[Request] unpack base.ipak

[raminr63]

Hi

Guys did someone find a way to unpack base.ipak file?!

[JariZ]

If somebody did it would've been posted here already.
Short answer: No.

[iPaddie]

If somebody did it would've been posted here already.
Short answer: No.

[SuperNovaAO]

Can someone send me a small ipak file please?

[House]

Can someone send me a small ipak file please?

@Skype

[Nekochan]

Damn treyarch crypted everything....

[kokole]

Damn treyarch crypted everything....

IGNORE THIS, READ NEW POST
I dont think .ipak are crypted because if you search for "iwi" you will find matches. I just think its like rar/zip uncompressed with a custom header

---

Ok, so I have some info on the .ipak header (got on my own):

Code:

.ipak 48 bytes header:
0x00 DWORD - identifier ("KAPI")
0x04 DWORD - unknown
0x08 DWORD - file size
0x0C DWORD - unknown
0x10 DWORD - unknown
0x14 DWORD - data start pointer
0x18 DWORD - data size (data end = data start pointer + data size)
0x1C DWORD - probably num of files
0x20 DWORD - unknown
0x24 DWORD - unknown pointer (points to some section)
0x28 DWORD - unknown
0x2C DWORD - probably num of files

^ This goes this way: offset, size, description
Hope someone finds what these unknowns are

By the way, looks like they use 0xA7 byte for start/end padding, and 0xCD or 0x93 byte to separate files padding

[kokole]

Ok, so what I have posted before might be wrong: an .ipak contains different sections, and deppending on how many sections are there, the size of the header is different.

Info here:

Code:

Each section has a 16 bytes header, depending on the number
of sections in the .ipak header, the size of the full header
is different, example:
[.ipak header]        - 16 bytes
[section 1 header]    - 16 bytes
[section 2 header]    - 16 bytes

Each header is of 16 bytes, so the above example file has a
48 byte header

The headers of an .ipak file are the first bytes...

.ipak 16 bytes header:
0x00 DWORD - identifier ("KAPI")
0x04 DWORD - unknown
0x08 DWORD - file size
0x0C DWORD - number of sections

secion 16 bytes header:
0x00 DWORD - section index
0x04 DWORD - data start pointer
0x08 DWORD - data size (data end = data start pointer + data size)
0x0C DWORD - unknown

Maybe each index means sound, images, and other stuff

Looks like the index for .iwi files is 2

This is what I get after examinating the file for 10 minutes

Example for lazy people:


The bytes in memory are reversed so we need to reverse 00 00 04 00 and we
get 00 04 00 00 which is 40000 in hex
We go to the position 40000 in the file and...

We know why its the .iwi files section because its section 2 (index 2, reversing the bytes):


You could write a tool now, or I could write it when I have time...

[Tomsen1410]

Really, really nice @kokole ! +1

But there is something I dont get:
Why is the pointer reversed?

---

The 4th section has to do soemthing with the IWI stuff aswell.(if it does exist)
Looks like the content and the locations in memory of the .IWI file or something like that.


I dont know a lot about these things, so someone could tell me what the 4th section could be?

[kokole]

@Tomsen1410

When you read from memory the bytes get reversed, for example if you use ReadProcessMemory from some address that has an int32 with a value of 2, it will appear like 02 00 00 00 instead of 00 00 00 02 in memory. Don't really know why is this but just deal with it
This .ipak file is like uhm, "ready" for memory usage.