The VG Resource
Encrypted OFS3 Files? - Printable Version

+- The VG Resource (https://www.vg-resource.com)
+-- Forum: The Resources (https://www.vg-resource.com/forum-109.html)
+--- Forum: The Spriters Resource (https://www.vg-resource.com/forum-110.html)
+---- Forum: Ripping Help (https://www.vg-resource.com/forum-114.html)
+---- Thread: Encrypted OFS3 Files? (/thread-43029.html)

Encrypted OFS3 Files? - Lillyth-Sillyth - 09-19-2024

I'm currently working on extracting character sprites, event illustrations, and dialogue backgrounds from Sword Art Online: Alicization Lycoris.
The game seems to use the exact same / very similar file types and folder structure as two of its predecessors (Sword Art Online: Hollow Fragment and Hollow Realization).
With the sprites / illustrations / backgrounds of the latter being packaged like this:
  1. CPK File
  2. OFS3 Files
  3. PHYRE Files
  4. DDS Files
  5. PNG Files

For Lycoris, I managed to extract the CPK without problems, and even successfully extracted all cutscenes and sound files.
However, I am struggling with unpacking what should be OFS3 files. At first, I thought it was simply a different file type, or incorrectly extracted from the CPK.
The first line when opening it with an HEX editor (which usually should contain the phrase OFS3) only reads this gibberish [HEX Value > ASCII Value]:
  • BC AD B6 B3 BE A6 B3 BE FF 64 B2 FF FF 3A F1 FF > ¼.¶³¾¦³¾ÿd²ÿÿ:ñÿ
And the entire rest of the file looks essentially the same - no clear information anywhere to be found.

However, when scrolling all the way to the bottom, I managed to find these lines [HEX Value > ASCII Value] :
  • 4F 46 53 33 10 00 00 00 00 00 40 00 F0 9B 4D 00 > OFS3......@.ð›M.
  • 4F 46 53 33 10 00 00 00 01 00 40 00 70 6A 27 00 > OFS3......@.pj'.
  • 52 59 48 50 54 00 00 00 D7 08 00 00 31 31 58 44 > RYHPT...×...11XD
Those seem to indicate that the file is an OFS3 file after all. But unpacking it with my usual method (OFS3 Tool by Liquid-S from GitHub) does not work.
QuickBMS also could not extract them as a PHYRE file.

Since I am pretty new to this whole topic, I haven't encountered anything like this before.
My current theory is that the file might be encrypted to some degree, though I have no idea how to confirm this.

Have any of you ever seen something like this, and do you know if there is any way to get this thing unpacked?
I attached one of the affected files, so you can have a look for yourself.

.zip   SpriteOFS3.zip (Size: 871.09 KB / Downloads: 22)
Would be really happy if anyone had some leads for me. And thanks in advance!

RE: Encrypted OFS3 Files? - axx1611 - 10-22-2024

I think they are not OFS3 RAW files, but OFS3 files compressed in CRILAYLA format.
and SAOAL's CRILAYLA format is also modified.
You need to XOR the first 32 bytes (I'm not sure if it is fixed 32 bytes) with 0xFF first (after XOR, you will see the CRILAYLA file header)

In addition, the reason why you can see the OFS3 word is because the CRILAYLA format does not compress the first 256 bytes but directly saves them at the end of the file.
I highly suspect that most of SAOAL's files have been processed in a similar way.