Ares Chronicles (PC) - unpacking Unity asset bundles

[ice]

Ares Chronicle is a korean game
Use unity3d engine
Official website：https://ac.zlongame.co.kr/
My unpacked PC version
The first layer uses very simple packets, I decompress the packets using quickbms according to the UnityFS header information





When I couldn't open it with Assetstudio. I found that the unpacked file in hxd was also encrypted. I tried to decompile the dll again, and found that the dll was not encrypted.





I wonder if I can make a decryption script based on the dll file information, I am not too familiar with quickbms？

I upload a few files and dlls that I unpacked for the first time for reference


thank you very much

https://drive.google.com/file/d/1nmh4Lz ... sp=sharing

[ikskoks]

Hi. What script did you use to unpack those "packets"? Can you link it here?

Is PC version of this game free2play? Does it require payment or kerean ID verification to play?

[ice]

Yes, of course

Code: Select all

do
    goto OFFSET
    get DUMMY long
    findloc NEXT_OFFSET string "UnityFS" 0 ""
    if NEXT_OFFSET == ""
        get SIZE asize
    else
        math SIZE = NEXT_OFFSET
    endif
    math SIZE -= OFFSET
    string Name p "%s_%08x.unity3d" aRCNAME OFFSET
log Name OFFSET SIZE
    math OFFSET = NEXT_OFFSET
while NEXT_OFFSET != ""

The game is free
I'll upload a PC client later

[ice]

Hi. What script did you use to unpack those "packets"? Can you link it here?

Is PC version of this game free2play? Does it require payment or kerean ID verification to play?

I have uploaded the full PC game！
<link deleted by moderator - uploading full games is not allowed here>

[ikskoks]

Thanks. I'll take a look at those files and I'll let you know when I find something useful.

[ice]

Thanks

[ice]

Hi. What script did you use to unpack those "packets"? Can you link it here?

Is PC version of this game free2play? Does it require payment or kerean ID verification to play?

any base？

[ikskoks]

I think you meant "Any news?"


And yes, there is some progress, but not much. I've discovered that in this case assets are handled by "Zeus Framework"
and main logic is probably in file \Zeus.Framework.Asset\AssetBundleLoader.cs from decompiled source code.

But I hadn't too much time to analyze this format in detail.

[ice]

I think you meant "Any news?"


And yes, there is some progress, but not much. I've discovered that in this case assets are handled by "Zeus Framework"
and main logic is probably in file \Zeus.Framework.Asset\AssetBundleLoader.cs from decompiled source code.

But I hadn't too much time to analyze this format in detail.

OK

[barncastle]

I've had a look at this and these Asset Bundles have a custom structure as well as the usual XOR cipher protection. Unlike most games which have some in-game logic to decipher bundles before loading them, these devs have actually modified the Unity Engine (UnityPlayer.dll) to natively support their changes.

Their custom header is 32 bytes with the standard "UnityFS" signature followed by 6 big endian uint32 fields i.e.

Code: Select all

 struct AresBundleHeader
 {
    char Signature[8]; // "UnityFS"
    uint Field1;
    uint Field2;
    uint Field3; // null byte
    uint Field4;
    uint Field5;
    uint Field6;
 }

These field values are generated by using some elaborate bit twiddling that shifts, swaps and transforms the normal size, (un)compressedBlocksInfoSize and flag field bits. An example of decoding this can be seen here. Additionally, the compressed block info has an XOR cipher that uses a static key which can also be found within the modified UnityPlayer.dll.

However, as this is a custom structure, it is not just a matter of reversing these changes. You also need to rebuild each file with a proper Unity standard Asset Bundle header for it to be usable by normal tools.

I've created a tool to do just that. It extracts and converts each bundle so it can be opened with AssetStudio (and possibly Unity - I've not tested). You can find it here, with a compiled binary under Releases. The BundleConverter class also contains (bad) example code to convert normal bundles to this customised format.

Also FYI, the _vfileIndexV2.fb file contains the names and offsets of each file within the blobs. There are also more files in the "%userprofile%/AppData/LocalLow/PerfectWorld" folder which is where updates and hotfixes get stored.