MK1 Format

MK1 (Mortal Kombat 1) File Format

MK1 uses UE4.27 with IoStore (Zen storage). Unlike UE3 NRS games which use .xxx compressed archives, MK1 stores assets in IoStore containers (.utoc + .ucas) or standalone .uasset files.

Pipeline

UTOC (table of contents) + UCAS (content archive)
  → AES-256-ECB decrypt
  → Oodle v9 decompress
  → .uasset (midway equivalent)
  → Exports (DataTable, textures, etc.)

The .uasset IS the midway — it contains name/import/export tables and serialized export data, equivalent to a decompressed UPK in UE3 games.

UAsset Header — 64 bytes (0x40)

No magic number. The header is a fixed struct at the start of every .uasset.

Offset	Size	Field	Notes
0x00	8	FilePathFName	u64, name hash
0x08	8	EngineFilesCount	u64
0x10	4	UFlags	u32, serialization flags
0x14	4	DataLocationInUCas	u32, offset into UCAS (for container-hosted assets)
0x18	4	NameTableOffset	u32, byte offset to name table
0x1C	4	NameTableSize	u32, name table size in bytes
0x20	4	UnkData1Offset	u32, auxiliary data offset
0x24	4	UnkData1Size	u32, auxiliary data size
0x28	4	ImportTableLocation	u32, import table offset
0x2C	4	ExportsLocation	u32, export table offset
0x30	4	UnkTable2Location	u32, unknown metadata table offset
0x34	4	UnkTableOffset	u32, unknown table offset
0x38	8	UnkTableSize	u64, unknown table total size

Name Table

Located at NameTableOffset, variable length (total = NameTableSize bytes).

Each entry:

• u16 length (byte-swapped: stored LE, read as BE)
• UTF-8 string of that length (no null terminator)

Export Table Entry — 72 bytes (0x48)

9 × u64 fields. Located at ExportsLocation, count derived from (UnkTable2Location - ExportsLocation) / 72.

Offset	Size	Field	Notes
0x00	8	ObjectLocation	u64, data offset (in UCAS for container assets)
0x08	8	ObjectSize	u64, serialized data size
0x10	8	ObjectName	u64, index into name table
0x18	8	OuterIndex	u64, ImportObjectIndex encoded
0x20	8	ClassIndex	u64, ImportObjectIndex encoded
0x28	8	SuperIndex	u64, ImportObjectIndex encoded
0x30	8	TemplateIndex	u64, ImportObjectIndex encoded
0x38	8	GlobalImportIndex	u64, ImportObjectIndex encoded
0x40	8	ObjectFlags	u64, low byte = export type (0x0B = DataTable)

ImportObjectIndex Encoding

The u64 index fields pack type and value:

• Bits [63:62] = Type: 0=Export, 1=ScriptImport, 2=PackageImport, 3=Invalid
• Bits [61:0] = Value
• For PackageImport: upper 32 bits = package index, lower 32 bits = export hash index

Import Table Entry — 8 bytes

Single u64, decoded as ImportObjectIndex. Count derived from (ExportsLocation - ImportTableLocation) / 8.

Export Data

Export data is stored sequentially after the last table (after UnkTable). For standalone .uasset files, exports are read from the current file position — NOT from ObjectLocation (which stores the UCAS container offset).

Exports with ObjectFlags & 0xFF == 0x0B are DataTable exports containing UE4 tagged properties.

UE4 Tagged Properties

Export data uses UE4's self-describing tagged property format:

FName PropertyName → FName PropertyType → type-specific data

Supported types: BoolProperty, ByteProperty, IntProperty (u8/16/32/64, signed/unsigned), FloatProperty, StrProperty, NameProperty, TextProperty, EnumProperty, StructProperty, ArrayProperty, MapProperty, ObjectProperty, SoftObjectProperty, FieldPathProperty.

Unlike UE3, container types (Array, Map) serialize their element types inline — no whitelists needed.

Special ObjectProperty Handlers

element_name	Behavior
RowStruct	Read super FName + class ref + children count, then per-child struct elements
mLootStruct	Read super FName + one property
ScriptStruct	Read source FName + reference + 0-3 properties
mPreReqStruct	Read inner struct element

---

IoStore Container Format (UTOC + UCAS)

UTOC Header — 144 bytes

Magic: -==--==--==--==- (16 bytes, ASCII literal)

Offset	Size	Field	Notes
0x00	16	Magic	-==--==--==--==-
0x10	4	Version	u32, = 3 for UE4.27
0x14	4	HeaderSize	u32, = 144
0x18	4	EntryCount	u32, number of chunks
0x1C	4	CompressedBlockCount	u32
0x20	4	CompressedBlockEntrySize	u32, = 12
0x24	4	CompressionMethodCount	u32
0x28	4	CompressionMethodNameLength	u32, = 32
0x2C	4	CompressionBlockSize	u32, = 65536
0x30	4	DirectoryIndexSize	u32
0x34	4	PartitionCount	u32
0x38	8	ContainerId	u64
0x40	16	EncryptionKeyGuid	GUID (all zeros for MK1)
0x50	4	ContainerFlags	u32, bitmask
0x54	4	HashSeedsCount	u32 (0 or 0xFFFFFFFF = none)
0x58	8	PartitionSize	u64 (0xFFFFFFFFFFFFFFFF = single)
0x60	4	NoHashCount	u32

Container Flags:

Bit	Flag
0	Compressed
1	Encrypted
2	Signed
3	Indexed

UTOC Section Layout (after header)

Sections are sequential, order is critical:

1. ChunkIds — EntryCount × 12 bytes
2. OffsetAndLengths — EntryCount × 10 bytes (5B offset + 5B length, both big-endian)
3. PerfectHashSeeds — HashSeedsCount × 4 bytes (skipped if 0 or 0xFFFFFFFF)
4. ChunkIndicesWithoutPerfectHash — NoHashCount × 4 bytes
5. CompressedBlocks — CompressedBlockCount × 12 bytes
6. CompressionMethods — CompressionMethodCount × CompressionMethodNameLength bytes (null-terminated ASCII, e.g. "Oodle")
7. Signatures (if Signed flag) — 4B hash_size + hash_size×2 + CompressedBlockCount×20
8. DirectoryIndex — DirectoryIndexSize bytes (AES-ECB encrypted if Encrypted flag)

Compressed Block Entry — 12 bytes

Packed as u64 + u32:

• u64[0:40] → block offset in UCAS (40 bits)
• u64[40:64] → compressed size (24 bits)
• u32[0:24] → uncompressed size (24 bits)
• u32[24:32] → compression method index (8 bits, 0 = uncompressed)

Directory Index (decrypted)

AES-256-ECB decrypted with game key. Structure:

Field	Type	Notes
mount_len	i32	Mount point string length
mount	string	UTF-8, typically ../../../
dir_count	u32	Number of directory entries
dirs[]	struct×dir_count	16B each: name_idx(u32) + first_child(u32) + next_sibling(u32) + first_file(u32)
file_count	u32	Number of file entries
files[]	struct×file_count	12B each: name_idx(u32) + next_file(u32) + user_data(u32)
str_count	u32	Number of strings
strings[]	variable	FString: i32 len + data (UTF-8 if len>0, UTF-16LE if len<0)

Sentinel value 0xFFFFFFFF = end of linked list. user_data = entry index into ChunkIds/OffsetAndLengths.

UCAS Data Reading

1. Look up entry index from directory index user_data
2. Get offset + length from OffsetAndLengths (5B big-endian each)
3. Compute first/last compression blocks: offset / CompressionBlockSize
4. For each block: seek in UCAS → read aligned to 16B → AES-ECB decrypt → Oodle decompress (if method > 0)
5. Trim to exact offset within first block + length

Encryption

• Algorithm: AES-256-ECB, no padding
• Key: 0x6FAABA4F4EF8A6AC188A517ACEF38F1422484E3B1F3F4CF3DACB27A6CBCCD076
• Applied to: UCAS data blocks (aligned to 16B) and UTOC directory index
• Compression: Oodle v9 (Kraken/Leviathan/Mermaid), requires oo2core_9_win64.dll

Cross-Game Comparison

Feature	MKX	IJ2	MK11	MK1
Engine	UE3	UE3	UE3	UE4.27
Container	.xxx (ZLIB/LZO)	.xxx (Oodle v4)	.xxx (Oodle v5)	IoStore (UTOC/UCAS)
Midway	Decompressed UPK	Decompressed UPK	Decompressed UPK	.uasset
Magic	0x9E2A83C1	0x9E2A83C1	0x9E2A83C1	None (no magic)
Encryption	None	None	None (DFP separate)	AES-256-ECB
Properties	UE3 tagged (whitelist)	UE3 tagged (whitelist)	UE3 tagged (whitelist)	UE4 tagged (self-describing)
Localization	Coalesced (AES)	Coalesced (AES)	Coalesced (AES)	.locres (JSON)
Bulk data	TFC	TFC	PSF	UCAS