Collection of patterns, scripts and more for reverse engineering ForzaTech game engine resources used in Forza game series since 2015, starting with Forza Motorsport 5.
ImHex patterns for .carbin
and .modelbin
game resources.
carbin_importer.py
, modelbin_importer.py
*.modelbin
file including characters, props and buildings (modelbin_importer.py
)Paste the carbin_importer.py
contents into Blender 4.2 Scripting Text Editor and Run Script.
game_path
is the absolute path to the game rip root folder with unzipped cars, tires, materials, shaders and textures. The rip must have the original folder structure (Media\Cars\NIS_SkylineFF_99\NIS_SkylineFF_99.carbin
). For FM7 and later, place the Base
and PCFamily
folder contents directly into the Media
folder. Unzip Materials_pri_*.zip
into the Materials
folder.
db_path
is the absolute path to the unencrypted GameDB.slt file. It may be located outside the game folder.
If you don't have it (FH5 v1.642.644.0 and later, FM2023), then comment the block above and uncomment the block below # FH3, KOE_One_15, 2188
, set use_db = False
, edit game_path
and media_name
according to your needs.
carbin_converter.mjs
It deserializes the Forza Horizon 5/Forza Motorsport (2023) input file and then serializes the Forza Horizon 4/Forza Motorsport 7 output file compatible with 3DSimED 3.2c. Actually, it just replaces the first byte with 05
and drops 5 unnecessary bytes at the end of model chunks. Forza Horiozn 5 also has an updated .materialbin
file format not supported by 3DSimED, so a lot of warnings must be skipped.
cd D:\ForzaTech-extraction-tools-main\scripts
node carbin_converter.mjs "D:\games\rips\FH5\media\Cars\NUL_Car_00\NUL_Car_00.carbin.bak"
string_extractor.mjs
Prints a list of all strings contained in the input file in the following formats:
<u32 length> <u8 data[length]>
<u16 length> <u8 data[length]>
For example, 0A 00 00 00 6E 75 6C 5F 63 61 72 5F 30 30
is a string "nul_car_00" 10 bytes long. It was useful for researching .carbin
and _skeleton.modelbin
.
Media\Cars\*\*.carbin
279 / 397 bytes unknown
05 00
FH4, FH5 NUL_Car_0006 00
FH501
at the end (type 6 only)03 00
type10 00
FH412 00
FH5Media\Cars\*\*.modelbin
Entry
Multicharacter literal ('Grub' == 0x47727562
).
-1
FH5 DOD_caliperLR_006Media\_library\Shaders\*\*.shaderbin
It contains compiled HLSL shaders: DXBC (FH3), DXIL (FH5).
Install Windows SDK. *.durango.vso/pso
got error, use *.pc.vso/pso
.
&"C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\fxc.exe" /dumpbin m_ch2normglossalphaemissiveCarLightScenario.pc.vso /Fc m_ch2normglossalphaemissiveCarLightScenario.pc.vso.asm
Install https://github.com/yhyu13/HLSLDecompiler/releases. *.pc.vso/pso
got error, use *.durango.vso/pso
.
&"C:\Users\Doliman100\Downloads\HLSLDecompiler_0.3\cmd_Decompiler.exe" -D m_ch2normglossalphaemissiveCarLightScenario.durango.vso
Media\Stripped\gamedbRC.slt
It seems to be necessary for correct scaling and positioning of wheels and selecting of tires.
Tutorial
ForzaHorizon5.exe (CRC32: BFCEECA8)
00000001408FCFFE: call DeobfuscateGameDB(_, _, destination address, size, _)
Stage 1: Arxan TransformIT.
Stage 2: Obfuscation based on CRC-32.
Media\Stripped\StringTables\EN\*.str
Related to gamedbRC.slt tables.
00 04
version_&16972226482902517561
39 C7 E1 40 10 76 89 EB
"IDS_DisplayName_1"Keygen is available on GameModels Community.
3DSimED3.exe v3.2.3.1 (CRC32: C7FD36C3, protection: PC Guard 5.01, OEP: 007CC646, IAT: 008B1000)
IAT invalid imports:
008B141C: kernel32.ExitProcess
008B15D8: ?
008B15DC: ?
008B15E0: ?
008B1BC8: ?
The first four APIs are mentioned here. I couldn't find which DLLs they refer to. Maybe they are used to load import/export modules dynamically.
The XeNTaX community for sharing their research of .carbin
and .modelbin
file structure and creating tutorials for researching unknown 3D formats.