Need to open .BSP and .XML files related to the "level" structure. DirectX/PhysX based. Hero 108: Online.

[ViolaMirabilis]

Hey, there is an old MMORPG called Hero 108: Online. The game was abandoned in 2010 and not many resources of this game are there anymore. Someone on this forum managed to unpack the encrypted .pak files, which allow us to go into every single asset of the game. The game is supposedly running on DirectX related engine, and so are all the assets.

* models are made with the .x extension. They don't work in Blender; however, can be opened in Ultimate Unwrap3D Pro 4.
* animations have an .ANM extension. They didn't work anywhere; however, after changing the .ANM extension to simple .x estension, the animations load properly along with game models in Ultimate Unwrap3D.

What is left, basically the only leftover I cannot get access to, is the model of the levels/map structure. Files related to this are:
- .XML (with coordinates of NPCs and other objects)
- .BSP files which, sadly, cannot be opened in anything source-related
- .LOS
- .NAV

Opening the .XML file in PhysX Viewer loads some odd strucutre, which resembles the area, but it's oddly rotated and totally out of scale.

Is there anyone who could try to get into the files and manage to load the maps somehow? I want to open it in any program possible, just to view it and start some work on it.

"Levels/Maps" are located in: Hero 108 online\Data4\DATA\SCENE_HERO108\ and in the corresponding SE files.

Link to the unpacked files:

To view the content, you need to sign in or register

Link to VirusTotal:

To view the content, you need to sign in or register

Some addition:
When opening the .BSP file with a hexeditor, it has some calls to corresponding .PNG files with textures. For instance, you can see, that if you open the SE00.BSP file with the editor, it looks for "SE_00_GGG.png". If you open the .PNG, it has .png textures for the very first area in the game.

One more addition:
The magic header for the .BSP is "ABSP", which is quite unusual for .BSP formats. Hence, I believe it's some kind of a custom format in this case.
The xxx_xxx_PH.XML can be opened with PhysX Viewer by NxuStream, but I don't really think it resembles anything in game.

 

[CatLad]

I'm sure you've already found this in the source, but you might be able to use ScenePathFileName to load in a specific map. I was able to change the login server to localhost/127.0.0.1 and grab the login packet which was only slightly useful, but it was informative.


"Usage:
GameClient.exe XXXXXX
[-u username]
[-p password]
[-s \"Xxx.xxx.xxx.xxx Nnnn YYYY;\"]
[-ServerId n]
[-LoginServerIP aaa.bbb.ccc.ddd]
[-LoginServerPort XX]
[-Locale XXX]
[-?/--help]
[-CharacterTypeId character_type_id]
[-ScenePathFileName scene_path_file_name]
[-SceneMapId scene_map_id]
[-SceneLevelDesignId scene_level_design_id]

Example:
GameClient.exe
GameClient.exe -?
GameClient.exe --help
GameClient.exe -u username -p password -ServerId 1
GameClient.exe -u username -p password
GameClient.exe -u username -ServerId 2
GameClient.exe -s \"127.0.0.1 10080 LocalServer;127.0.0.1 10081 LocalServer-HK\" -ServerId 2
GameClient.exe -s \"127.0.0.1 10080 LocalServer;127.0.0.1 10081 LocalServer-HK\"
GameClient.exe -CharacterTypeId 0
GameClient.exe -LoginServerIP 127.0.0.1
GameClient.exe -LoginServerIP 127.0.0.1 -LoginServerPort 1234
GameClient.exe -Locale cht_twn
GameClient.exe -ScenePathFileName \"Data\\Scene_Hero108\\Scene001\\Scene001_01\\Scene001_01_01\\001.xml\"
GameClient.exe -SceneMap 1
"

 

[ViolaMirabilis]

I'm sure you've already found this in the source, but you might be able to use ScenePathFileName to load in a specific map. I was able to change the login server to localhost/127.0.0.1 and grab the login packet which was only slightly useful, but it was informative.


"Usage:
GameClient.exe XXXXXX
[-u username]
[-p password]
[-s \"Xxx.xxx.xxx.xxx Nnnn YYYY;\"]
[-ServerId n]
[-LoginServerIP aaa.bbb.ccc.ddd]
[-LoginServerPort XX]
[-Locale XXX]
[-?/--help]
[-CharacterTypeId character_type_id]
[-ScenePathFileName scene_path_file_name]
[-SceneMapId scene_map_id]
[-SceneLevelDesignId scene_level_design_id]

Example:
GameClient.exe
GameClient.exe -?
GameClient.exe --help
GameClient.exe -u username -p password -ServerId 1
GameClient.exe -u username -p password
GameClient.exe -u username -ServerId 2
GameClient.exe -s \"127.0.0.1 10080 LocalServer;127.0.0.1 10081 LocalServer-HK\" -ServerId 2
GameClient.exe -s \"127.0.0.1 10080 LocalServer;127.0.0.1 10081 LocalServer-HK\"
GameClient.exe -CharacterTypeId 0
GameClient.exe -LoginServerIP 127.0.0.1
GameClient.exe -LoginServerIP 127.0.0.1 -LoginServerPort 1234
GameClient.exe -Locale cht_twn
GameClient.exe -ScenePathFileName \"Data\\Scene_Hero108\\Scene001\\Scene001_01\\Scene001_01_01\\001.xml\"
GameClient.exe -SceneMap 1
"

Yeah, I noticed that too; however, had no chance with setting it up, sadly. I couldn't force load the level at all, yet I'm certain it's possible, it's just my lack of skills, lol.
I point to the valid path (with the extracted files) and in the log file, which is under the "documents" folder, it involves the changes in -ScenePathFileName; however, no luck with initialising it.

#EDIT. Alright, I passed in the -CharacterTypeId 0 along with -ScenePathFileName and it initialised the loading screen, but crashed right away

#EDIT

\Hero108Client.exe dummy -u username -p password -s "127.0.0.1 10080 LocalServer;127.0.0.1 10081 LocalServer-HK" -ServerId 2 -LoginServerIP 127.0.0.1 -LoginServerPort 1234 -Locale cht_twn -CharacterTypeId 0 -ScenePathFileName "C:\HERO108\HERO108\extracted\DATA\SCENE_HERO108\SE01\SE01M001.XML" -SceneMapId 1

loaded the character selection screen for about a second, then crashed. I noticed that without passing all these, it won't try to load at all. With just the

CharacterTypeId 0

it initialises the loading screen, nothing else. With the full commands, it actually loads the map for some time.

Running this command can force load the map for a few seconds:

.\Hero108Client.exe dummy -u username -p password -s "127.0.0.1 10080 LocalServer;127.0.0.1 10081 LocalServer-HK" -ServerId 2 -LoginServerIP 127.0.0.1 -LoginServerPort 1234 -Locale cht_twn -CharacterTypeId 0 -ScenePathFileName "C:\HERO108\HERO108\extracted\DATA\SCENE_HERO108\SE01\SE01M001.XML" -SceneMapId 1

However, it's crashing after a second and no actions are possible. What I noticed is that no matter the .xml path that's passed in, actually the -SceneMapId changes the map layout. Maybe, not sure, the SceneMapId has to match the .xml for it to load somewhat correctly.

#EDIT Loading it with -SceneLevelDesign x at the end initialises the music, too. Just for a split of a second.

Another interesting thing - it turns out that the game doesn't read your path to the .xml fine at all with the "-ScenePathFIleName". I tried changing the camera, some objects, etc. - and nothing worked. I deleted ALL the contents of the .xml to which I have set a path, and the game still loads the map for a second. It means, probably, that it is reading the packed .dat files anyway. The path gets loaded into the .log file found in the documents, yet it's not utilised.

#EDIT Alright, last comment for now. I tried a plethora of combinations and eventually got the cause for the crash in the logs.

2025/12/10  12:48:36       CGameObjectList    AddObject        PlayerId should not be zero. ObjectId=1, ObjectName="Unknown Player Name", PlayerId=0

--> so at this point, the server expects a player object; thus, this is not a debug/dev mode, but it just force loads into the game, but crashes, because there is no server (and no player).

 

[CatLad]

I have the login request figured out, I just need to get the packet encrypt/decrypt sorted out. Did you ever get that part working ?

 

[CatLad]

well, I was finally able to get packet encryption/decryption working. the key is stored big endian in memory, but needs to be little endian when actually being used. I zeroed out the key and that's what led me to it as the hash was left untouched. so hooray! I'll probably start working on getting the random data files into tables in order to query them / understand the server side data structures. additionally research if there is a similar enough game with an existing private server that can be borrowed from, or if it would be a fully custom implementation.

 

[ViolaMirabilis]

well, I was finally able to get packet encryption/decryption working. the key is stored big endian in memory, but needs to be little endian when actually being used. I zeroed out the key and that's what led me to it as the hash was left untouched. so hooray! I'll probably start working on getting the random data files into tables in order to query them / understand the server side data structures. additionally research if there is a similar enough game with an existing private server that can be borrowed from, or if it would be a fully custom implementation.

I'm still nowhere that close to make tremendous progress on this, but I've looked through all the unpacked files and similarities. I cannot find anything related to similar games, as this is made by a Taiwanese studio, which hasn't made any more games, actually. They started working on this game around 2006, as it was in some contract with Cartoon Network and the original, Taiwanese producer. I've looked through everything possible, looked through files, .dlls, all the comments left by developers in the files - nothing. It seems that the engine is custom, definitely written in C++. They also rely on PhysX a lot, as there are literal references to it, however, again, that doesn't tell much. I tried to look through their .bsp files, to find some viewers/openers; however, none available online is capable of running them, thus no similarities can be found. Looking at how much I spent digging inside and found nothing related to similarities, I assume this has to be a fully custom implementation.

 

[CatLad]

I took a deep look as well, and it's definitely all custom. I've got the login packet call fully working, and have managed to piece together a bit of the response, but I can't tell a lie, it's going to be a slog. The included text files do provide a treasure trove of stats about mobs/npcs/skills, so that should help considerably when it comes to implementing the actual game mechanics.

 

[ViolaMirabilis]

I took a deep look as well, and it's definitely all custom. I've got the login packet call fully working, and have managed to piece together a bit of the response, but I can't tell a lie, it's going to be a slog. The included text files do provide a treasure trove of stats about mobs/npcs/skills, so that should help considerably when it comes to implementing the actual game mechanics.

Yeah, I've digged in the files as well and I'm currently creating a parser. The files have got all the data that's needed, honestly. NPC positions, vendors, what they sell, full list of items, their stats, prices, quests, exp rewards, and so on. Everything can be pieced together and inferred from the files. You can hit me up on discord, if you don't mind. My tag is: viomirabilis

 

[CatLad]

friend request sent.

 

[CristiHero108]

Hi CatLad and ViolaMirabilis , is the above something you are still working on? I would like to help if possible.

 

[CatLad]

Hi CatLad and ViolaMirabilis , is the above something you are still working on? I would like to help if possible.

we are, i’ll send you a pm.

 

[CristiHero108]

Hey CatLad, I don't think I'm able to reply to your DM, not sure if it's my account permission or something else. I spoke to Viola yesterday about it, feel free to get my discord ID from them.

 

[SirHOANG]

Hey CatLad, I don't think I'm able to reply to your DM, not sure if it's my account permission or something else. I spoke to Viola yesterday about it, feel free to get my discord ID from them.

CatLad CristiHero108 yo you both still alive? add me discord too: SirHOANG#3507 i done testing that game now i feel like it was a bit fun but still more bugging

 

[CatLad]

CatLad CristiHero108 yo you both still alive? add me discord too: SirHOANG#3507 i done testing that game now i feel like it was a bit fun but still more bugging

I added you just now.

Are you saying you built out a server emulator already?

 

[SirHOANG]

I added you just now.

Are you saying you built out a server emulator already?

nope, but mirabillis can build server i just have to wait till he share me a source and what was ur name? so i can know u

 

[auglyn]

How far did you guys make it?
It will probably take months to fix all the bugs.

 

[SirHOANG]

How far did you guys make it?
It will probably take months to fix all the bugs.

mirabillis already fix some more few bugs, and some of your are not finished maybe i done testing his server and it working fine now do you have discord? can i add you also

 

[CatLad]

How far did you guys make it?
It will probably take months to fix all the bugs.

Do you have a link to the code / a repo that youre willing to share.

 

[SirHOANG]

Do you have a link to the code / a repo that youre willing to share.

only mirabillis can he have it not me and he also hosted server but not open yet only open in for sometime when he free
but sad thing he cannot share anymore unless he need to fully done his project first yk