Heroes of Hammerwatch asset.bin Structure

I month or so ago I started looking into the Heroes of Hammerwatch file structures trying to see how easy it would be to create custom campaigns or mods. When I first got the game and started playing with it there were very little in-memory protections, but now the game seems to have quite a few protections in place. Both while running and in the assets themselves.

Do note though this post is being written because I'm putting this project on hiatus for some other projects and just wanted to dump what little bits and pieces I remember for future me if I pick this up again.

Right now all I've succeeded in doing is a basic understanding of the assets.bin, there was plans to figure out the town.bsa and character .savs but didn't have the time.

The tools I ended up using to aid in reversing are: Radare2, Okteta, and Kaitai Struct.

So using radare to debug the game and kaitai to template out the assets.bin with ksv I was able to brute force figure out some of the structure. There are still some parts I don't understand like what the asset_type field is used for. It seems that only 0x01 and 0x03 are used for everything. The packedsize and unpacked size to have another use since assets that aren't packed still process the packedsize field and vice-versa. Also how the data is 'packed' is still a mystery to me.


As for how the game itself loads / checks validity of the assets.bin it uses two checks. During startup the game itself has the current versions MD5 hash compiled into the game. It will compare that hash with the hash found in the file, so you can easily bypass this check just by changing the MD5 field in the assets.bin. The other check is every asset has its full/path/name.ext + data hashed with MD5* and then compared against the same compiled in hash. This can only be bypassed by NOP-ing out the check, or potentially finding a MD5 collision / padding attack if you wanted to put the time into it.

There are also some quirks that I don't understand yet about how the game is using MurmurHash3 for assets. If the assets are required to be alphabetically sorted before 'packing'. Why some assets can't be packed like .inc files.

The important bit is If you would like to just unpack the files and see whats in there you can purchase their other game 'Serious Sams Bogus Detour' which comes with a PACKAGER binary that also works on HoH assets.bin as long as you change the assets.bin magic header from HWRR to BDRP. You can also re-package with the same PACKAGER binary and change the magic back to HWRR. Then you can hexedit the MD5 to the compiled in version and NOP out the second check mentioned above to load a modified assets.bin

My kaitai struct files and other notes can be found below:
https://gitlab.com/mcd1992/heroes-of-hammerwatch-tools


*MD5 Notes:
They seem to use a modified MD5 library created by Mordechai T. Abzug
ftp://pipeline.gps.caltech.edu/pub/source/sharc/sharc-1.00b2/src/md5.cpp

Comments

Post a Comment

Popular posts from this blog

Removing Steam Link Bandwidth Limit

A reddit thread brought to my attention that there is a bandwidth limit on the steam link. I've finally figured out where the stream settings are saved and how to read / write them.You will also have to make one file called streaming_args.txt, I'll explain below. streaming_settings.bin  This config file has its maximum_bitrate_kbps set to 0. Which signifies no limit. streaming_settings_100000.bin  This config file has its maximum_bitrate_kbps set to 100,000 for 100mbps. To use these you can either scp them into your /mnt/config/system/ folder as streaming_settings.bin or you can put the file on a USB pendrive as /steamlink/config/system/streaming_settings.bin and reboot with the pendrive inserted. (Note: You need to hard 'reboot' un-plug and re-plug the power, you should see the steamlink on a blue background icon thing.) To see if it worked goto your Streaming settings and press Y to go into Advanced Settings. If it worked your Bandwidth Limit row will b
Read more

Root and SSH Access on the Steam Link

Alright this was a lot easier than I expected. Thanks Valve! After digging through the full 332 update zip I found that Valve left their developer init scripts in /etc/init.d/startup. Not sure if they did this intentionally or not but I like it. So first and foremost I was wrong about the Android AOSP thing, it looks like its just a custom linux and the android stuff I was seeing earlier was just from them using the android signing utility for their updates. Basically they use signapk on their zip files which leaves some android stuff in META-INF. So sorry about the false alarm there. As for enabling ssh on your Steam Link its very easy. All you need to do is get a pendrive and make this file in these folders: /steamlink/config/system/enable_ssh.txt (Note: the file must have some data in it, if enable_ssh.txt is empty it will not work) Then reboot the Steam Link with the pendrive inserted, after its done connecting to the network you can ssh into the Steam Link as root with the p
Read more

Arch Linux Chroot on Steam Link (Easy Setup)

Alright, this should be a much more user-friendly method of getting an Arch Linux chroot going on your steam link. But by doing it this way you're going to have to have some trust in me as we're going to be downloading and running a shell script that could potentially screw up your Steam Link. Its very un-likely though, more likely is losing important data on any storage devices you may have plugged into the Link. So first things first you're going to need a USB HDD or pendrive that you don't care about as all of the data on it needs to be wiped. After you're certain that this storage device has nothing important on it plug it into the steam link. Then you're going to need SSH access to your steam link, after you've SSH'd into your steam link do `busybox sh` to switch to a better shell with tab auto-completion. Now do `cd` to enter /home/steam/ then do `wget http://fgthou.se/steamlink/create-chroot-device.sh` to download my script that will automate t
Read more