Doliman100/ForzaTech-extraction-tools

Reverse engineering the structure of .carbin and .modelbin files from Forza game series.

ForzaTech extraction tools

Collection of patterns, scripts and more for reverse engineering ForzaTech game engine resources used in Forza game series since 2015, starting with Forza Motorsport 6.

Patterns

ImHex patterns for .carbin and .modelbin game resources.

Scripts

cd  D:\ForzaTech-extraction-tools-main\scripts
node carbin_converter.js "D:\games\rips\FH5\media\Cars\NUL_Car_00\NUL_Car_00.carbin.bak"

carbin_converter.js

It deserializes the Forza Horizon 5/Forza Motorsport (2023) input file and then serializes the Forza Horizon 4/Forza Motorsport 7 output file compatible with 3DSimED 3.2c. Actually, it just replaces the first byte with 05 and drops 5 unnecessary bytes at the end of model chunks. Forza Horiozn 5 also has an updated .materialbin file format not supported by 3DSimED, so a lot of warnings must be skipped.

string_extractor.js

Prints a list of all strings contained in the input file in the following formats:

<u32 length> <u8 data[length]>
<u16 length> <u8 data[length]>

For example, 0A 00 00 00 6E 75 6C 5F 63 61 72 5F 30 30 is a string "nul_car_00" 10 bytes long. It was useful for researching .carbin and _skeleton.modelbin.

Resources

media\Cars\*\*.carbin

279 / 397 bytes unknown

Hierarchy

• Root
  • ChunkA[0]
    • Model[0]
    • Model[1]
    • ...
  • ...
  • ChunkB[0]
    • Model[0]
    • Model[1]
    • ...
  • ...

Structures

• Root (1*5+2=7 / 42 bytes unknown)
  • type
    05 00 FH4, FH5 NUL_Car_00
    06 00 FH5
  • guid
  • car name
  • skeleton path
  • 01 at the end (type 6 only)
• ChunkA (1*7+4*8=39 / 43 bytes unknown)
• ChunkB (4+(1*13+4*8)+((4))=53 / 67 bytes unknown)
  Upgrade parts?
  • 03 00 type
• Model (4*16+2+1+4+(4)+8+4+(1*2+1*27)+1*19+1*20+4+(16)+5=180 / 245 bytes unknown)
  • type
    10 00 FH4
    12 00 FH5
  • guid
  • 5 unknown bytes at the end (type 18 only)

Links

• Model chunk

media\Cars\*\*.modelbin

Structures

• Entry

  • tag

    Reversed because it is stored as a number.[link] In C++ it looks like this:

    uint32_t type = *(uint32_t *)("Grub");
    std::cout << std::hex << type;
    // Expected output: 62757247

    • Skel - Skeleton
      • count: 1
      • no properties
    • Mrph - Morph
      • count: 0-1
      • no properties
    • MatI - Material Info
      • properties
        • Name
        • Id
    • Mesh
      • properties
        • Name
        • BBox
    • IndB - Index Buffer
      • count: 0-1
      • properties
        • Id
    • VLay - Vertex Layouts
      • properties
        • Id
          -1 FH5 DOD_caliperLR_006
    • VerB - Vertex Buffer
      • properties
        • Id
    • Skin
      • properties
        • Id
    • MBuf
    • Modl - Model
      • count: 1
      • properties
        • BBox
        • TRef (optional)

  • properties

    • Name
    • Id
    • BBox - Bounding Box
    • TRef
      • array of unknown 4-byte elements

  • data address

    • aligned to 4 bytes

Links

• Part 1
  • Entry properties
• Part 2
• Part 3 - LOD
  • Skel entry
• Part 4 - UV
• Download experimental tools

media\Stripped\gamedbRC.slt

It seems to be necessary for correct scaling and positioning of wheels and selecting of tires.

Decrypt

Tutorial
ForzaHorizon5.exe (CRC32: BFCEECA8)

00000001408FCFFE: call DeobfuscateGameDB(_, _, destination address, size, _)

Stage 1: Arxan TransformIT.
Stage 2: Obfuscation based on CRC-32.

Links

• Crypto tool
• Download decrypted
• Data_Car table

media\Stripped\StringTables\EN\*.str

Related to gamedbRC.slt tables.

Structures

• Root
  • 00 04 version
  • table name buffer
• StringInfo
  • id
    The first byte of the placeholder name hash.
    _&16972226482902517561 39 C7 E1 40 10 76 89 EB "IDS_DisplayName_1"

Links

• 010 Editor pattern and C# hash function

Other tools

3DSimED

Keygen is available on GameModels Community.
3DSimED3.exe v3.2.3.1 (CRC32: C7FD36C3, protection: PC Guard 5.01, OEP: 007CC646, IAT: 008B1000)
IAT invalid imports:

008B141C: kernel32.ExitProcess
008B15D8: ?
008B15DC: ?
008B15E0: ?
008B1BC8: ?

The first four APIs are mentioned here. I couldn't find which DLLs they refer to. Maybe they are used to load import/export modules dynamically.

Environment

• Node.js v18.14.0
• ImHex v1.30.1
• Forza Horizon 5 v1.405.2.0 (Steam) [EMPRESS]
• Forza Horizon 4 v1.466.445.0 (Steam) [EMPRESS]
• Forza Horizon 3 v1.0.37.2 (UWP) "OpusDev"

Thanks

The XeNTaX community for sharing their research of .carbin and .modelbin file structure and creating tutorials for researching unknown 3D formats.