dade

Dade (Decompress, Analyse, Decode, Export) is a single package that bundles a collection of asset extractors and converters for a set of PC and console video games. Each game is a sub-command of one dade command, so every tool is invoked the same way:

dade <game> <subcommand> [ARGS]

Run dade --help to list the games, and dade <game> --help to list a game's subcommands.

Games

Installation

pip install dade

Incoming

dade incoming extract --output OUTPUT_DIR SOURCE

SOURCE may be a PC disc directory or ISO containing DATA1.CAB (or the DATA1.CAB itself), a Dreamcast .gdi file, or a directory of already extracted PC or GD-ROM content. Recognised assets are converted (PVR and PPM to PNG, IAN and *_M.BIN to OBJ and MTL, terrain, saves, and .ctl to JSON, CDDA .raw and .OSB to WAV, Shift-JIS or ISO-8859-15 .TXT to UTF-8) and every other file is copied verbatim. The source is never modified.

An installed copy works as the source too — point at the game's directory, such as the Incoming 3DFX folder of the Zoom Platform Incoming Trilogy (…/Incoming Trilogy/Incoming 3DFX). The Incoming 3DFX, Incoming USA, and Incoming Subversion (an expansion pack) titles share the original engine and are supported; Incoming Forces is not supported.

Pass --gdiextract-path, --spvr2png-path, or --unshield-path to point at the native tools when they are not on PATH, -j/--jobs to set the number of concurrent conversion jobs (defaults to the CPU count), and --debug for verbose logging.

Two further subcommands convert a single asset without mirroring a whole source tree:

• dade incoming ian2obj MODEL OUTDIR — convert one model to Wavefront OBJ and MTL. Both the PC .ian mesh and the Dreamcast *_M.BIN model pack are accepted (the format is detected from the file name); a Dreamcast pack needs its matching *_ML.BIN index beside it and yields one OBJ and MTL per object. The texture is resolved from the game root, auto-detected from MODEL or set with --game-root, unless --no-texture is given.
• dade incoming extract-pvr-pack PACK OUTDIR — unpack a Dreamcast *_T.PVR texture pack, writing each texture as a separate .pvr file, or as a PNG with --png (which requires spvr2png).

Native tools

Some Incoming conversions shell out to native helpers, which must be on PATH or supplied with the matching --*-path option:

• 7z — extracts DATA1.CAB from a PC ISO (used when isodump is absent).
• gdiextract — extracts the ISO 9660 file system from a Dreamcast GDI.
• isodump — extracts DATA1.CAB from a PC ISO.
• spvr2png — converts Sega Dreamcast PVR images to PNG.
• unshield — unpacks the InstallShield DATA1.CAB cabinet on the PC disc.

Amplitude and FreQuency

dade amplitude unpack DISC -o OUT
dade frequency unpack DISC -o OUT

Amplitude and FreQuency (Harmonix) share one PS2 engine but are separate commands, one per game. Point either at its disc directory (DISC): every ARK is unpacked mirroring its location, disc streaming songs are converted to WAV, and assets are converted in place (bitmaps to PNG, DataArray to JSON, Milo scenes to object folders, meshes to OBJ, audio to WAV). The output directory defaults to the current directory; set it with -o/--output-dir.

Tone Sphere

dade bit192 extract "Tone Sphere.xapk" -o out/
dade bit192 decrypt-cz gamedata_sub.cz gamedata_sub.dz
dade bit192 save …

Tools for the bit192labs rhythm game Tone Sphere: .cz decryption, full asset extraction, and save.bin editing. This is the game-specific layer on top of the generic Marmalade support in dade marmalade.

Marmalade SDK

dade marmalade extract-dz ARCHIVE.dz OUTDIR
dade marmalade extract-group RESOURCES.group.bin OUTDIR

Unpack and decode assets built with the Marmalade SDK: Derbh (.dz) archives, IwResGroup (.group.bin) resources, and CIwTexture, CIwGxFont, CIwMaterial, and CIwModel resources to PNG, JSON, and Wavefront OBJ.

BitRock / InstallBuilder

dade bitrock extract INSTALLER OUTDIR
dade bitrock crack INSTALLER

Extract (and, for encrypted installers, brute-force the password of) BitRock / InstallBuilder installers. Optional cuda and opencl extras accelerate password cracking on a GPU.

Monopoly 2008

dade monopoly08 extract ROOT

Unpack and convert an extracted Monopoly (2008, Electronic Arts) disc for Xbox 360, PS3, PS2, or Wii. The platform is auto-detected and every output is written next to its source inside ROOT.

jubeat plus

dade jubeatplus unpack Jubeat.ipa -o out/

Convert a whole jubeat plus (jp.konami.jubeatplus) download to formats that open outside iOS. SOURCE may be an .ipa, the .app bundle, the Payload directory, or a directory holding Payload; it is only read, and the converted bundle is written under -o/--output-dir into a directory named after it.

Every encrypted asset uses the same Blowfish variant as dade rhythmin, differing only in the key. There are seven, each the MD5 of a passphrase the binary assembles on the stack so it never appears whole in the executable; two of them carry the shipped assets.

Every other file is copied unchanged, so the output is a complete bundle rather than a selection. Nothing is decrypted beyond the game's own asset cipher: an App Store executable stays enciphered, and its LC_ENCRYPTION_INFO command says so.

pngdefry and ffmpeg must be on PATH or given with --pngdefry-path and --ffmpeg-path. Pass --no-png or --no-audio to skip either conversion and copy those files instead, -j/--jobs to set the number of concurrent conversion jobs (defaults to the CPU count), and --debug for verbose logging.

REFLEC BEAT plus

dade rbplus unpack "REFLEC BEAT plus.app" -o out/
dade rbplus extract-assets iPhone@2x.zip -o out/
dade rbplus dump-chart 100000109.rb har --image chart.png

Convert a whole REFLEC BEAT plus (jp.konami.reflecbeatplus) download to formats that open outside iOS. SOURCE may be an .ipa, the .app bundle, the Payload directory, or a directory holding Payload; it is only read, and the converted bundle is written under -o/--output-dir into a directory named after it.

A tune ships as a %09d.rb package: an ordinary ZIP whose every entry is enciphered with the same Blowfish variant as dade rhythmin and dade jubeatplus, differing only in the key. There are two keys, neither of which appears in the executable as a passphrase: each is stored with every byte reduced by its own index, so adding the index back yields Konami ReflecBeat For iOS. and Konami ReflecBeatplus., whose MD5s are the keys. A package does not record which one it uses, so the first is tried and the second used when the metadata does not parse.

Mach-O images are the one thing left behind entirely: neither the executable nor the debug copy under .dSYM is read, converted, or copied. Every other file is copied unchanged, so the output is a complete bundle rather than a selection.

A chart is drawn as a strip. REFLEC BEAT is a versus game, and the two sides are separate sets of notes rather than one set divided, so each is drawn as a panel of its own — side 0 (pink) on the left, side 1 (blue) on the right — and counted on its own.

Whether a note's lane is drawn from the chart or invented depends on its route selector. One naming a lane, 0 to 6, comes straight down into that lane and no randomness touches it: that is every slide and every vertical note. One naming 7, 8, or 9 is aimed at one of the three alternative targets, which sit beyond the seven lanes. Only a note naming nothing is laid out at run time, from a generator seeded with rand() when play starts, so that part of a chart falls differently on every play. Those notes are laid out here from a seed, fresh on each run unless --seed pins one, under the engine's two rules: a chain member inherits the lane of the segment before it, so a chain runs straight up a single lane, and notes one side strikes together cannot share a lane, so they take neighbouring ones. A hold keeps its lane until it is released.

Time runs upward, the way the notes fall, wrapped into columns and ruled on every quarter note when the tune's tempo is known. A hold extends as a bar to the moment it is released, a note aimed at an alternative target is green, one that travels to the other side to be swiped back is half gold, a vertical note carries a V, each note of a chain is joined to the next by a line, a slide draws the track the finger takes from the note across to each of its waypoints, and a speed change rules its column across. Every image carries a drawn legend saying so.

--speed, from 1.0 to 2.0 as the game offers it, spreads the notes further apart without changing how much time a column holds. --scale, from 1.0 to 3.0, writes the image larger for a display that would otherwise have to enlarge it.

dade rbplus dump-chart also reads one note chart from a file of its own, either as the package stores it or already deciphered, in which case the difficulty is taken from the file name when it says one and must be named otherwise. --key and --iv, both hex, read a chart enciphered under neither of the game's keys.

dade rbplus extract-assets unpacks one of the three texture archives the game downloads (iPad, iPad2x, and iPhone@2x), each holding a little over two thousand PNGs under ZipCrypto. The archive's own index, a second encrypted ZIP stored as its list entry, is written out as manifest.json. Each texture is examined and only the Apple-optimised ones go through pngdefry.

pngdefry and ffmpeg must be on PATH or given with --pngdefry-path and --ffmpeg-path. Pass --no-png, --no-audio, or --no-images to skip a conversion, -j/--jobs to set the number of concurrent jobs (defaults to the CPU count), and --debug for verbose logging.

pop'n rhythmin

dade rhythmin dump-chara chara001.chr
dade rhythmin dump-idx music_select.idx
dade rhythmin dump-map map_042.map
dade rhythmin dump-sheet 000000007.orb n
dade rhythmin extract-dialogue pools.inc --binary PopnRhythmin

Decrypt and decode the data files of the Konami iOS rhythm game pop'n rhythmin. Every encrypted file uses BFCodec, which is Blowfish with one deviation in its F function; the key is derived from a constant in the binary, so nothing needs to be supplied. Each dump-* subcommand writes JSON to standard output:

• dump-chara — downloaded chara_%03d.chr character data.
• dump-idx — AEP .idx animation indexes, with sprite records, layer chains, and decoded position and colour channels. --names, --layer NAME, and --find NAME narrow the output.
• dump-map — sugoroku map_%03d.map boards. --ascii prints a text board and --image OUT.png renders a pictorial one.
• dump-sheet — note charts from a .orb or .acv song package, given the difficulty suffix (es, n, h, or ex). --summary drops the per-record list, --raw writes the decrypted bytes, and --image OUT.png renders a DDR-style strip chart.
• extract-dialogue — the sugoroku board dialogue pools inside a 32-bit app binary, as either the compiled-in C header or the runtime binary asset. The dialogue is copyrighted game content and is not shipped here; without --binary the tables are written out empty.

Miscellaneous

dade misc coredata MODEL
dade misc macho dump BINARY
dade misc sc-info dump PATH
dade misc strings STRINGS

Converters and readers for platform-level formats that belong to no single game. coredata deserialises a compiled Core Data model — a .cdm mapping model or a .mom managed object model — to JSON, optionally dumping the raw keyed archive (--archive) or emitting the SQLite script the migration amounts to (--sql, with --mom supplying the destination model's column types). strings reads an Xcode .strings localisation table in either the compiled binary plist form or the old-style text form and writes it as JSON.

macho dump writes the properties of a Mach-O executable as JSON: the header and its flags, the segments and their sections, the libraries it links (weakly or otherwise), its UUID and source version, the minimum OS it declares, the entitlements inside its code signature, and, for an image bought from the App Store, the LC_ENCRYPTION_INFO command that says its text is still enciphered. BINARY may be an application's executable, a framework, or a dynamic library, thin or universal; every architecture slice is read. Nothing is decrypted and no code is disassembled.

sc-info dump describes the SC_Info directory an App Store download carries beside its encrypted executable:

• the store item ID and, given a storefront, the App Store link;
• the Manifest.plist;
• the .sinf purchase record — buying account, purchase and transaction times, initialisation vector, the righ tag block with all eight tags named (the store item, the vendor, the tool that built it, and the rest), and the atom tree with every leaf's value decoded;
• the .supf and .supp supplements, each broken into its length-prefixed parts, including the two different Apple FairPlay certificates they embed (subject, issuer, validity, key, and every extension broken out field by field);
• the .supx tagged entries, and cross-checks between the parts.

PATH may be an .ipa, which is read in place without being unpacked, or the SC_Info directory, the .app bundle holding it, the Payload directory holding that, or a directory holding Payload. --json prints the same information as JSON, one entry per bundle.

An SC_Info can hold more than one set of these files, one per executable, and every set is read. The extra set is either architecture-specific (BofA_armv7.sinf beside BofA.sinf) or left behind by a renamed executable, and it need not be complete — a set often has a .supp but no .supf. The set the bundle's own executable uses is named by the manifest's SinfPaths, and it is reported first.

A download often holds more than the application: an app extension under PlugIns and a watch app under Watch each carry an SC_Info of their own, and every one of them is read. Narrow that with --main-bundle, which keeps only the application (Payload/<name>.app, the only bundle at that depth), or --bundle NAME, which takes a bundle named in full or by its last component such as NotificationService.appex. Naming the SC_Info directory or one bundle directly reads that one.

The App Store link is regional wherever the storefront can be established, since a store item is only reachable in the store it was sold in. That comes from an iTunesMetadata.plist beside the bundle when there is one; otherwise pass --region, as in --region jp. Without either, the link is written without a region, which the store resolves by the reader's own storefront.

Nothing is decrypted. The only things left whole are the signatures, the key blobs, and the encrypted priv body, which are reported with their length, digest, and bytes. The report lists the first ten .supp records and counts the rest; --json always carries all of them.

Extreme-G, Interstate '76, and Tony Hawk's Pro Skater 2

dade xg2 --help
dade i76 --help
dade thps2pc --help

Asset extractors and converters for Extreme-G / Extreme-G 2 (N64 and PC), Interstate '76 and Interstate '82, and the PC version of Tony Hawk's Pro Skater 2. Run each game's --help for its subcommands.

Development

uv sync --all-groups --all-extras
yarn install

Run the formatters and checks:

yarn format
yarn qa