Bloodsports.TV bundle files/*.streams

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
AlphaTwentyThree
Posts: 909
Joined: Sat Aug 09, 2014 11:21 am

Bloodsports.TV bundle files/*.streams

Post by AlphaTwentyThree »

Can somebody help me to extract these files? There's an offzip compression in the bundle files but offzip cannot decompress all blocks, so I'm in need for a script. As for the .stream files, I'm at a loss here - I ran comptype_scan2 but it didn't result in anything usable.
Here are samples: http://*USE_ANOTHER_FILEHOSTING*/a244ad8 ... /bundle.7z
Thanks for yout help!
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Bloodsports.TV bundle files/*.streams

Post by aluigi »

The stream file that contains the information is probably obfuscated.

The other files are like compressed file systems splitted in chunks so without information about the archived files you can extract nothing.

You can just try to rip known file formats after having unpacked everything with offzip -a -1.
AlphaTwentyThree
Posts: 909
Joined: Sat Aug 09, 2014 11:21 am

Re: Bloodsports.TV bundle files/*.streams

Post by AlphaTwentyThree »

Damn... thanks anyway.
happyend
Posts: 157
Joined: Sun Aug 24, 2014 8:54 am

Re: Bloodsports.TV bundle files/*.streams

Post by happyend »

v00d00
Posts: 3
Joined: Mon Apr 20, 2015 3:08 am

Re: Bloodsports.TV bundle files/*.streams

Post by v00d00 »

For the regular bundle files (not the streams):

Code: Select all

ULONG   Magic
ULONG   Uncompressed Size
ULONG   ?? (0)


Followed by the zlib compressed data blocks:

Code: Select all

ULONG   Block Size
         Data


If the block size = 65536, it's uncompressed (no leading zlib 789C bytes either). Continue reading each block, uncompressing (if needed), and once at the final block trim it so that the decompressed size of all blocks = the uncompressed size from the header. Haven't checked much further yet - scripting is handled by LuaJIT (the compiled scripts are in the bundles), hashes use Murmur - https://bitbucket.org/bitsquid/foundation/src/7f896236dbafd2cb842655004b1c7bf6e76dcef9/murmur_hash.cpp?at=default
AlphaTwentyThree
Posts: 909
Joined: Sat Aug 09, 2014 11:21 am

Re: Bloodsports.TV bundle files/*.streams

Post by AlphaTwentyThree »

Good work! :)
Now somebody could eventually try to work on a script. ;)
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Bloodsports.TV bundle files/*.streams

Post by aluigi »

The problem is the obfuscated file table.
Maybe you can try with offzip, it should point you to the right place.
v00d00
Posts: 3
Joined: Mon Apr 20, 2015 3:08 am

Re: Bloodsports.TV bundle files/*.streams

Post by v00d00 »

Some murmur hashes:

Code: Select all

resource_packages/boot -> 9e13b2414b41b842
lua -> a14e8dfa2cd117e2
scripts/game/gui/ingame/selection/selection_manager_host -> 0036c4d25badcb2b


from file bundle\9e13b2414b41b842 (resource_packages/boot), after decompressing:

Code: Select all

00003E14 E2 17 D1 2C FA 8D 4E A1 2B CB AD 5B D2 C4 36 00      ...,..N.+..[..6.
         `-- Hash of "lua"       `-- Hash of "scripts/game/gui/ingame/selection/selection_manager_host"
00003E24 01 00 00 00 00 00 00 00 00 00 00 00 6E 0B 00 00      ............n...
         `-- Unk                             `-- Filesize + 8?
00003E34 00 00 00 00 66 0B 00 00 02 00 00 00 1B 4C 4A 01      ....f........LJ.
         `-- Unk     `- Filesize `-- Unk     `-- LuaJIT Compiled code start

000049A5 00 E2 17 D1 2C FA 8D 4E A1 B1 9F 26 E8 A5 FF 49
   EOF --'  `-- Next header start


The actual header of the bundle file uses the same hashes for it's index. Just need the list of all of the filenames/extensions before being hashed. Dumping / hashing all strings would be one way, might be a file containing them though (as in Payday / Payday 2). Alternative, would be to dump as <pathhash>.<exthash> for the filenames - less meaningful, but the original Payday dumpers did the same until the names were located in idstrings_lookup.idstrings_lookup. Bitsquid engine is by Fatshark, who were originally Grin - the same as Overkill who made Payday. There are a lot of similarities between their code as a result.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Bloodsports.TV bundle files/*.streams

Post by aluigi »

Basically the "stream" files are totally useless and don't contain the names and the information of the archived files.

Well, better for us :)
http://aluigi.org/papers/bms/others/bloodsports_tv.bms
AlphaTwentyThree
Posts: 909
Joined: Sat Aug 09, 2014 11:21 am

Re: Bloodsports.TV bundle files/*.streams

Post by AlphaTwentyThree »

aluigi wrote:Basically the "stream" files are totally useless and don't contain the names and the information of the archived files.

Too bad... :(
But thanks for the script! :)
v00d00
Posts: 3
Joined: Mon Apr 20, 2015 3:08 am

Re: Bloodsports.TV bundle files/*.streams

Post by v00d00 »

Fixed a few bugs in the one posted, and added all used extensions (unsure if there is a simpler way of doing it). I have uncompressed all of the bundle files successfully with this one:

Code: Select all

# Bloodsports.TV
# script for QuickBMS http://quickbms.aluigi.org

math CHUNK_SIZE = 0x00010000
get FLAGS long
get SIZE longlong
putvarchr MEMORY_FILE SIZE 0
log MEMORY_FILE 0 0
append
for MEM_SIZE = 0 u< SIZE
    get CHUNK_ZSIZE long
    savepos OFFSET
    if CHUNK_ZSIZE == CHUNK_SIZE
        log MEMORY_FILE OFFSET CHUNK_SIZE
    else
        clog MEMORY_FILE OFFSET CHUNK_ZSIZE CHUNK_SIZE
    endif
    math OFFSET + CHUNK_ZSIZE
    goto OFFSET
    get MEM_SIZE asize MEMORY_FILE
next
append

goto 0 MEMORY_FILE
get FILES long MEMORY_FILE
getdstring DUMMY 0x40 MEMORY_FILE
getdstring DUMMY 0xc0 MEMORY_FILE
for i = 0 < FILES
    getdstring DUMMY 0x10 MEMORY_FILE
next i

for i = 0 < FILES
    get EXTA long MEMORY_FILE
    get EXTB long MEMORY_FILE
    string EXT p= "%08x%08x" EXTB EXTA
    get PATHA long MEMORY_FILE
    get PATHB long MEMORY_FILE
    string PATH p= "%08x%08x" PATHB PATHA
   
    if EXT == "00a3e6c59a2b9c6c"
        set EXT "timpani_master"
    elif EXT == "169de9566953d264"
        set EXT "navdata"
    elif EXT == "18dead01056b72e9"
        set EXT "bones"
    elif EXT == "27862fe24795319c"
        set EXT "render_config"
    elif EXT == "2a690fd348fe9ac5"
        set EXT "level"
    elif EXT == "3b1fa9e8f6bac374"
        set EXT "network_config"
    elif EXT == "82645835e6b73232"
        set EXT "config"
    elif EXT == "84a01660022666eb"
        set EXT "swf"
    elif EXT == "931e336d7646cc26"
        set EXT "animation"
    elif EXT == "99736be1fff739a4"
        set EXT "timpani_bank"
    elif EXT == "9efe0a916aae7880"
        set EXT "font"
    elif EXT == "a14e8dfa2cd117e2"
        set EXT "lua"
    elif EXT == "a486d4045106165c"
        set EXT "state_machine"
    elif EXT == "a8193123526fad64"
        set EXT "particles"
    elif EXT == "ad9c6d9ed1e5e77a"
        set EXT "package"
    elif EXT == "b277b11fe4a61d37"
        set EXT "mouse_cursor"
    elif EXT == "bf21403a3ab0bbb1"
        set EXT "physics_properties"
    elif EXT == "cce8d5b5f5ae333f"
        set EXT "shader"
    elif EXT == "cd4238c6a0c69e32"
        set EXT "texture"
    elif EXT == "e0a48d0be9a7453f"
        set EXT "unit"
    elif EXT == "e5ee32a477239a93"
        set EXT "shader_library"
    elif EXT == "eac0b497876adedf"
        set EXT "material"
    elif EXT == "fa4a8e091a91201e"
        set EXT "ivf"
    elif EXT == "fe73c7dcff8a7ca5"
        set EXT "shading_environment"
    endif
    string FILENAME p= "%s.%s" PATH EXT
   
    get HASDATA long MEMORY_FILE
    get ZERO long MEMORY_FILE
    if HASDATA == 0
        set SIZE 0
    else
        get ZERO long MEMORY_FILE
        get SIZE long MEMORY_FILE
        get ZERO long MEMORY_FILE
    endif
   
    savepos OFFSET MEMORY_FILE
    log FILENAME OFFSET SIZE MEMORY_FILE
    math OFFSET + SIZE
    goto OFFSET MEMORY_FILE
next i
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Bloodsports.TV bundle files/*.streams

Post by aluigi »

Well done.
I have used it in the script online and added the fail-safe extension "." that is used by quickbms to automatically guess the extension when none is provided.
happyend
Posts: 157
Joined: Sun Aug 24, 2014 8:54 am

Re: Bloodsports.TV bundle files/*.streams

Post by happyend »

script not support .stream files?
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Bloodsports.TV bundle files/*.streams

Post by aluigi »

No, the stream files seem to contain nothing useful (as far as I remember).