MOGG File Format

MOGG files are a form of audio file often used in Harmonix games across all platforms aside from PS2 and DS, from Guitar Hero 2 (Xbox 360) and onwards. They are an extension of the OGG Vorbis container with an extra header prepending it, to assist with streaming and seeking. Additionally, starting with Rock Band, MOGG containers provide AES encryption.

Structure

MOGG Header

Name	Type	Size	Function
Version	Integer (LE)	4 bytes	Version of the MOGG file. Related to encryption (10 / 0xA = unencrypted)
Header Size	Integer (LE)	4 bytes	Length of the MOGG header / offset in the file where the OGG begins, represented by a count of 8-byte blocks.
Map Version	Integer (LE)	4 bytes	Version of the MOGG map. (usually 16 / 0x10)
Seek Interval	Integer (LE)	4 bytes	The interval between samples in the sample table. (Usually 20000 / 0x4E20)
Entry Count	Integer (LE)	4 bytes	The number of entries in the OggMap.
OggMap	#OggMap Array	sizeof(OggMap) * Entry Count	A lookup table to help the game stream the OGG file from disk.
AES IV	Byte Array	16 bytes	The initialisation vector used for decrypting the OGG file. Only present on MOGG version 11 / 0xB.

OggMap

To help the game seek in an OGG file (rewinding after pausing, practice mode, etc), a lookup table is used to locate the byte offset in the file to look for a sample.

When the game wants to seek to sample N, it looks up entry (N / Seek Interval) in the table, that gives a byte offset and sample offset. It then seeks the file over to the byte offset and skips (N - Sample Offset) samples.

Name	Type	Size	Function
Byte Offset	Integer (LE)	4 bytes	Offset into the file that the entry starts.
Sample	Integer (LE)	4 bytes	The sample in the OGG stream that corresponds to the byte offset.

OGG File

After the header, there is a regular OGG Vorbis format file, usually containing multiple tracks. The tracks corresponding to instruments are defined in the songs.dta file. This is where encryption starts if the version is 0xB or higher.

Encryption

Starting with Rock Band, MOGG files used for songs are encrypted with a 128-bit AES cipher in ECB mode with an externally-managed counter. Each "generation" of MOGG files changes either the encryption keys or exact scheme used, or both. There is also an additional bit-shuffling obfuscation step prior to encryption or after decryption. Rock Band games that support a given version of encryption also support all earlier versions.

Generation	Info	Games
10 / 0xA	Unencrypted. Lacks key in MOGG header.	Used for unimportant MOGGs, such as sound effects, and in Guitar Hero 2 (Xbox 360) for songs.
11 / 0xB	Encryption is done with a static key in the game binary, using the value in MOGG header as the IV.	Used in Rock Band on-disc and DLC songs. Also used in Dance Central Spotlight.
12 / 0xC	The true decryption key is derived through a custom algorithm. Changes the format of the header. Treated as exactly the same by all games that support at least this version of encryption.	Used in Rock Band 2 on-disc songs. Support was added to Rock Band 1 in a title update.
13 / 0xD		Not used officially, but used in songs encrypted by C3 CON Tools.
14 / 0xE	Increases the complexity of the key derivation step.	Used in Rock Band 2 DLC songs, as well as on-disc and DLC songs for the Dance Central series prior to Dance Central VR.
15 / 0xF		Used in the Rock Band Network. Support was added to Rock Band 2 in a title update.
16 / 0x10		Used in Rock Band 3, Rock Band 4 and Rock Band VR on-disc songs, and DLC until November 2018.
17 / 0x11	A new value is added in the header and a new set of keys are used, but otherwise the same as 0x10, except that the revealed key from one step in the algorithm is no longer ASCII.	Used in Rock Band 4 DLC and other Harmonix games released after November 2018, such as DropMix, Dance Central VR, Audica, and Fuser. The non-RB games each have their own keyset, and only support their own variant of 0x11, as well as unencrypted 0xA.

The Beatles: Rock Band used version 16/0x10 alongside a custom white-box crypto algorithm by Cloakware in order to protect the original keys.

Platform Differences

For performance(?) reasons, the Wii versions of the Rock Band games opt to not use MOGG files for songs, instead using the BIK File Format with an added encryption layer. Encrypted MOGG files are still used in DLC song preview audios.

On the Xbox 360, starting with Rock Band 2, release builds of the game obfuscate the encryption keys for version 0xC behind the console's native hypervisor encryption functions (XeKeys). This was likely to prevent those with development kits from reverse engineering the new algorithm, as it in theory changes the way a non-retail hypervisor derives keys.

On the PlayStation 3, MOGG files are decoded with the help of the SPUs, and the VorbisReader class was heavily changed to accomodate that. Due to a logic error in their new code, any unencrypted (0xA) MOGG will not play back as it will perpetually read the first block of the file.

Tools

Several tools are available for working with MOGG files (creation/extraction, encryption/decryption, etc)

• Onyx Music Game Toolkit
• Magma
• ArkTool
• Nautilus
• Audacity (While not supporting MOGG files, if the MOGG header is smaller than 0x1000 bytes, it will read the contained OGG Vorbis file.)

References

• xorloser's ScoreHero post
• Onyx Toolkit Source Code
• ogg2mogg Source Code
• "Breaking Beatles" - maxton - Archived on 4th December 2020