While playing Classic game Aquanox again, I thought “Hey, wouldn’t it be cool to view the actual models in the game?”, this lead to the inspecting the Aquanox install folder and down a long and winding rabbit hole of curiosity involving poorly documented File format specifications, fixing broken Delphi code and rewriting the Decryption code in C# as part of a new tool.

This contains many technical details interleaved with the story of how I was able to build a tool to extract Aquanox’s files, but mostly focuses on the Journey.

Game Files

Most files in the install folder are either readable in a text editor or directly readable some other way (e.g. Cut scene videos) and were mostly self explanatory and/or uninteresting.

\dat\pak\ however contained 7 large .pak files. due to their size, these likely contained almost all of the games assets. After some analysis with HxD and failing to find magic bytes for common file types such as JPEGs I found the following text at the bottom of aquanox6.pak

As it turns out, this is the footer of a TGA v2.0 file, specification below:
(https://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf)
From here on I was able to find many more embedded TGA files by searching for this particular string and was able to a section was able to confirm the embedded files were tightly packed with no additional information inbetween. I was also able to manually extract some of these for viewing!

This is a great start!, but ideally it would be nice to automate this extraction. Unfortunately there are no magic bytes or predictable characters at the start of a TGA file which would make this hard, there is likely some mechanism that Aquanox uses to get the offset and/or size of each file.

At this point I decided to check and see if maybe someone else had done something similar and tried to find any mods that might still be around for such an old game.

One of the sites I came across was this handy wiki: (http://wiki.xentax.com/index.php/Aquanox_PAK)
This helped greatly with understanding how to read the files. The pak files contain a small header with basic information, what appears to be a table with file details then finally the actual files.

This is great as now we have all the details to read the file except for a table to appears to hold information necessary to read the individual files easily.
Unfortunately there were only a couple mods and none of the ones I found touched the .pak files. There was however an old forum post from 2011 on gog.com about how to change the in the game using a tool called “UnMassivePAK” and a dead link:
(http://djdeadmind.pithed.org/aquanox/dl/generic/unmpak.zip)
The website pithed.org itself is still up and running with a classy gif

I have attempted to contact the owner of the site and someone else who possibly created the tool with details collected via the wayback machine and some OSINT. Maybe they can provide some insight into how to read the file details table. In the mean time lets carry on 🙂

Some details in the previously mentioned Gog.com post reveal a few interesting facts.
– The tool only unpacks the .pak files
– There are 2 steps, the first of which creates a “keyfile”

Since this tool only unpacks the files, even if I receive a reply from either of the people contacted we will need to create our own tool if we want to be able to repack it for use in game. Also, the reason we cannot read the file details table is possibly because it is encrypted by this “keyfile”.

Old Source Code

Eventually a friend pointed my towards the “AquaNox 1-2 modding tools” download on moddb.com which I some how missed in my previous searches which contained both the AquaNoxMarkUnPAK.exe program and its source code written in Delphi.

There were a couple of challenges here, the first one is that AquaNoxMarkUnPAK.exe gets flagged on VirusTotal pretty badly. For a tool that’s only meant to unpack files it has a lot of extra features such as dropping files and calling out a unknown IP address (yikes!) results here if your curious.

Trying to analyze a dodgy executable is not ideal, thankfully the author also included the source code. This was a challenge as Delphi is not something I’ve ever worked with before and on top of this it was so old that it doesn’t build in the current Delphi editor.

Even with these issues, finding this source code was a big win since it includes both code for reading pak files and the decryption keys to decode the file details table at the start of the file.

Sitting in front of the source it was possible to figure out missing/incorrect details of the file format as shown on the Xentax wiki. Here is the full breakdown of the file format, numbers in {} is the length in bytes:

• char {12} – File Magic Bytes always = “MASSIVE”
• uint16 {2} – Major version number
• uint16 {2} – Minor Version Number
• uint32 {4} – Number of files contained in .pak file
• char {60} – Copyright String
• bytes {132 * Number of files} – File Details Table
  • encrypted char {128} – File Name
  • encrypted uint {4} – File Size
• bytes {variable} – File Contents

I was also able to get the source code to build with a few tweaks and made it available here https://github.com/PyroChiliarch/AquaNoxMarkUnPAK-v1.2. Whats interesting is that this freshly compiled version still triggers VirusTotal, from what I can tell this is likely due to analytics gathering by the creators of the Delphi platform.

Creating the New Tool

Armed with this additional information I was able to implement a new tool by rewriting the decryption in C# and also encryption to allow repacking .pak files. This tool is available for download here https://github.com/PyroChiliarch/AquanoxRePAK.

Additionally I added a few extra features to make modding easier for less technical users, using this new tool its possible to install mods with a single command and revert back to vanilla with a single command.

Combining this new tool with an existing the existing model conversion script located here https://www.moddb.com/games/aquanox/downloads/msb-obj-converter I was finally able to import the Aquanox game models for viewing into the Unity game engine after modifications in Blender (Normal’s needed to be inverted). Here’s some subs from the Tornado zone after import: