f1 0x000033b4 0x000316d3
0x000086d6 0x000033b4 0x000315cf
0x0000bab6 0x00000234 0x00000446
0x0000bd18 0x00000444 0x0000158b
0x0000c18b 0x00005ae4 0x00060a1f
0x00011ca9 0x00000c84 0x000129f4
0x0001295b 0x00000234 0x00000427
0x00012bbf 0x00000444 0x00000f02
0x0001302b 0x00000234 0x000002e1
0x0001328b 0x00000234 0x00000095
0x000134f2 0x00000234 0x000000b6

[umisery]

Encryption/obfuscation doesn't sound very good, I hope it gets figured out

[aluigi]

There are some missing information in this topic.
Is it Forza 7?
For what platform? (and is this method 22 used on both the platforms?)
Do all the zip files use this method 22 or only few ones?

[umisery]

It's Forza Horizon 3, in the later updates they used method 22 on some of the zips (not all afaik, I don't have the dumped game files right now to check).

From PC, I don't know what method(s) the Xbox version uses but I presume the same since this is a console port.

[umisery]

Here's some more method 22 zips:

https://www32.zippyshare.com/v/sKD4lSxd/file.html


https://www32.zippyshare.com/v/qxgNNfTZ/file.html

[umisery]

Forza Horizon 4 uses method 22 on some zips as well, can't upload any files yet though. I'm hoping that someone will eventually make a script for this, it will be very helpful.

[D3FEKT]

Unsure if there has been any progress for method 22 zips, but now with Forza Horizon 4 being released, can now note that most zips in that game are method 22.
Here is 5 more sample zips to go by.

https://www.mediafire.com/file/09m5q7y4 ... a.rar/file

Thanks

[SoniKalien]

Pertaining to Forza Horizon 4:

I own the game, but I didn't want to screw around with permissions etc because I actually play it as well :]

What I've been able to do is use R-Studio to copy a few archives from the install directory successfully to another drive. I unchecked "keep permissions and stuff" or something like that. That has given me 2 files (eg):

Code: Select all

REN_5Turbo_HE_80.zip
REN_5Turbo_HE_80.zip.$efs

I opened the .$efs file with a hexeditor and it starts with:

Code: Select all

.appx_...

followed by unreadable hex code (a bunch of number and letters lol)

So I am hoping that might be a clue into getting these extracted. I have tried various variations of forza studio and other extractors and the general consensus is that "this is not a valid archive". I'm guess that is because of encryption. Is the .$efs any help to getting them decrypted?

[umisery]

Did you just say that R-Studio completely bypassed EFS perms on FH4 and allowed it to be copied elsewhere? That in itself is huge news.

Would you be able to upload both those files please? If they're openable, copyable and editable then this is insane as the game can't even be dumped from kernel with any sorts of perms due to how strong EFS is on FH4.

[CTRLC]

Here is the 2 files efs still in there but we have the *efs files, if anyone know how to do that we are happy to know that.

https://www65.zippyshare.com/v/1Hv8DFsy/file.html

[ThatsJustLogic]

Can anyone explain how its done using R-Studio? I want to look into it a little bit.

[CTRLC]

You need the use recover file feature, simply go to game files select recover what you want.

[SoniKalien]

I'm glad my success has been replicated

Yes it's easy to copy the files with R-Studio. I run my pc using 3 partitioned o/s's (all win 10) the first is my main... let's call it "work" os and the third is for my legit stuff (games) so I'm using RStudio in my "work" os to copy from the legits o/s to another drive. Just to avoid messing up stuff.

As for opening/editing... no the zip cannot be extracted. I suspect because of encryption. I have tried ForzaStudio which has so far been able to extract the .zips from previous titles.

here's my 2 files. https://www34.zippyshare.com/v/wV4KoisM/file.html

[umisery]

Still has EFS encryption, just without perms restricted user-access anymore. But this step one, progress is being made.

[SoniKalien]

I've just done some comparisons:

ctrl-c vs my AUD_RS2_95.zip.$efs - same file size, last 16 bytes are different (offset(h)-86)

My AUD_RS2_95.zip.$efs vs my REN_5Turbo_HE_80.zip.$efs - same file size, last 40 bytes different starting offset(h)-6E

[CTRLC]

Looks like Potato_of_Doom manage to dump the game, I'm not sure how he did tho.

Here is the a car file without EFS.

https://www13.zippyshare.com/v/LFONAlvO/file.html

[SoniKalien]

Yea there's a dump going around but I understand it's from pre-release or demo that didn't have the updated efs/uwp and as such is missing a lot of cars.