[RELEASE] Savegame-Deemer - Save and Load of *unencrypted* savedata (from any game)

[Hellcat]

Savegame-Deemer
Save and Load of unencrypted savedata
(from any game)
********** + ********** + **********
a CFW plugin by ---==> HELLCAT <==---

Huh? Back in the 1.50 days we could use tools like "Shines Savedata Tool" to dump/decrypt and resave gamesaves.... and edit them inbetween Since FW 2.00 a few more security measures got put into the FW to prevent messing around with the savedata. Well, while trying something different - but related - I created this CFW plugin. This plugin makes the PSP to save the savedata in unencrypted from alongside the normal, encrypted data, and also loads it back in on savedata load operations.

OK, here's the thing:
While this plugin is active, on every save operation, there's a second set of savedata written to
/PSP/SAVEPLAIN
on your memstick.
The folder layout in there is pretty similar to the one in the original /PSP/SAVEDATA folder, only that everthing in here is plain and unencrypted.

You can then edit your heart out on your savedata, on the next load the unencrypted (and maybe edited ) version will be loaded instead of the normal/encrypted one from /PSP/SAVEDATA.

If no unencrypted version exists for a savegame, the normal one will be used as if nothing ever happened.

More details can be found in the readme.
Read it, especially when having trouble, as there are a few "confuseness" causing things are mentioned in there....

Finally we're back at good ol' gamesave cheating


UPDATE 19.02.2008:
v1.10

• Did some major internal changes due to huge compatibility issues when actually running/using the plugin.
  Should be way more stable now, hopefully running on 100% (or at least 99.9% ) of the games.
  Also it's only one .PRX now, not splitted in two anymore, since the main .PRX is now a native kernel mode one.
• The usual minor bug fixes
• Added a new feature to patch/overwrite the SFO params/info on save (see readme)

How to get it.... /// - [ D*O*W*N*L*O*A*D - v1.10 ] - /// (Source is available as seperate download, URL is given in the readme....)

[mattownsurealgoood]

Hm, sounds pretty sweet.

How do you edit and what do you edit for?

[Hellcat]

How: Hexeditor in most cases

What for: Money, Medals, Unlocks, whatever the game saves in there....
(maybe even exploits....)

[Coolj]

Cool stuff,nice job Hellcat.Where is your dev statz?

[placo23]

Wow that sounds sweet! Is there any way to find out exactly what to edit? As for example, if I wanted to unlock a car when playing burnout dominator?

[Hellcat]

Originally Posted by placo23

Wow that sounds sweet! Is there any way to find out exactly what to edit? As for example, if I wanted to unlock a car when playing burnout dominator?

Closely inspect the data and find out its structure....

I usually compare two or more versions to see where the stuff is located that I want to modify and start trial-and-error like messing around until I get something

[Judas]

Here's what I would do. Say you wanted to buy another car in Burnout. I'd race and save up enough money to buy another car. Save the game. Then, buy the car, and do nothing else. Then, save the game in a different slot. Then you can compare the two, to see where the new car you bought is.

[Torch]

The burnout saves are different, atleast on the PS2. It just tracked how many races you completed, not the cars unlocked. More races completed = car gets unlocked on next load. And the PS2 version had checksums which had to be recalculated.

[Mr305]

I thought most games used internal checksum APART from being encrypted

[Hellcat]

Originally Posted by Mr305

I thought most games used internal checksum APART from being encrypted

They do.
But not all
(GO-Puzzle and Wipeout-Pulse have not, that's the two I tested it witch )

[Moose]

Sweet, thanks a lot!

Nice work Hellcat.

[b2p1mp]

Maybe a thread can be started (possibly this one) to show what games do not have the checksums. And where to edit in the hexeditor. For us dummies...

[headlesslizard]

Nice one hellcat maybe a tut will be created. Hellcat for dev...

[Mr305]

Originally Posted by Hellcat

They do.
But not all
(GO-Puzzle and Wipeout-Pulse have not, that's the two I tested it witch )

Thanks a lot! My new adventure is NOW game save editing...

-----

Is there hex editor made FOR psp? Pspfiler is only a viewer

[tommydanger]

nice work
But your File Server really sucks :P
I want to download the src but can't cause it says " You are already downloading a file!

Please finish your first download before starting another one.

If your previous download got aborted try again in a couple of minutes."
and it's been over 35min ._.
I had this idea for quite a while too, cause there'll be a time without pandora and we have to be prepared for that
Now I can focus on the main part, once again nice work

[Insert_Witty_Name]

Nice code mate very clean.

I recently updated the SDK header and sample for savedata, might want to check it out to remove some of the unknowns in your struct.

As for the question in your readme:

Another thing, when the savedata in question is saved/loaded via
the save game dialog (where you can choose what savegame to load
or save):
Usually the folder for the unencrypted savedata consists of
the game ID AND the save ID.
For the dialog to show up, the game does not pass a fixed save ID,
so in this case the folder will only be named of the game ID.
Keep that in mind if you think the wrong data is loaded/saved.

Example:
Wipeout-Pulse, savedata caused by autosave will be in a folder
like this:
UCES00465P0001
If you save (or load) a profile using the load/save dialog the
folder will look like this:
UCES00465

I guess this will cause some confusion, but so far I have no
way of knowing what save was selected in the dialog.
Not even the game knows ;-)

The savedata selected (0000, 0001 etc.) will be passed to the ->saveName member of your struct on save/load. This only happens on the 'list' type saves/loads.

Hope this helps.

[Reikai]

Dear Hellcat,
after seeing your program at the pspupdates website, I thought it could be the next replacement for the (reletively-famous) Japanese program, Laboko, on the PSP Slim.

However, after running it, I came across some problems...

whenever I enable deemerh.prx on the recovery menu, I can't load games... ISO, or UMD... I get the Sony Computer Entertainment boot-screen... but after that, it goes black... and a few seconds after that, it goes to the XMB saying that it can't load the game...

If I disable deemerh.prx however, everything works perfectly fine.

I am currently running this program though a Japanese PSP-2000/Slim... *Not sure if it may have anything to do with it...*

The memory stick I tried/am using is a Sandisk 4 GB...

The games I tried using this on were:
Final Fantasy Tactics: Shishi Sensou
Monster Hunter Portable 2
Star Ocean: First Departure
*All Japanese...

==========

[sconer]

@Reikai: First of all, try different options in UMD Mode in Configuration from your M33 Recovery Menu and see if that makes any difference. If any these games use the autosave feature or attempt to load profiles automatically, that is most likely the reason. When games autosave, or enter a save/load menu, they begin to slow down as it is, so with this plugin enabled they become even slower. Anyways, what I'm getting to, is that some games use more memory than others, and the plugin may crash the PSP during any of the save/load methods.

If anyone decides to make a list, you can put Ape Quest in the unsupported section, it will crash during load.

[Bubbletune]

Neat work Hellcat! Can't believe you still don't have developer status, your code is really advanced and good work I'll try it tommorow on some game.

[TeamOverload]

Very sweet, will be useful for going around and screwing around with some games when I finish them.

[mohaas05]

does this also work for games like SOCOM:FTB2 that are locked to the PSP unit they're saved on?

[zmathue]

yes but to move it to a dif. psp you might need to change the saved mac address, then the checksum(if there is one)

[Hellcat]

Originally Posted by b2p1mp

Maybe a thread can be started (possibly this one) to show what games do not have the checksums. And where to edit in the hexeditor. For us dummies...

I could screw together a simple website for that, so everyone can enter info they got into a small database....

Originally Posted by headlesslizard

Nice one hellcat maybe a tut will be created. Hellcat for dev...

I'm sure (about the tut).

And yayz0r \o/ [action=Hellcat]got teh blackish username [/action]

Originally Posted by tommydanger

But your File Server really sucks :P

*g* yah, I know.... it was never meant for the kind of traffic it was hit by lately....
I'll raise the limits, hopefully that'll fix it for a while.... gotta make a new one.... when there's time *lol*

Originally Posted by Insert_Witty_Name

Nice code mate very clean.

Thanks

Originally Posted by Insert_Witty_Name

The savedata selected (0000, 0001 etc.) will be passed to the ->saveName member of your struct on save/load. This only happens on the 'list' type saves/loads.

Hope this helps.

Hmm, when the whole process finished (...GetStatus returns 3) the saveName value is still empty... (you can check on the struct dump that gets saved as well after a save from dialog)
But I might look at the saveNames array, maybe there's something....

Originally Posted by Reikai

However, after running it, I came across some problems...

whenever I enable deemerh.prx on the recovery menu, I can't load games... ISO, or UMD... I get the Sony Computer Entertainment boot-screen... but after that, it goes black... and a few seconds after that, it goes to the XMB saying that it can't load the game...

Originally Posted by sconer

If anyone decides to make a list, you can put Ape Quest in the unsupported section, it will crash during load.

Hmm.... strange, I'll check that!
What firmware happens this on?
What error code fdo you get when it jumps back to the XMB?

I tried myself on an EU Slim with 3.80-M33.

That should be able to be figured out

Originally Posted by JumpR

Neat work Hellcat! Can't believe you still don't have developer status, your code is really advanced and good work

Thanks
And I finally got the Dev

[patrck_744]

NOT WORKING: Monster Hunter Freedom 2[ISO] [800200D], Juiced 2: HiN[ISO] [800200D]

I hope there is a fix for this.

[Hellcat]

I guess it's 800200d2?
k, I'm on it

[EDIT]
What firmware happens this on?

[Ephyon]

The Error Message for Monster Hunter Freedom 2 (EU) is
"The game could not be started. (800200D9)"


I will try out my other games and will edit this post for saving space in this thread ^^

[Coolj]

Making your prx in kernel mode should fix those problems.

Oh,I forgot,congrats for your new status,finally

[FreePlay]

lumines and daxter don't work ._.
[action=FreePlay]scurries about trying to fix this[/action]

[Hellcat]

Ah, Lumines I can test with tonight, I have that one!
[action=Hellcat]runns off for some bug hunting....[/action]

[Reikai]

the FW I was running was

3.80 M33-5

Error code is the same as you posted. 800something.... yeah