RPF7 archives

RAGEArchives and filesApplies toGTA V

An RPF7 archive holds directories, binary files and resources. Its table contains names; file data is addressed in 512-byte blocks relative to the archive’s start. An uncompressed binary entry can itself be an RPF archive, with its own header and block origin. Proven

Every table entry across the install’s 5,407 archives is checked against an independent CodeWalker listing. The 45,075 binary entries comprise 5,228 nested archives, parsed recursively, and 39,847 other payloads, decoded to their declared lengths. All 348,598 resource bodies decode to their stream ends without a refusal. The proven archive layouts and compression rules below apply to that full corpus. Proven · all archive entries

The entry table and name table follow the 16-byte header and use the header’s cipher. Names are NUL-terminated strings addressed by offsets into the name table. Proven

RPF7 header16 bytes100% known

Little-endian words. The magic's integer value is 0x52504637.

ProvenObservedSourcedInferredUnknownNot described

Offset	Size	Type	Field	Confidence
0x0	4	u32 = 0x52504637	magic	Proven
0x4	4	u32	entry count	Proven
0x8	4	u32	name table length	Proven
0xC	4	u32	cipher	Proven

Entry variants

Every entry is 16 bytes. A directory has 0x7FFFFF00 in its second word; otherwise bit 31 of that word distinguishes a resource from a binary file. Proven

Directory entry16 bytes100% known

ProvenObservedSourcedInferredUnknownNot described

Offset	Size	Type	Field	Confidence
0x0	4	u32	name offset	Proven
0x4	4	u32 = 0x7FFFFF00	directory marker	Proven
0x8	4	u32	first child entry	Proven
0xC	4	u32	child count	Proven

Binary entry16 bytes100% known

ProvenObservedSourcedInferredUnknownNot described

Offset	Size	Type	Field	Confidence	Notes
0x0	2	u16	name offset	Proven
0x2	3	u24	compressed length	Proven	zero means uncompressed
0x5	3	u24	block offset	Proven
0x8	4	u32	decoded length	Proven
0xC	4	u32	encrypted flag	Proven	0 or 1

Resource entry16 bytes100% known

ProvenObservedSourcedInferredUnknownNot described

Offset	Size	Type	Field	Confidence	Notes
0x0	2	u16	name offset	Proven
0x2	3	u24	stored length	Proven	includes the 16 bytes before the compressed body
0x5	3	u24	block offset and resource flag	Proven	low 23 bits are the block; top bit is set
0x8	4	u32	system page flags	Proven
0xC	4	u32	graphics page flags	Proven

Binary entries with a nonzero compressed length use raw DEFLATE; a zero compressed length uses the decoded length as its stored length. Resources use the RSC7 page layout. Their archive entry supplies the page flags; the 16 bytes preceding their body are not a trustworthy loose-file RSC7 header. Proven

When a resource’s 24-bit stored length is 0xFFFFFF, its actual length is assembled little-endian from bytes 7, 14, 5, 2 of those 16 preceding bytes. Proven

Script resources (.ysc) have encrypted compressed bodies without a separate resource-entry encryption flag; the inspected reader selects decryption by extension. The resource body’s stored length participates in NG key selection. Proven

Ciphers

Header value	Interpretation	Confidence
`0`	No encryption	Sourced · CodeWalker, ragekit
`0x4E45504F`	Clear table (`OPEN`)	Sourced · CodeWalker, ragekit
`0x0FFFFFF9`	AES-256 ECB	Sourced · CodeWalker
`0x0FEFFFFF`	NG	Sourced · CodeWalker

The byte-swapped word 0x4F50454E is not a cipher value in either reader’s source; both read 0 as none and 0x4E45504F as open. Sourced · CodeWalker, ragekit

Both cipher routines process complete 16-byte blocks and leave a trailing partial block unchanged. NG is a 17-round table cipher: rounds 1, 2 and 17 mix consecutive input bytes; rounds 3–16 take a diagonal byte spread. Sourced · CodeWalker

NG selects one of 101 keys using (nameHash + length + 61) % 101, with wrapping 32-bit addition. The archive uses its own filename and length; an encrypted file uses its entry name and recorded file length. The cipher’s name hash maps bytes through a lookup table before mixing, so ordinary joaat is not interchangeable with it. Sourced · CodeWalker

The community key-material layout provides NG keys, decrypt tables, the hash lookup table and an optional AES key; CodeWalker describes extraction from a game executable. Sourced · CodeWalker

Recounting every archive record in the retained listing gives 5,405 NG and two AES archives. The AES archives are x64c.rpf/anim/cutscene/cuts_random_event.rpf and x64c.rpf/anim/cutscene/cuts_trevor_4.rpf. Enhanced therefore cannot be treated as an NG-only corpus. Proven · 5,407 unique archive paths

Which ciphers occur in other builds?

The two AES archives occur in the inspected listing. Their presence or absence in another edition or update needs a separate archive census. Unknown