Skip to content

Asset Browser — browse and edit game files in the tool

Choose a tag to compare

@DVS-code DVS-code released this 12 Sep 01:18
· 3 commits to public-client since this release

ForzaCryptoTool v3.2.0

Adds an Asset Browser: browse the game install inside the tool and edit files in place, instead of
decrypting an archive to disk and opening it in an external editor.


Asset Browser

Point it at the game install and expand it as a tree. Archives open from the ZIP central directory
alone — no entry data is read — so expanding a multi-GB archive is instant and costs no decryption
and no network call.

Decryption is deliberately lazy: only the entry you actually click is decrypted, and it is sent to
the service on its own rather than as part of its archive. Opening one XML out of a 5.6 GB archive
uploads a few hundred bytes. Method 0 and method 8 entries are not encrypted at all and open fully
offline.

Per-entry status, before anything is opened

Every entry is classified from its page layout, with no decryption:

Badge Meaning
plain Stored or deflate. Opens offline.
encrypted Method 22, decryptable on open.
locked Method 22 whose per-page IVs are unavailable.

A locked entry states the reason rather than failing vaguely: only the first chunk's IV is stored in
the file, and the rest are cipher-internal state that cannot be derived from the file's bytes. Such
an entry is never rendered as guessed bytes — the raw ciphertext is available in the hex view
instead. Only openable is ticked by default and can be unticked to see everything.

Archives show a summary such as 122 entries · 44 openable · 78 locked, so you can tell whether one
is worth opening at a glance.


Editing

Text files and archive entries can now be edited and saved. Save offers the output folder
(default) or overwriting the original in the game install, behind a second confirmation naming the
exact path. Overwriting always writes a timestamped .bak alongside first.

Saving an entry rebuilds its whole archive with every other entry byte-copied — including
encrypted entries the tool cannot read. Editing one readable file inside an archive full of
unreadable ones is the normal case, and untouched bytes pass straight through.

The file's original BOM and line endings are preserved. The install mixes both (2,598 files carry a
UTF-8 BOM and 1,968 don't; 3,864 are CRLF and 700 LF), so normalizing either would rewrite far more
of a file than you changed.

Nothing is written that fails its own read-back: a rebuilt archive is reopened and the edited entry
compared before it lands, and a re-encrypted archive is reparsed and its entry count checked.


Archive handling

New format model with a byte-exact guarantee: repacking an archive with no changes reproduces it
byte for byte. Verified across all 8,888 archives under 32 MB in the retail install.

Untouched entries are byte-copied rather than recompressed, because .NET's deflate does not
reproduce the game packer's bit stream. Local headers and central-directory records are copied with
only the fields that genuinely moved, preserving FH6's quirk of carrying its 0x1123 extra field in
the central directory but not in local headers.

Records are also walked in physical order so inter-entry padding survives. Exactly one archive in the
install (UI.zip) has a 22-byte gap between two entries; packing records contiguously produced a
file 22 bytes short and shifted every later offset. That is why the check runs over the whole install
rather than a sample.


Also in this release

  • Shared dark styling for grids, tabs and trees, so every view matches.
  • A test suite ships with the source. It runs against a real game install and skips cleanly without
    one.
  • Encrypted config containers using an .xml extension are now recognized (previously reported as
    unknown).

Notes

  • Editing is currently offered for text content. Binary formats open read-only in the hex view.
  • Locked entries stay locked until their IVs are available; this is a property of the format, not a
    limitation of the client or the service.
  • The client holds no encryption keys. Every decrypt and re-encrypt runs service-side, as before.