Doliman100 / ForzaTech-extraction-tools

Reverse engineering the structure of .carbin and .modelbin files from Forza game series.
GNU General Public License v3.0
31 stars 5 forks source link

ForzaTech extraction tools

Collection of patterns, scripts and more for reverse engineering ForzaTech game engine resources used in Forza game series since 2015, starting with Forza Motorsport 5.

Patterns

screenshot of .carbin file opened in a hex editor ImHex patterns for .carbin and .modelbin game resources.

Scripts

carbin_importer.py, modelbin_importer.py

screenshot of Nissan Skyline GT-R opened in Blender

Features

How to use

Paste the carbin_importer.py contents into Blender 4.2 Scripting Text Editor and Run Script.
game_path is the absolute path to the game rip root folder with unzipped cars, tires, materials, shaders and textures. The rip must have the original folder structure (Media\Cars\NIS_SkylineFF_99\NIS_SkylineFF_99.carbin). For FM7 and later, place the Base and PCFamily folder contents directly into the Media folder. Unzip Materials_pri_*.zip into the Materials folder.
db_path is the absolute path to the unencrypted GameDB.slt file. It may be located outside the game folder. If you don't have it (FH5 v1.642.644.0 and later, FM2023), then comment the block above and uncomment the block below # FH3, KOE_One_15, 2188, set use_db = False, edit game_path and media_name according to your needs.

carbin_converter.mjs

screenshot of Mercedes AMG One opened in 3DSimED It deserializes the Forza Horizon 5/Forza Motorsport (2023) input file and then serializes the Forza Horizon 4/Forza Motorsport 7 output file compatible with 3DSimED 3.2c. Actually, it just replaces the first byte with 05 and drops 5 unnecessary bytes at the end of model chunks. Forza Horiozn 5 also has an updated .materialbin file format not supported by 3DSimED, so a lot of warnings must be skipped.

cd  D:\ForzaTech-extraction-tools-main\scripts
node carbin_converter.mjs "D:\games\rips\FH5\media\Cars\NUL_Car_00\NUL_Car_00.carbin.bak"

string_extractor.mjs

Prints a list of all strings contained in the input file in the following formats:

<u32 length> <u8 data[length]>
<u16 length> <u8 data[length]>

For example, 0A 00 00 00 6E 75 6C 5F 63 61 72 5F 30 30 is a string "nul_car_00" 10 bytes long. It was useful for researching .carbin and _skeleton.modelbin.

Resources

Media\Cars\*\*.carbin

279 / 397 bytes unknown

Hierarchy

Structures

Links

Media\Cars\*\*.modelbin

Structures

Links

Media\_library\Shaders\*\*.shaderbin

It contains compiled HLSL shaders: DXBC (FH3), DXIL (FH5).

Shader types

How to disassemble DXBC

Install Windows SDK. *.durango.vso/pso got error, use *.pc.vso/pso.

&"C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\fxc.exe" /dumpbin m_ch2normglossalphaemissiveCarLightScenario.pc.vso /Fc m_ch2normglossalphaemissiveCarLightScenario.pc.vso.asm

How to decompile DXBC

Install https://github.com/yhyu13/HLSLDecompiler/releases. *.pc.vso/pso got error, use *.durango.vso/pso.

&"C:\Users\Doliman100\Downloads\HLSLDecompiler_0.3\cmd_Decompiler.exe" -D m_ch2normglossalphaemissiveCarLightScenario.durango.vso

Media\Stripped\gamedbRC.slt

It seems to be necessary for correct scaling and positioning of wheels and selecting of tires.

Decrypt

Tutorial
ForzaHorizon5.exe (CRC32: BFCEECA8)

00000001408FCFFE: call DeobfuscateGameDB(_, _, destination address, size, _)

Stage 1: Arxan TransformIT.
Stage 2: Obfuscation based on CRC-32.

Links

Media\Stripped\StringTables\EN\*.str

Related to gamedbRC.slt tables.

Structures

Links

Other tools

3DSimED

Keygen is available on GameModels Community.
3DSimED3.exe v3.2.3.1 (CRC32: C7FD36C3, protection: PC Guard 5.01, OEP: 007CC646, IAT: 008B1000)
IAT invalid imports:

008B141C: kernel32.ExitProcess
008B15D8: ?
008B15DC: ?
008B15E0: ?
008B1BC8: ?

The first four APIs are mentioned here. I couldn't find which DLLs they refer to. Maybe they are used to load import/export modules dynamically.

Environment

Thanks

The XeNTaX community for sharing their research of .carbin and .modelbin file structure and creating tutorials for researching unknown 3D formats.