DSHack.org Archive
This is a read-only archive from DSHack.org, as seen in 2008-2015.
Click here to join our newer Forum.
Page: 1 2 3
Szymmy_Saurus.cia
Posted 2014年11月23日 - 2:30 JST #18495

GRAWR :3

Admin
2359 Posts
Since nobody else did it yet and SaveDataFiler allows us to decrypt MK7 saves, I'll try to make some research on MK7 save files. I'm just making this thread to keep progress instead of documenting a discovery, so it's going to take a few posts until I figure something out.

First, the file system goes like this:
rNJIqtz.png
Then like this:
T2tjFUH.png
For now my replay folders are empty, but I'm very curious, VERY curious if they are the same format as Staff Ghosts. So anyway, system2.dat has this unique header and it's mostly empty afterwards.
Y2fX4Jq.png
There are some E8 03s in latter part, but only a few. Repeating every 168 bytes.
BoYWvZm.png
And at the very end we have this.
rpBBTED.png

System3.bin has exactly the same size and the most part is exactly the same. The header is the same, the E8 03s are exactly the same... But there are some differences.
u0LrQ3i.png
I'm going to run through the shell cup and figure out what will it change in my save file.

Szymmy_Saurus.cia
Posted 2014年11月23日 - 2:57 JST #18497

GRAWR :3

Admin
2359 Posts
3 stars, 40 points, unlocked Banana Cup and new character - Shy Guy. Created ExtData for Mario Kart Channel, got 34 coins.
The first change was that system3.dat got replaced with system1.dat! But anyway, comparing files with 2.dat in name. The first change appeared rather quick.
olQHyml.png
The second one...
UTgD2oD.png
And the third... Make note that 01 appears multiple times. Four to be precise.
0LS6AC8.png
There are some 04s soon after. Also 4 to be precise.
emzFOH3.png
And then it starts to get really different.
asIwG5T.png
More of it:
ZCvaX3c.png
And at the very end before it fades into 00s:
VSedCI9.png
With the final two lines being different as well.
NKeHODd.png
Tried to look for the coin amount (34, 22 in hex).
It was only in one instance, on 4C28.
03K5qjA.png
I'll try to edit it to FF and look if it works.

Szymmy_Saurus.cia
Posted 2014年11月23日 - 3:01 JST #18498

GRAWR :3

Admin
2359 Posts
Not surprising. Time to make Banana Cup.
https://d3esbfg30x759i.cloudfront.net/ss/zlCfzSrUOHkNHledG3

Szymmy_Saurus.cia
Posted 2014年11月23日 - 3:31 JST #18499

GRAWR :3

Admin
2359 Posts
I actually went for Time Trials now as I couldn't restore the save, even after making this byte back ;_;
Here's the time I had:
https://d3esbfg30x759i.cloudfront.net/ss/zlCfzSrUXhsC7QW-Ye
10 coins, Bowser Castle 1.
I have no clue how are these files generated. I just had a System1 instead of System3, now I have a System4 as well instead of 2!
qtgGvz2.png
Was 7, is 11. Interesting. The only change there is in this file.
And obviously a hash. I don't know, is it randomly generated or so? Maybe that was the reason why I failed to make the last edit?
SxZHpkX.png

And the other file is really interesting.
IT'S MUCH DIFFERENT THAN WHAT IT WAS BEFORE!
But I guess it's not that weird if you know that I just pulled my first time trials, so yeah. Then it gets as usual.
aRCweEq.png
Then there's this 4E57 again...
k0d2avx.png
And the hash.
Wj0qRsN.png

There's also a matter of this replayxx.dat file.
Kka0tVq.png

And if I'm right...
I'VE JUST FOUND WAY TO CREATE STAFF GHOSTS! Lazy Nintendo counterattacks :P
9jz0G7k.png

Szymmy_Saurus.cia
Posted 2014年11月23日 - 3:48 JST #18501

GRAWR :3

Admin
2359 Posts
It's CRC-32! :awesome:
g5hVa6r.png
Time to haxx some things.

pabloh&g
Posted 2014年11月23日 - 4:08 JST #18504

On 26/09/2014, at 9:25 pm, Yamilla Hoshi wrote:> ????

Members
167 Posts

Interesting!


Gericom
Posted 2014年11月23日 - 4:13 JST #18505

Feature-Length Nut Expansion Pak

Moderator
1377 Posts
I already thought it was a crc. Nice work! Try to document the format on the wiki.

Very nice that those staff ghosts are in separate files.

Szymmy_Saurus.cia
Posted 2014年11月23日 - 5:29 JST #18508

GRAWR :3

Admin
2359 Posts
Every time the game is booted, it creates a new system file and deletes the old one.
There are two system files, one is a backup, the second one is a current save. What's interesting about it is that if the save data gets corrupted, it doesn't backup the old save.
I'd love to work on editing saves, but there is just one tiny problem: I can never, never, never ever get it working when modifying files. Halp?

Szymmy_Saurus.cia
Posted 2014年11月23日 - 6:00 JST #18509

GRAWR :3

Admin
2359 Posts
Aaand Staff Ghosts confirmed working. I wonder if we can extract them from ExtData as well.
https://d3esbfg30x759i.cloudfront.net/ss/zlCfzSrV8joYKoFr27

Solara-Chan
Posted 2014年11月24日 - 11:34 JST #18537

Brigade Leader In-Training

Moderator
124 Posts

Interesting. Nice to see MK7 Hacking Progressing!


Szymmy_Saurus.cia
Posted 2014年11月26日 - 3:53 JST #18560

GRAWR :3

Admin
2359 Posts

It's not progressing. Nobody wants to help me with the checksums, so we're stuck at read-onlyness  :Okay:


MKGirlism
Posted 2014年11月26日 - 4:24 JST #18562

I'm cutely evil, aren't I?

Führer
8388607 Posts
This Community is to small, for Team Work, which is why Geri must make Tools himself, which is why you must Research stuff yourself, which is why I have to Test everything myself, etc.

Haruhi Ermiiworth
Posted 2014年11月26日 - 4:51 JST #18563

ERLLUMINATII CONFIRMED

Moderator
9234 Posts

This Community is to small, for Team Work, which is why Geri must make Tools himself, which is why you must Research stuff yourself, which is why I have to Test everything myself, etc.

I actually help Szymmy a lot. We figured out some neaty things yesterday, during a 3 hours long Team Viewer session, and it was fun :D


Méga-Mew
Posted 2014年11月26日 - 4:58 JST #18564



Members
29 Posts

Can you found the offset for VR race ?


Gericom
Posted 2014年11月26日 - 5:12 JST #18572

Feature-Length Nut Expansion Pak

Moderator
1377 Posts
I want to help you, but currently I have a lot of other things to do aswell.

Szymmy_Saurus.cia
Posted 2014年11月27日 - 0:21 JST #18579

GRAWR :3

Admin
2359 Posts

I had three saves ripped, one with 1000VR, other one with 1021, unfortunatelly before the last try became reality, someone has chosen Toad Circuit eventually leading me to force close. After the restart I got to 1041VR. By the way, 1000VR players are so lame I was able to outlap one player on both of the races :P
So anyway, after dumping the saves, I opened them in Hex Editor and compared these values. The first thing I found was this.
6gAoUAa.png
File #3: 3FE=1022.
File #2: 417=1047
Why is this inversed? I mean shouldn't 1047 be in File #3? Or is it something else? I checked the offset in File #1:
koJj2Gw.png
And it was exactly 1000. What the heck? Soon afterwards there was a number of coins, but it was reversed as well. I double-checked if I opened the right file, but it was the right one all along, or should I rather say, both files in folder had the same contents.

BUT THEN I REALISED. It wasn't my VR. It was the opponents'.

54ECklW.png
Achievement get! Can edit other people's VR points.

I converted 1021 to Hex and got 3FD, wrote it in search box... Then made the same with second file and 411...
BayTFIE.png

BINGO! The offset is 0x4E3C! :3

 


Szymmy_Saurus.cia
Posted 2014年11月27日 - 0:34 JST #18580

GRAWR :3

Admin
2359 Posts

I took a look at the saves exported by PKHeX, edited one a bit and I realised two things:
1. The file 00000307_ is not responsible for save corruption. At all. It is just used by SaveDataFiler. Then we just have to edit the system file.
2. There are TONS of checksum checks in the Pokemon files.
3. File structure of Pokemon and MK7 saves is totally different. Totally. 
Now I'm going to try to edit the MK7 save file again, but this time modifying more values and checking what happens.

EDIT: When I did no changes, but booted MK7 and exported second save afterwards: The files were exactly the same.


Szymmy_Saurus.cia
Posted 2014年11月27日 - 1:20 JST #18581

GRAWR :3

Admin
2359 Posts

List of everything that changed between Luigi Circuit 29 coins and Luigi Circuit 36 coins, I did exactly the same things in both cases before exporting new save:
System4 changed to System5.

4904 changed from 01 to 02

4972 changed from 01 to 02

4974 changed from 01 to 02

4996 changed from 01 to 02

49AA changed from 01 to 02

4C14 changed from 04 to 05

4C18 and 4C19 changed from 9087 to 4CAA (!)

4C28 changed from 1D to 24

4C2C changed from A0 to B6

4C30 changed from 11 to 14

4C34 changed from 52 to 5E

4C38 and 4C39 changed from 5232 to 9A46 (!)

4C3C changed from 28 to 2E

4C40 changed from 17 to 1D

4CC0 changed from 09 to 10

4D70 changed from 0E to 12

4D72 changed from 0C to 0E

4D8A changed from 02 to 04

4D92 changed from 02 to 04

4D98 changed from 05 to 07

4D9A changed from 05 to 06

4DBA changed from 01 to 02

4DC4 changed from 05 to 07

4DE0 and 4DE1 changed from 7C27 to 262F (!)

4DE8 and 4DE9 changed from 4628 to 9638 (?)

4E63 changed from 00 to 01

Line starting with 4F60 changed from 00 to FD 0B 00 00 BC 22 00 00 48 14 00 00 B8 21 00 00 00 00 00 00 0C 00 00 00 16 00 03 00 12 00 00 00 02 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 05

50CC, 50CD and 50CE changed from 03 03 03 to 04 04 04
And obviously CRC-32 at 50D0.

I will make another save now and repeat the steps.


Szymmy_Saurus.cia
Posted 2014年11月27日 - 1:35 JST #18582

GRAWR :3

Admin
2359 Posts
4C18, 4C38, 4DE0 and 4DE8 officially confirmed to be checksums. But of what sort?

TSMKFail
Posted 2014年11月27日 - 2:11 JST #18583



Members
289 Posts

Well now to investigate.


Page: 1 2 3