Page 1 of 1
Ares Chronicles (PC) - unpacking Unity asset bundles
Posted: Fri Apr 29, 2022 3:21 pm
by ice
Ares Chronicle is a korean game
Use unity3d engine
Official website:
https://ac.zlongame.co.kr/
My unpacked PC version
The first layer uses very simple packets, I decompress the packets using quickbms according to the UnityFS header information
When I couldn't open it with Assetstudio. I found that the unpacked file in hxd was also encrypted. I tried to decompile the dll again, and found that the dll was not encrypted.
I wonder if I can make a decryption script based on the dll file information, I am not too familiar with quickbms?
I upload a few files and dlls that I unpacked for the first time for reference
thank you very much
https://drive.google.com/file/d/1nmh4Lz ... sp=sharing
Re: [Ares Chronicle] unpacking of Unity3D games
Posted: Sat Apr 30, 2022 12:58 am
by ikskoks
Hi. What script did you use to unpack those "packets"? Can you link it here?
Is PC version of this game free2play? Does it require payment or kerean ID verification to play?
Re: Ares Chronicles (PC) - unpacking Unity asset bundles
Posted: Sat Apr 30, 2022 4:26 am
by ice
Yes, of course
Code: Select all
do
goto OFFSET
get DUMMY long
findloc NEXT_OFFSET string "UnityFS" 0 ""
if NEXT_OFFSET == ""
get SIZE asize
else
math SIZE = NEXT_OFFSET
endif
math SIZE -= OFFSET
string Name p "%s_%08x.unity3d" aRCNAME OFFSET
log Name OFFSET SIZE
math OFFSET = NEXT_OFFSET
while NEXT_OFFSET != ""
The game is free
I'll upload a PC client later
Re: [Ares Chronicle] unpacking of Unity3D games
Posted: Sat Apr 30, 2022 5:05 am
by ice
ikskoks wrote: ↑Sat Apr 30, 2022 12:58 am
Hi. What script did you use to unpack those "packets"? Can you link it here?
Is PC version of this game free2play? Does it require payment or kerean ID verification to play?
I have uploaded the full PC game!
<link deleted by moderator - uploading full games is not allowed here>
Re: Ares Chronicles (PC) - unpacking Unity asset bundles
Posted: Sat Apr 30, 2022 10:30 am
by ikskoks
Thanks. I'll take a look at those files and I'll let you know when I find something useful.
Re: Ares Chronicles (PC) - unpacking Unity asset bundles
Posted: Sat Apr 30, 2022 6:06 pm
by ice
Thanks
Re: [Ares Chronicle] unpacking of Unity3D games
Posted: Sat May 07, 2022 2:52 pm
by ice
ikskoks wrote: ↑Sat Apr 30, 2022 12:58 am
Hi. What script did you use to unpack those "packets"? Can you link it here?
Is PC version of this game free2play? Does it require payment or kerean ID verification to play?
any base?
Re: Ares Chronicles (PC) - unpacking Unity asset bundles
Posted: Sat May 07, 2022 9:27 pm
by ikskoks
I think you meant "Any news?"
And yes, there is some progress, but not much. I've discovered that in this case assets are handled by "
Zeus Framework"
and main logic is probably in file
\Zeus.Framework.Asset\AssetBundleLoader.cs from decompiled source code.
But I hadn't too much time to analyze this format in detail.
Re: Ares Chronicles (PC) - unpacking Unity asset bundles
Posted: Sat May 14, 2022 9:11 pm
by ice
ikskoks wrote: ↑Sat May 07, 2022 9:27 pm
I think you meant "Any news?"
And yes, there is some progress, but not much. I've discovered that in this case assets are handled by "
Zeus Framework"
and main logic is probably in file
\Zeus.Framework.Asset\AssetBundleLoader.cs from decompiled source code.
But I hadn't too much time to analyze this format in detail.
OK
Re: Ares Chronicles (PC) - unpacking Unity asset bundles
Posted: Sat May 21, 2022 1:21 pm
by barncastle
I've had a look at this and these Asset Bundles have a custom structure as well as the usual XOR cipher protection. Unlike most games which have some in-game logic to decipher bundles before loading them, these devs have actually modified the Unity Engine (UnityPlayer.dll) to natively support their changes.
Their custom header is 32 bytes with the standard "UnityFS" signature followed by 6 big endian uint32 fields i.e.
Code: Select all
struct AresBundleHeader
{
char Signature[8]; // "UnityFS"
uint Field1;
uint Field2;
uint Field3; // null byte
uint Field4;
uint Field5;
uint Field6;
}
These field values are generated by using some elaborate bit twiddling that shifts, swaps and transforms the normal size, (un)compressedBlocksInfoSize and flag field bits. An example of decoding this can be seen
here. Additionally, the compressed block info has an XOR cipher that uses a static
key which can also be found within the modified UnityPlayer.dll.
However, as this is a custom structure, it is not just a matter of reversing these changes. You also need to rebuild each file with a proper Unity standard Asset Bundle header for it to be usable by normal tools.
I've created a tool to do just that. It extracts and converts each bundle so it can be opened with AssetStudio (and possibly Unity - I've not tested). You can find it
here, with a compiled binary under Releases. The BundleConverter class also contains (bad) example code to convert normal bundles to this customised format.
Also FYI, the _vfileIndexV2.fb file contains the names and offsets of each file within the blobs. There are also more files in the "%userprofile%/AppData/LocalLow/PerfectWorld" folder which is where updates and hotfixes get stored.