【Guideline】How to extract models from game Crossout (Old version)


#0 : 13.07.2022 08:43

After one year, finnally I can get rid of all the busy real-life stuff and write a guideline on how to extract game models from Crossout.

Crossout is one of my favourite game from Gaijin Entertainment (the company that also made War Thunder and Star Conflict) so I've tried multiple ways to extract models, but just failed....

Finnally, thanks to the masters in forum XeNTaX, I am able to learn some basic in basic knowledge on how to extracting models.

Link up here is a video I made on how to extract old models from old version of Crossout, but it's in Chinese.

So I'll write a simple (since me myself is a green hand) guideline here in English (which is really bad).


#1 : 13.07.2022 08:54

First of all, the tools you need.

Thanks to Model Master (Мастер Моделей), you can find most of the tools here in this website:


1. 010Editor
2. Model Researcher & Rawtex

(You can search these software on google, but I downloaded a version here and upload it on Baidu Netdisk) (Not for profit)
Link: https://pan.baidu.com/s/1Oz-ZAmhwQRnJwSOyaN4tMw

Extract code: 959m
3. Paint.net https://www.getpaint.net/download.html
4. Blender https://www.blender.org/download/
5. Old version of Crossout (from 2016):

(I found this old version of Crossout on a Chinese old game website and I upload it on Baidu Netdisk)
Link: https://pan.baidu.com/s/1GHLYZqHA6wlzGN8Xg_MLKw

Extract code: 5pvs

6. Windows 11 Calculator on programmer mode

7. You with Patience

Other Links:
1. XeNTaX forum https://forum.xentax.com/index.php
2. Guideline on reverse engineer on games
3. Crossout:
Chinese Server:  https://co.games.wanmei.com/main.html
Gaijin Server: https://crossout.net/en/


#2 : 13.07.2022 08:57

Why old version?

Because in the new version (since 2020), they use a new way to seal all the models, so I can only extract models from the old one.


#3 : 13.07.2022 09:14

Locate Original Model Files

You can find original model files from pak\models\constructor or pak\models\weapons

Since here I'll extract a weapon called scorpion, I'll go to the weapons folder

and find folder "railgun_turrent" (The name of the folder that contains model is more of a inside nickname, and is different from the name in the game. Since scorpion in Crossout is a railgun on turrent, so I believe that's why it's in the railgun_turrent folder.)

Inside the folder, the upper part in the green square has something to do with models, and lower part in the red square has something to do with textures.

We'll deal with textures later so I open the biggest file, railgun.mdl-msh001 to extract the mesh (model without texture) with 010Editor first.


#4 : 13.07.2022 09:23

Analyze and Extract the Mesh File

When you open a file with 010Editor, the hexadecimal code of this file is shown.

Since find a vertices is of vital in extracting a mesh file. Here down below is the vertices.



I'll Finish the Rest Tomorrow

Мастер Моделей

#5 : 14.07.2022 15:34

We are waiting for the continuation!

At one time, I was also interested in this game, but the endless variability in assembling models scared me away.


#6 : 24.07.2022 09:56

Analyze and Extract the Mesh File's Vertices Numbers

When you open a file with 010Editor, the hexadecimal code of this file is shown.

Since find vertices is of vital in extracting a mesh file. Here down below is the number of the vertices.


    Big-endian? Little-endian?

But since they're using the little-endian (pretty much like Lilliput people from Gulliver's Travels, some programmers decide that a number should be saved from high to low, they're called using a little-endian method, while others decide that a number should be saved from low to high, then that's the big-endian method.), which means a number is saved form high to low, then the real number of "5D 0B" is the hexadecimal number of "0B 5D"

Then we can transfer this hexadecimal number to decimal number which we're usually using in real life by using the programmer mode of the Windows 11 Calculator, which is 2909. That means, the mesh (model without texture) of this model has 2909 vertices (points).


#7 : 24.07.2022 10:04

Model Researcher-Count of the Vertices

After knowing the number of the vertices, we can open the Model Researcher.

Then open the same railgun.mdl-msh001 file inside the Model Researcher.

Since we've already know the count of the vertices, we can simply fill the black.




#8 : 24.07.2022 10:49

Analyze the Structure of a Vertex Group

Just like two rivers, we can tell that the data of the vertices right start from the orange point.

And by comparing the repeated data from the green square and the yellow square, we can tell that a vertex group contains 10 BYTEs (a number, like "7" is a BIT, and eight bits, like "FF 7F 00 00" makes a Byte) of data.


There might be 3 bytes for x,y,z 3d coordinate of this vertex (to locate this vertex, the data we REALLY NEED AND REALLY CARE),

3 bytes for x,y,z normal coordinate of this vertex (doesn't matter, because normal can be automatically calculated if we can figure out the faces of this mesh.),

2 bytes for u,v UV coordinate (for connecting a mesh and its texture),

2 bytes for maybe bones (or some inside game data that we'll never know since we're not Gaijin Employees).


Anyway, now we know that if we want to extract x,y,z coordinate data of every vertex of this mesh, we need to 

1. Read 3 bytes from 0x34 (the location of the orange point, where the vertices data starts).

2. Leave 7 bytes of useless normal, UV, bones data.

3. Read 3 bytes of x,y,z coordinate data.

4. Leave 7 bytes...



Then we need to tell these message we know to the Model Researcher

Red Arrow: Offset, means where the data of the vertices starts, that is 0x34

Yellow Arrow: Data Type, Float, means the data use a byte, 8 hexadecimal numbers to represent a coordinate.

Blue Arrow: Format, XYZ, means the data use x,y,z 3d coordinate to locate a vertex.

Purple Arrow: Padding, means how long the useless data is so that the Model Researcher can step over them. That is, 7 bytes, 4*7=28. 

Orange Arrow: Byte Order, Little Endian, means the number is saved from high to low.

Brown Arrow: Then we can render now.

Black Arrow: pull closer!

好!Yes! Да! Si! Ja! 良し!   All the vertices are found and located!


#9 : 24.07.2022 11:23

Extract the Faces of a Mesh

At last of #8, we can see from the screenshot that the "End block" is 0x1c6bc under the Padding.

Then we click in the Hex View. And those data in pink is those vertices data, but that's not the point now.

What we can see is that, from the orange point, which is exactly  0x1c6bc,  a new type of data starts. 

Like 00 XX 00 YY 00 ZZ......

 And we can see from the red circle, their meaning looks like a strange alphabet segregated by dots "."

These are the data representing the faces.

Just like how we start extracting the vertices, we need to figure out how many faces this model have.

We scroll down to the bottom. Only to find out that the last two lines in the orange square looks different from others. These are the tail of this file but not the data representing the faces. So the last data about faces ends at 0x1f1e7.


But if we know that every 00 XX represents a point, and every faces of these commercial game models are usually triangels.

Then the count of the faces is 2B2B÷6=1841

Then we type in all the parameters. where the face data starts (Offsets); Type (Short); how many faces (count,1841);format of a face (triangle).

But, then we find that one face is left (pink arrow). Then we increase 1 face, from 1841 to 1842. Bingo!

Render again, these are the faces!


#10 : 24.07.2022 11:32

Extract the UV

Remember I've metioned UV from #8? We need to extract UVs now, since if we want to glue clothes (texture) to our meshes, we need them as double-sided adhesives.

Just like how we extract vertices, UV coordinates is located in the last two bytes.

So the first UV coordinate starts at 0x54. And since we need to step over every 8 useless bytes to extract the two key UV bytes, the padding is 8*4=32.

Set for polygon and render the UV, here we go! We have the UV now.


#11 : 24.07.2022 11:59


It's time for extracting textures.

These tf_ files are texture files.

.tfd file is the texture file itself and .tfh is the header, the menu which describe the data sturcture of the .tfh file.

Then it's time for our Raw Texture Cooker

Remember to set as what is shown in the screenshot. BC1 mode.

We drag the railgun_a.tfd file in, to get a railgun_a.dds texture file.

Open that .dds texture file with Paint.net

We made it! Well... half way.

As is shown from the picture, the railgun's texture is splitted into three parts, two small one big.

Of course we want the big one, the clearer one.

So we open the .tfh file to see from where can we extract only the big part of the texture.

Actually if you read through these hexadecimal data, with some experience, quickly you can find this number, 2A800 (little endian remember~), is the starter of the big picture.

Then we type in 2A800 in to the OFFSET part.

Drag in again and open again. 




#12 : 24.07.2022 12:04

Load the Texture~!

We load this .dds file in, click Flip

Then render with texture to get this.

Then we can save the .obj file.


#13 : 24.07.2022 12:17

Last of Last


We have the model now, but we need to clear the burr.

Open the .obj file we've just saved in Blender

Then we need to 

1. Reverse the UV

2. Reverse the normal to make all the faces extroverted.

3. Then save again.


As the way described in #11, you can also extract the metallicity texture and normal texture from _g.tfd and _n.tfd

But do remember to set to BC3 when extracting normal texture.



That's all, free to ask me if encountered any problem~.

And as I metioned before, check my video https://www.bilibili.com/video/BV16341177vH for detailed operation. 

Although it's in Chinese, I believe combined with this simple tutorial, you can get the meaning.

Good luck!



#14 : 24.07.2022 12:22

We are waiting for the continuation!

At one time, I was also interested in this game, but the endless variability in assembling models scared me away.

As you can see, it's just a very simple very basic tutorial, which might be too wordy for experienced reverse engineers.

Because me myself is a very green-handed person. So do please to help me to correctize my guideline if my description is wrong.

"endless variability in assembling"

Well, just extract the basic models. :)