The Gemulets reversing

First post of a series about a project I will try to update with more findings down the road.

Introduction

I want to try to dig through the game Gravity Falls: Legend of the Gnome Gemulets.

Gravity Falls: Legend of the Gnome Gemulets Cover

It’s a 3DS game from 2015 and I never tried something like this before. Hopefully the literature online is mature enough to help me through this journey.

First steps

I already own a copy of the game but the ROM extractions seems a bit too out of my league and the scope of this project so I just downloaded a .CIA file of the game somewhere on the Internet.

The first step is understanding how a CIA or CCI file work. For this task I used Asia81/HackingToolkit9DS and these are the files we got.

│   DecryptedExeFS.bin
│   DecryptedExHeader.bin
│   DecryptedManual.bin
│   DecryptedRomFS.bin
│   HeaderExeFS.bin
│   HeaderNCCH0.bin
│   HeaderNCCH1.bin
│   LogoLZ.bin
│   PlainRGN.bin
│
├───ExtractedBanner
│       banner.bcwav
│       banner.cbmd
│       banner.cgfx
│       banner1.bcmdl
│       banner10.bcmdl
│       banner11.bcmdl
│       banner12.bcmdl
│       banner13.bcmdl
│       banner2.bcmdl
│       banner3.bcmdl
│       banner4.bcmdl
│       banner5.bcmdl
│       banner6.bcmdl
│       banner7.bcmdl
│       banner8.bcmdl
│       banner9.bcmdl
│
├───ExtractedExeFS
│       banner.bin
│       code.bin
│       icon.bin
│
├───ExtractedManual
│       Manual.bcma
│
└───ExtractedRomFS
    │   bundle_ctr.ipk
    │   dummydata.dat
    │   fulllogic_ctr.ipk
    │   mapfile.txt
    │   maplist.metapreload
    │   patch_ctr.ipk
    │   persistentloading_ctr.ipk
    │   secure_fat.gf
    │   worldmap_ctr.ipk
    │
    ├───enginedata
    │   └───localisation
    │           localisation.loc8
    │
    └───video
            logos_intro.moflex

On line 38 we can see the biggest file of all: bundle_ctr.ipk. That’s probably where all the game assets are stored.

Soooo: what is an .ipk file?

Let’s try searching on GitHub if someone documented this file format:

Github search: “ipk format”

Our eyes go directly to this project: Just Dance 2019 IPK File Unpacker.

Why is this important? Because it’s a game and it’s made by Ubisoft, the same company behind the software used to make GF:TLOG so we are on the correct track.

Let’s try searching “just dance ipk file” on Google to see

After a little bit of Googling we get some information and stumble upon QuickBMS which is a software developed to uncompress this sort of files.

QuickBMS takes in input a “file descriptor” and our “packed file” and extracts every resource in it. It is pretty powerful and costumizable. For our needs we can try to see if some of the ipk file descriptors work.

We have a file descriptor for Rayman Origins, Blue Dragon and Just Dance 2014. We are interested in RO and JD2014 because they are made by Ubisoft so they will be pretty similar.

Let’s start the software with quickbms.exe /G and select our .bms file descriptor, our target file and create a folder where we want to extract it.

The first attempt with JD2014 doesn’t work. Using the Rayman Origins bms file the software is finally capable of extracting the content from bundle_ctr.ipk. Go here for a complete list of all files. (Beware that the page is heavy to load for small powered devices)

Once extracted we are going to have 3140 new files.

As we can see on the line #4416 we have a secretcode_ui.isc.ckd in the credits folder.

Opening it up with an hex editor we can see the file structure

00000000  00 00 00 01 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 04  97 ca 62 8b 00 00 00 00  |..........b.....|
00000020  3f 80 00 00 3f 80 00 00  00 00 00 00 00 00 00 0b  |?...?...........|
00000030  53 65 63 72 65 74 5f 52  6f 6f 74 00 00 00 00 44  |Secret_Root....D|
00000040  09 9a 2d 43 88 01 76 00  00 00 00 00 00 00 00 00  |..-C..v.........|
00000050  00 00 00 ff ff ff ff 00  00 00 00 00 00 00 22 77  |.............."w|
00000060  6f 72 6c 64 2f 63 6f 6d  6d 6f 6e 2f 75 69 2f 63  |orld/common/ui/c|
00000070  6f 6d 6d 6f 6e 2f 63 6f  6d 70 6f 6e 65 6e 74 73  |ommon/components|
00000080  2f 00 00 00 12 67 66 5f  75 69 6d 65 6e 75 62 61  |/....gf_uimenuba|
00000090  73 69 63 2e 74 70 6c 46  03 ad e8 00 00 00 00 00  |sic.tplF........|
000000a0  00 00 00 00 00 00 01 2d  0e 45 c8 00 00 00 00 00  |.......-.E......|
000000b0  00 00 01 00 00 00 04 00  00 00 05 44 a0 00 00 44  |...........D...D|
000000c0  34 00 00 00 00 00 00 00  00 00 02 c6 fd ca e3 ff  |4...............|
000000d0  ff ff ff ff ff ff ff c6  fd ca e3 ff ff ff ff ff  |................|
000000e0  ff ff ff ff ff ff ff 00  00 00 00 97 ca 62 8b 3f  |.............b.?|
000000f0  80 00 00 3f 80 00 00 3f  80 00 00 00 00 00 00 00  |...?...?........|
00000100  00 00 09 75 69 74 65 78  74 62 6f 78 00 00 00 00  |...uitextbox....|
00000110  44 20 00 04 43 b5 93 d1  00 00 00 00 00 00 00 00  |D ..C...........|
00000120  00 00 00 00 ff ff ff ff  00 00 00 00 00 00 00 22  |..............."|
00000130  77 6f 72 6c 64 2f 63 6f  6d 6d 6f 6e 2f 75 69 2f  |world/common/ui/|
00000140  63 6f 6d 6d 6f 6e 2f 63  6f 6d 70 6f 6e 65 6e 74  |common/component|
00000150  73 2f 00 00 00 1c 75 69  74 65 78 74 62 6f 78 5f  |s/....uitextbox_|
00000160  61 6c 70 68 61 61 6e 69  6d 61 74 69 6f 6e 2e 74  |alphaanimation.t|
00000170  70 6c 53 f2 c0 8e 00 00  00 00 00 00 00 01 00 00  |plS.............|
00000180  00 00 00 00 00 0b 53 65  63 72 65 74 5f 52 6f 6f  |......Secret_Roo|
00000190  74 00 00 00 00 42 b3 2e  b3 42 b6 49 69 3f 80 00  |t....B...B.Ii?..|
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001b0  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001c0  00 00 00 00 01 d1 0c be  ed 00 00 00 01 00 00 00  |................|
000001d0  01 00 00 00 04 00 00 00  04 44 a0 00 00 44 34 00  |.........D...D4.|
000001e0  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 3f b3 33 33 3f b3 33  33 bf 80 00 00 bf 80 00  |.?.33?.33.......|
00000200  00 bf 80 00 00 00 00 00  04 54 65 78 74 00 00 0b  |.........Text...|
00000210  2b 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |+...............|
00000220  00 00 00 00 00 00 00 00  00 00 00 00 00 3f 80 00  |.............?..|
00000230  00 ff ff ff ff ff ff ff  ff ff ff ff ff 97 ca 62  |...............b|
00000240  8b 3f 80 00 00 3f 80 00  00 3f 80 00 00 00 00 00  |.?...?...?......|
00000250  00 00 00 00 0c 53 65 63  72 65 74 5f 45 6e 74 65  |.....Secret_Ente|
00000260  72 00 00 00 00 44 94 cc  4a 44 2d dc 5a 00 00 00  |r....D..JD-.Z...|
00000270  00 00 00 00 00 00 00 00  00 ff ff ff ff 00 00 00  |................|
00000280  00 00 00 00 15 77 6f 72  6c 64 2f 63 72 65 64 69  |.....world/credi|
00000290  74 73 2f 61 63 74 6f 72  73 2f 00 00 00 16 75 69  |ts/actors/....ui|
000002a0  5f 6d 65 6e 75 69 74 65  6d 5f 62 75 74 74 6f 6e  |_menuitem_button|
000002b0  2e 74 70 6c 17 02 ae 48  00 00 00 00 00 00 00 01  |.tpl...H........|
000002c0  00 00 00 00 00 00 00 0b  53 65 63 72 65 74 5f 52  |........Secret_R|
000002d0  6f 6f 74 00 00 00 00 44  1f fe 66 43 d3 b7 3e 3f  |oot....D..fC..>?|
000002e0  80 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000002f0  00 00 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000300  00 00 00 00 00 00 02 ec  59 cf 6e 00 00 00 01 00  |........Y.n.....|
00000310  00 00 01 00 00 00 04 00  00 00 04 44 a0 00 00 44  |...........D...D|
00000320  34 00 00 00 00 00 01 00  00 00 00 7b 48 a9 ae 3f  |4..........{H..?|
00000330  80 00 00 3f 80 00 00 3f  80 00 00 3f 80 00 00 00  |...?...?...?....|
00000340  00 00 00 3f 80 00 00 00  00 00 00 3f 80 00 00 00  |...?.......?....|
00000350  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 3f  |...............?|
00000360  80 00 00 00 00 00 00 00  00 00 01 00 00 00 00 00  |................|
00000370  00 00 00 00 00 00 00 00  00 00 00 ff ff ff ff 00  |................|
00000380  00 00 00 00 00 00 01 00  00 00 00 00 00 00 00 ff  |................|
00000390  ff ff ff 00 00 00 00 00  00 00 00 00 00 00 00 ff  |................|
00000400  ff ff ff 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000410  00 00 00 ff ff ff ff 00  00 00 00 ff ff ff ff ff  |................|
00000420  ff ff ff 00 00 00 00 3f  80 00 00 3f 80 00 00 00  |.......?...?....|
00000430  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 97  |................|
00000440  ca 62 8b 00 00 00 00 3f  80 00 00 3f 80 00 00 00  |.b.....?...?....|
00000450  00 00 00 00 00 00 0f 75  69 73 69 6d 70 6c 65 74  |.......uisimplet|
00000460  65 78 74 75 72 65 00 00  00 00 44 1e ee 54 43 c6  |exture....D..TC.|
00000470  ee 61 00 00 00 00 00 00  00 00 00 00 00 00 ff ff  |.a..............|
00000480  ff ff 00 00 00 00 00 00  00 1a 65 6e 67 69 6e 65  |..........engine|
00000490  64 61 74 61 2f 61 63 74  6f 72 74 65 6d 70 6c 61  |data/actortempla|
000004a0  74 65 73 2f 00 00 00 1e  74 65 78 74 75 72 65 67  |tes/....textureg|
000004b0  72 61 70 68 69 63 63 6f  6d 70 6f 6e 65 6e 74 5f  |raphiccomponent_|
000004c0  32 64 2e 74 70 6c 3e e2  58 96 00 00 00 00 00 00  |2d.tpl>.X.......|
000004d0  00 01 00 00 00 00 00 00  00 0b 53 65 63 72 65 74  |..........Secret|
000004e0  5f 52 6f 6f 74 00 00 00  00 42 aa a1 33 42 fb b3  |_Root....B..3B..|
000004f0  a9 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000500  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  |................|
00000510  00 00 00 00 00 00 00 00  02 7b 48 a9 ae 00 00 00  |.........{H.....|
00000520  00 00 00 00 00 00 00 00  00 3f 80 00 00 00 00 00  |.........?......|
00000530  00 3f 80 00 00 00 00 00  00 3f 80 00 00 00 00 00  |.?.......?......|
00000540  00 00 00 00 00 00 00 00  00 00 00 00 00 3f 80 00  |.............?..|
00000550  00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00000560  00 00 00 00 00 00 00 00  00 ff ff ff ff 00 00 00  |................|
00000570  00 00 00 00 01 00 00 00  25 77 6f 72 6c 64 2f 63  |........%world/c|
00000580  6f 6d 6d 6f 6e 2f 75 69  2f 63 6f 6d 6d 6f 6e 2f  |ommon/ui/common/|
00000590  73 69 6d 70 6c 65 74 65  78 74 75 72 65 2f 00 00  |simpletexture/..|
000005a0  00 13 77 68 69 74 65 62  61 63 6b 67 72 6f 75 6e  |..whitebackgroun|
000005b0  64 2e 70 6e 67 88 4c c8  aa 00 00 00 00 00 00 00  |d.png.L.........|
000005c0  00 00 00 00 00 ff ff ff  ff 00 00 00 00 00 00 00  |................|
00000630  00 00 00 00 00 00 00 00  00 ff ff ff ff 00 00 00  |................|
00000640  00 ff ff ff ff ff ff ff  ff ff ff ff ff 3f 80 00  |.............?..|
00000650  00 3f 80 00 00 00 00 00  00 00 00 00 00 44 a2 80  |.?...........D..|
00000660  00 44 48 00 00 85 0e 47  05 00 00 00 01 00 00 00  |.DH....G........|
00000670  01 00 00 00 04 00 00 00  04 44 a0 00 00 44 34 00  |.........D...D4.|
00000680  00 00 00 00 00 00 00 00  00 00 00 00 00           |.............|

@ExAnironApr 29, 2022

Introduction

First steps

@ExAniron
Apr 29, 2022