Project Title

A brief description of what this project does and who it's for

How Unreal Engine 4/5 Projects Are Shipped and the Role of the AES Key

Shipping UE4/5 Projects

When a project built with Unreal Engine 4 or 5 (UE4/UE5) is packaged for release, the engine compiles the game assets, code, and content into a distributable format suitable for the target platform (e.g., PC, consoles, mobile). This packaging process includes:

• Asset Cooking: UE4/5 "cooks" game assets, converting source assets into platform-specific, optimized formats.
• Packaging: The cooked assets and binaries are then bundled together into containers known as pak files (.pak), which are essentially archives that hold all the necessary game data.
• Encryption: For security and anti-tampering purposes, these pak files are often encrypted using AES (Advanced Encryption Standard). This encryption protects the game assets from unauthorized extraction or modification, helping safeguard intellectual property and reduce cheating.

Why You Need to Crack the AES Key

The AES encryption key is critical because it is used to encrypt and decrypt the pak files. During normal gameplay, the engine uses this key internally to decrypt the game data on the fly. However, when performing tasks such as:

• Modding: Modders may want to access or modify game assets.
• Data Extraction: Developers, analysts, or security researchers may need to extract assets for debugging, localization, or forensic purposes.
• Reverse Engineering: In some cases, understanding game behavior or troubleshooting requires inspecting encrypted data.

Since the AES key is not publicly distributed with the shipped game to prevent piracy and cheating, it is necessary to crack or extract the AES key to gain access to the encrypted contents of the pak files.

Disclaimer: This repository is intended solely for academic and educational purposes. The owner of this repository is not responsible for any damage, loss, or issues that may arise from the use, modification, or distribution of the code or documentation provided herein. By using any part of this project, you acknowledge and agree that you do so at your own risk.

Now having this information there are a few things that have to be done in order to mod a game without mod support. The given example we are going to use is a game called Motor Town Behind the Wheel. A game in which mods are not supported.

Tools we are going to use, please download:

• Fmodel This is a tool that browses UE game archives, for example .pak files
• UE4SS (Download experimental) A lua injector, in our case we will be using it to extract a file. Tho you can use it for multiple things.
• UAssetGUI this we will be using for reading/editing uasset files, extracted from pak archives
• Repak This we will be using to create the new pak (desire mod) for the game
• AEScracker This we'll use to find the AES-256 key

1. Obtaining the private key

Now, first thing we need is to get is the AES key of the shipped binary that is used to access the main pak file (or others)

To do so, download the AESCracker above and unzip the contents somewhere. Keep it around, you might need it. No, really, you are gonna need the thing.

Now inside the folder just move inside the binary of the game. To locate it find the folder of the game. For steam for example, you right click the game, hover "Manage" and click "Browse Local Files". The binary should be located in <GAMENAME>/Binaries/Win64 and there you shall see a .exe named like '<GAMENAME>-WIn64-Shipping.exe' now, grab that .exe file and put it in the folder just created with the AES thing. All you wanna do now is drag and drop the .exe file over to the batch file named RUN Find 256-bit UE4 AES Key.bat and wait. Now a new window shall appear and just follow the prompt accordingly, when it starts to say "Finding" then you know it started. Now with a backgracking algorithm now the application is lurking for AES keys. For the example game, Motor Town, the binary is called MotorTown-Win64-Shipping.exe so now the folder MotorTown-Win64-Shipping will be created in which there will be plenty of keys possible, no worry, we will find out which one is the right one soon enough. After it's finished running press enter for it to close. In the new folder MotorTown-Win64-Shipping now there are multiple folders with some numbers (you are here to create mods, so don't mind that). Each one contains one file with a file named with an AES-256 key. So a few that we will need to test.

2. Obtain the mappings

Mappings are needed to translate or link data between different formats or systems, ensuring accurate interpretation and proper functionality.

Now, let's get them. Go back into the folder of the game, go in the folder of the .exe file copied earlier and drop the contents of the UE4SS archive inside of it (a .dll and a folder called ue4ss). Now after dropping them you shall do some small changes to UE4SS-Settings.ini from the ue4ss folder dropped. Search for debug and enable them all.

[Debug]
; Whether to enable the external UE4SS debug console.
ConsoleEnabled = 1
GuiConsoleEnabled = 1
GuiConsoleVisible = 1

In case your log is flooded with scan failed you might to do the following patch:

• go to the ue4ss folder
• create a folder named UE4SS_Signatures
• create a new file GUObjectArray.lua with the following content:

function Register()
    return "48 8B ?? ?? ?? ?? ?? 48 8B 0C C8 ?? 8B 04 ?? 48 85 C0"
end

function OnMatchFound(matchAddress)
    local nextInstr = matchAddress + 0x7
    local offset = matchAddress + 0x3
    local dataMoved = nextInstr + DerefToInt32(offset)-0x10
  
    return dataMoved
end

Now start the game. Wait for the Debugger with the purple buttons to show up. Click on "Dumpers" then click on "Generate .usmap file"

Wait for it to finish and save the .usmap for that version somewhere safe, along with the AES key eventually. Now you can remove the dll and ue4ss for the moment, or just move the .dll outside the of the folder of the .exe of the game until you need it again.

3. What do you wanna extract?

Fire up Fmodel

Top corner click "Directory" then click "Selector", you might see in the "Detected Game" field that there are a few to edit if you have some UE based games. Go to the button below "ADD UNDETECTED GAME", click the 3 dots and get to the path of the game where there are 2 folders: "Binaries" and "Content", then click the +.

From the top section now select the UE version, in my case with Motor Town is 5.5 and click "OK"

"It looks like you just changed something. Fmodel will restart to apply your changes." - let it restart

Now you should see the .pak files listed as game archives, tho the ones that need the AES key will be greyed out.

Now, top corner click "Directory" and then click "AES" then there will be an input with the key you wanna include.

Now try all the AES keys from step 1 until the .pak can be selected. An example of an AES key: 0x0000803F0000803F0000803F0000803F000048430000F041000048450AD7A33C i will not give you the real key here.

Double click the .pak of the game.

Now you wanna extract some files, maybe more, your choice. Either way, whatever you wanna extract, right click it and hit export from the folder tab. In case you want just a package, click the folder, go in the package tab and choose what you wanna extract.

4. Tuning!

Open the .uasset file with UAssetGUI editor and do your desired changes, remember to specify the version the the .usmap Mappings to it so you can use it properly.

Each game has it's own way of functioning so be careful what you change. And some things can be very tricky.

5. Packing

You've done the changes you want to the .uasset files now you wanna create a mod. Good, let's say you changed something from MotorTown\Content\Cars\Parts\Tire let's say Tires.uasset, now you wanna create a new folder like My_Cool_mod_P (some ue games need _P at the end of the .pak to work). Create the folders recursivly so you that your file shall be pathed like MotorTown\Content\Cars\Parts\Tire\Tires.uasset inside My_Cool_mod_P. Now we have to pack it. Open a terminal in the parent folder of your mod's folder and pack your mod.

repak pack ".\%MODNAME%"

This command will pack your mod into a pak file. so for the example

repak pack ".\My_Cool_mod_P"

and it will create My_Cool_mod_P.pak, which you have to place in the game's paks folder. So go in the Game's folder from before, go to "Content", then go to "Paks" and drop the .pak there.

Motor Town Modding Video Tutorial by Tehlikelierd

Video Tutorial