2022 - Tom Clancy's Rainbow Six: Siege Asset Extraction Tools

[Tushkan]

There are 3 types of operators (3-speed, like the one you exported, 2- and 1-speed ops) plus 2 sexes. So there might as well be 6 skeletons. Plus some characters have their specific animations (Mozzie's reloading, Nomad's planting b'cs she lacks 1 finger). Where do ubi games generally keep their skeletons? This is the first ubi game I'm unpacking so I have no clue how they store their data in general. They have a bunch of havok files in *meshshape.forge but those seem to be colliders. I don't know if it also contains any skeletons or animations which i'm interested in.
If you manage to grab data out of those mesh files, I guess you already took care of their archiving and chunks structure. How did you distinguish between static and rigged meshes? I wasn't able to easily find skinned meshes except for ones that I know of because I play the game. One of reasons is because packaging strategies for verts differ from file to file. There are even models where 1 vert pos is packed into 4 bytes. And with other buffers it gets even harder to interpret those packings (like with normals, i'm not even sure I unpacked them correctly when I found them). The only reliable structure is tris-verts id buffer (still, even that one has a peculiar lod system with chunks and invalid vert indices at lod bounds). I guess Ash was easier because that's an operator and their models generally are not compressed like props are. Can you give any suggestion on how would you approach finding skeletons and where would you search for it?

[zaramot]

Well, yeah since it's using havok - there might be, that they have skeletons somewhere too. Though, from what I saw atm, they were physics/collision related files. Honestly I haven't checked much yet, I have some plans but it was more like a brief research (to get geometry and make a texture converter). Since I don't even have the game lol latest client from torrent was more than 128 gb (of course with HD textures) but still a lot of space, I downloaded only 10 gb of files, which I assumed will have a lot of models+ textures inside (and they are). As for normals they shouldn't be a big problem for skinned meshes, but could be for static ones (I honestly, almost never bugging myself about them because of 3ds max). As for skeleton - I have no idea where it might be right now xD It will have some "type", "class" I don't know how to explain this correctly, I'm a Russian-speaking user - but I basically should extract some .forge with it (identify it's bones), then just remember this "type" - since, all skeletons will be in same folder with such hash after extraction (grouping, like a said).
P.S. A little about first routine. I haven't studied any in dept structure like you might think I am, I just extracted all files by "type". so I had a bunch of folders with certain "hash", then I went into folder one by one - decompressed files, checked them - remember which "type" is model, textures. Edited extraction script, so extracted folders of interest have name models/textures. Made maxscript for geometry import and noesis plugin for textures. That's all for now It's working, but it's definitely not the game of my interest as for models (not like For Honor, about which I'm still crying like a baby ) Better they encrypted rainbow six, than my amazing for honor.

[Custard]

Keep in mind that animation or mesh variety or speed of animation in itself doesn't inform on the skeleton, it's only the articulation points to use. To my eye as an animator this game shows all the signs of minimal skeleton variation. I'd say the assumption of one male and one female skeleton would be fair, with probable exceptions of some of the zombie creatures from Operation Chimera. Even when they push the body models like Gridlock or Suicide Bomber, have very different run cycle like Warden or Blitz, I still see the same articulation points on those animations. They also all use a lot of identical shared animations (e.g reinforcing wall), and they are spot-on identical. Character with visible face have facial animations, but if character has hidden face they don't need new skeleton the bones can go unused, same sort of thing with Nomad's missing finger.

[Tushkan]

Zaramot, xD. Don't worry about russian, I'm russian speaker too. As for mapping data, I have pandas plots of specific type occurrence per each forge archive. I also have structs for texture files so I can share those if you want to save time (they use plain dds data with custom footer instead of header, plus custom dx10 enum which was a pain to map to actual dx10 types).
As of skeletons, It looks like they should be stored inside meshshape files. They all have the same type and basically store serialized havok data. It can be unpacked to an xml by tool used to unpack skyrim models (i don't remember it's name). However I'm yet to research it.
And what type of encryption does honor have?

[Tushkan]

Custard, well that only makes my job harder ) it would be easier to spot similarities within 6 files rather than 2. Alot of data in game is linked via depgraphbin and is referred by uint64 uids, but those don't point at any havok files in particular. And asset files contain a shit ton of small structs full of uid references. Not an easy nut to crack in terms of time.

[zaramot]

Zaramot, xD. Don't worry about russian, I'm russian speaker too.

I kind of assumed that xD by the nickname, though kept my assumptions with myself lol Well, I have no idea what type of encryption for honor is using exactly, I guess it's AES. Though, since it's denuvo game + has anticheat system It's almost an unbreakable thing, as for me personally it's absolutely unbreakable wall xD But, I have client with 16 characters and a ton of models for them, so I'm not left with nothing - just with a bit more, than a half of recent game assets lol Still crying though, since I wanted most characters from latest updates

[Tushkan]

They use AES on asset files?.. That's kinda awkward. You can try one thing though. Ubi games generally come with battle eye. When you launch a game, you get your executable (it's encrypted and gets decrypted upon launch and spawned as a new process, at least in siege) and a battle eye service. If you launch your game in offline mode and kill the battle eye service (via cmd, command can be found in the internet or I can provide it to you), you then should be able to attach a debugger or Intel GPA to the game. This way you should be able to rip some decrypted data from it.

[zaramot]

Don't know why but it's always run through steam, even if I'm running it from uplay. Not sure, if it's doing such thing with decrypting .exe with for honor - like with siege. Though, even if I don't have much hope, I still really want those models for myself, so I'm highly motivated and don't mind to put time and efforts into it! I'll re-download the game, and try what you said. If I"ll somehow will be able to grab aes key from decrypted .exe and decrypt .forges, I will be happy like a little puppy.

[Tushkan]

Be aware you won't be able to get the actual unencrypted .forge archives. You should be able to halt the game and search through RAM for loaded data. There is a chance to attach and halt upon loading something heavy but I bet tat decryption code will be virtualized and very hard to read. Still, ripping data directly from memory should still be possible. If I manage to finish with R6S, I can try to help you on that one.

[comword]

Be aware you won't be able to get the actual unencrypted .forge archives. You should be able to halt the game and search through RAM for loaded data. There is a chance to attach and halt upon loading something heavy but I bet tat decryption code will be virtualized and very hard to read. Still, ripping data directly from memory should still be possible. If I manage to finish with R6S, I can try to help you on that one.

I am curious on your way of decrypting forge archives. I know the executable is heavily protected by BE, but I believe 3D related parts (model loading & rendering) can't be virtualized because of performance needs.
Where can I start analysis it without being able to run that executable?
Also, I found a tool https://zenhax.com/viewtopic.php?t=9138 published in 2015 can extract forge archive, but it is not open source.

[comword]

I think there is another way to analysis it, rather than stuck on PC version. Maybe we can get details from its PS4 or XBox console version. All of these consoles share mutual instruction set(x86_64) with desktop PC. Games designed for consoles usually do no virtualize and obfuscate, thus can be disassembled and analyzed statically. In addition, the game may share engine between PC and console and have same archives structure. Maybe this could be an alternative method.
But I can't find where to download a specific console version game.

[zaramot]

This tool for ubisoft games is great, but as creator said himself he can't do nothing with encrypted for honor .forges, so I have no idea how it would help you even if it was open-sourced. I checked PS4 version already xD As I said I'm very interested in For Honor. PS4 version working great - but updates requires newer firmware, no one can dump a .fpkg yet, maybe when PS5 will be released, then PS4 version will do the job even without decrypted PC (though, not 100% since maybe they encrypted .forges in new updates, but unlikely) Tushkan, you mentioned about textures from siege, here what I did for extracted textures, after I made alpha maxsciprt for models. It's plugin for Noesis, greatest tool ever - I love it so much. Not only could you preview them, but you could batch process them to ALL needed 2d formats xD

https://www.youtube.com/watch?v=K47_f6Z ... e=youtu.be

[Tushkan]

I am curious on your way of decrypting forge archives. I know the executable is heavily protected by BE, but I believe 3D related parts (model loading & rendering) can't be virtualized because of performance needs.
Where can I start analysis it without being able to run that executable?
Also, I found a tool https://zenhax.com/viewtopic.php?t=9138 published in 2015 can extract forge archive, but it is not open source.

1. Plain old bytes analysis. Load a bunch of forge headers in 1-per-row manner and start noting similarities and struct hints. Then proceed with guesses and tests.
2. When I tried to reverse actual forge unpacking via exe reverse, I couldn't find any particular parts of plain unpacking code. From what I saw they virtualize at least parts of unpacking routines. Maybe that's why siege takes so long to load ) The other issue is that i'm not that versed with asm reversing. I only use x64dbg, with minimal amount of analysis tools. Hell, I can't even use Scylla properly xD. And game gets an update each month and a half so I'm simply lacking in speed to crack it via reversing. I'd gladly read some literature on that matter or attend a webinar to get on par with the "industry"
)
3. If you want to analyze without an executable, than you should analyze actual binaries, like I did. Or ask someone to decypher and dump an exe for you. But given the fact it's heavily virtualized... I doubt it's worth something.
4. Last time I checked it on actual data, that unpacking tool was out of date. Ubi changed parts of .forge archives and switched to zstandard compressor, so that tool no longer applies. There is a newer one, but it only dumps out files, no text data, no nothing. Plain unpacked binaries. But still it's better than nothing. Or maybe that tool got an update. dunno, never bothered to check.

Tushkan, you mentioned about textures from siege, here what I did for extracted textures, after I made alpha maxsciprt for models. It's plugin for Noesis

O_o holy crap you work fast xD

[comword]

1. Plain old bytes analysis. Load a bunch of forge headers in 1-per-row manner and start noting similarities and struct hints. Then proceed with guesses and tests.

I have seen files in your Dropbox. They are not clear for understanding, and I didn't find forge archive structure analyzed.

Did you remember when Ubi changed .forge archives? Because I'm working on a season operation in old version game (about Mar - April in 2018).

Tushkan, you mentioned about textures from siege, here what I did for extracted textures, after I made alpha maxsciprt for models. It's plugin for Noesis

Really amazing, do you plan to share some of your work?

[zaramot]

Really amazing, do you plan to share some of your work?

Sure, I'm mostly sharing stuff which I did or doing, with rare examples when it's just for my personal use only or not finished for end-user, not user friendly xD So, of course with siege I could post everything I did later on, so anyone could take a look and continue the process or just take it as it is.