GCN MemCard Recover

Discussion in 'Wii - Hardware, Devices and Utilities' started by GerbilSoft, Jun 13, 2013.

Jun 13, 2013

GCN MemCard Recover by GerbilSoft at 5:42 AM (11,056 Views / 12 Likes) 36 replies

  1. GerbilSoft
    OP

    Member GerbilSoft GBAtemp Maniac

    Joined:
    Mar 8, 2012
    Messages:
    1,459
    Country:
    United States
    This game is not in the database. If you can send me a full dump of the card with the deleted save, and a known good save, I can add it and attempt to restore the file.

    Sidenote: Saving a JPN save file should *not* result in the card getting corrupted. Worst case is that it ends up setting the encoding field to Shift-JIS, which will make US/EU systems *think* it's corrupted, but is easily dealt with using GCMM and the like. (Copy files off of card, reformat, restore files.)

    Also, I'm currently adding a few editors to GCN MemCard Recover. I'm implementing a Sonic Adventure DX save file editor (based on SASave by MainMemory), as well as a hex editor. Other editors may be added later on.
     


  2. Leo Alves

    Member Leo Alves GBAtemp Regular

    Joined:
    Dec 16, 2012
    Messages:
    117
    Country:
    Brazil
    Here's my latest full dump, it is after the corruption, the only save i couldn't recover was from Tomb Raider Legend:
    https://drive.google.com/uc?export=download&id=0B3v61S2zNpCGM1p2endzbTVRYVE

    I think it encoded the Card to Shift-JIS, as you said, because before i reformatted the card, the only save file left was from the japanese game
     
  3. gukid

    Newcomer gukid Advanced Member

    Joined:
    Dec 15, 2006
    Messages:
    99
    Country:
    Canada
    First of all, thank you so much for the program! Like a few others, I played a Japanese game and wasn't reading the prompts properly, and it formatted my memory card for the Japanese region. I didn't even realize until I tried playing a US game, and then realized that I had potentially lost 14 years worth of Gamecube savegames...

    I did a raw dump, and using the MCRecover was able to recover almost everything on the card, minus a few games that you've already mentioned aren't supported yet (Twilight Princess, Mario Kart).

    There are a couple others missing that I was hoping to be able to recover: Baten Kaitos Origins, and Fire Emblem: Path of Radiance (which I was right in the middle of my first playthrough...) Are these not yet included in the database? Or are they affected in the same way as TP and Mario Kart?

    I should probably mention that when I loaded Fire Emblem and received the message about the memory card being formatted for a different region, I let it format it for the NA region, and it created a new Fire Emblem savegame. I assume that this would have probably overwritten something at the beginning of the file system, but I can't tell what that would have been. Being that there is a new save present on the card, would that prevent MCRecover from displaying the older deleted savegame?

    If you can possibly help me out, I can provide save backups, raw dumps, whatever you need!
     
  4. gukid

    Newcomer gukid Advanced Member

    Joined:
    Dec 15, 2006
    Messages:
    99
    Country:
    Canada
    Actually, I just found the xml database file, and I have quite a few games that aren't in the db yet. I also just discovered the feature in the program where you can get an xml search template for an existing save. I'll try creating new saves for any games that aren't present in the database, and add the generated xml to the database to test.
     
  5. GerbilSoft
    OP

    Member GerbilSoft GBAtemp Maniac

    Joined:
    Mar 8, 2012
    Messages:
    1,459
    Country:
    United States
    If a save has actually been overwritten, then MemCard Recover won't be able to find it. You should still be able to find saves from other areas of the card.

    I haven't done much work on MemCard Recover recently (been doing ROM Properties Page stuff), but if you have save files that aren't present in the current database, you can send them to me and I'll add them in. (The XML template function provides a basic template; for most files, you will still need to manually add variables, which are somewhat documented in an example file.)

    For the games that you haven't been able to recover: If you send me the card dump plus known-good GCIs, I can recover them for you. (This includes manual recovery of the unsupported save files like Mario Kart.)
     
  6. gukid

    Newcomer gukid Advanced Member

    Joined:
    Dec 15, 2006
    Messages:
    99
    Country:
    Canada
    It's one of the 1024 block cards, so I imagine the chances of it having overwritten something I want are pretty low, but I understand that this would cause that particular data to be unrecoverable.

    I've created some xml entries for a bunch of other games that were missing, which appear to be working. Other than Fire Emblem, Mario Kart and Twilight Princess, I think that may cover everything I've lost (at least everything that I own or can remember playing). I'll send you the xml templates I've generated so you can add them (they may need some tweaks.)

    If you're willing to take a look at recovering those last 3 saves, I'll definitely put together some good GCI's along with my raw memory card dump. Should I just email it to you?

    Thanks again! You rule!
     
  7. Zonta85

    Member Zonta85 GBAtemp Fan

    Joined:
    Nov 9, 2007
    Messages:
    333
    Location:
    Ascoli Piceno
    Country:
    Italy
    @GerbilSoft i see that only few games are in the database for PAL. I have tons of them, Can i send you a Memory card raw backup?
     
  8. GerbilSoft
    OP

    Member GerbilSoft GBAtemp Maniac

    Joined:
    Mar 8, 2012
    Messages:
    1,459
    Country:
    United States
    Sure, you can send me some PAL memory card dumps. I'm still working on some Nintendont and rom-properties stuff, but I might as well get back to mcrecover this weekend as well.
     
  9. Zonta85

    Member Zonta85 GBAtemp Fan

    Joined:
    Nov 9, 2007
    Messages:
    333
    Location:
    Ascoli Piceno
    Country:
    Italy
    Perfect i Will send you a raw backup of my 64 MB Memory card that has a Lot of games inside when i Will be at home. Are .gci files for single saves ok too?
    Because i Can download them from some sites, in this way it Will be easy to increase both PAL and NTSC databases.
     
  10. GerbilSoft
    OP

    Member GerbilSoft GBAtemp Maniac

    Joined:
    Mar 8, 2012
    Messages:
    1,459
    Country:
    United States
    I've had problems with GCIs uploaded to various sites before. Among other things, some of them are region-swapped, which works fine for use as a save file, but it doesn't contain the proper information for recovery.
     
  11. Zonta85

    Member Zonta85 GBAtemp Fan

    Joined:
    Nov 9, 2007
    Messages:
    333
    Location:
    Ascoli Piceno
    Country:
    Italy
    Understand. I Will upload only mine then.
     
  12. MarcusCarter

    Member MarcusCarter GBAtemp Fan

    Joined:
    Jan 7, 2012
    Messages:
    374
    Location:
    Indianapolis, IN
    Country:
    United States
    @GerbilSoft
    I believe I found the relevant checksum code of Yu-Gi-Oh! The Falsebound Kingdom USA.
    In the linked image, r28 (special purpose register #28) is the current region of the save that is currently loaded into RAM. r29 is 0x0200, and 800d2354's instruction adds that to the current address (in r28). The "st? rX, 0x00YY (r28)" instructions are adding the ?, where ? is either b (byte) or h (halfword (a halfword is 2 bytes, but considering you made the mcrecover program, I assume you know this, so this is for the 'average' users here)) at current address (stored in r28) + an offset of 0x00YY bytes, and stores it in register X. The 'lbz' instructions are doing the same thing, except they are zeroing the upper 2 bytes of the register afterward (Gamecube/Wii registers are 32-bit).

    Image.

    The .gci header is stored in 2 locations in RAM: 803ee4e0 and 803f04e0. The save itself is read from 2 locations in RAM as well, with only the first one seems to be used in calculating the checksum: 801bcad0 and 803faa90.

    I could be wrong (I still consider myself a noob hacker), but I believe that this subroutine is the key to cracking the checksum for this game.

    All of this was done using the Dolphin 4.0 DebugFast build from the SmashBoards Forums (search for 'Dolphin DebugFast 4.0 Emulator' on Google). The game runs super slow in this emulator build, so for plain memory searches I use the latest Dolphin build available with the '-d' flag in Command Prompt.
     
  13. MarcusCarter

    Member MarcusCarter GBAtemp Fan

    Joined:
    Jan 7, 2012
    Messages:
    374
    Location:
    Indianapolis, IN
    Country:
    United States
    I was wrong.

    3 registers are used for the checksum itself, I'll call them by variable names x, y, and z. Variable z will contain the actual checksum once it is fully calculated. There is also an accumulator (variable c) that tells the how many 16-bit values have currently been added, and when the accumulator goes over 0x08A8, then it is compared against the checksum in the save file, which is stored in r8 before this subroutine happens.
    The current save offset is in r9, and will be referred to as addr (note that the word 'addr' is in bold here!)
    Items inside square brackets ( [ or ] ) refer to the values that are located at that address offset.
    For example, "[addr + 0x0410] = x" means 'store the value at the address (addr + 0x0410) in register x'.

    Checksum is calculated as follows:

    1. addr = 0x4440
    2. set c, x, y, and z to zero
    3. [addr] = y
    4. c + 8 = c
    5. [addr + 0x2] = x
    6. (y XOR z) + z = z
    7. [addr + 0x4] = y
    8. (x XOR z) + z = z
    9. [addr + 0x6] = x
    10. (y XOR z) + z = z
    11. [addr + 0x8] = y
    12. (x XOR z) + z = z
    13. [addr + 0xA] = x
    14. (y XOR z) + z = z
    15. [addr + 0xC] = y
    16. (x XOR z) + z = z
    17. [addr + 0xE] = x
    18. (y XOR z) + z = z
    19. addr + 0x10 = addr
    20. (x XOR z) + z = z
    21. IF c ≤ 0x08A8 THEN GOTO step 3 ELSEIF addr ≥ 0x55A0 THEN branch to next subroutine
     
  14. GerbilSoft
    OP

    Member GerbilSoft GBAtemp Maniac

    Joined:
    Mar 8, 2012
    Messages:
    1,459
    Country:
    United States
    I'll take a look at implementing that algorithm into MemCard Recover.

    EDIT: I'm not sure about some of the steps listed - it seems you use left-hand assignment for a few of them, e.g. [addr + 0xE] = x; but then for others, you use right-hand assignment, (y XOR z) + z = z. Can you clarify these?
     
  15. MarcusCarter

    Member MarcusCarter GBAtemp Fan

    Joined:
    Jan 7, 2012
    Messages:
    374
    Location:
    Indianapolis, IN
    Country:
    United States
    They mean the same thing. I usually put the new value on the right for simplicity.
     
  16. GerbilSoft
    OP

    Member GerbilSoft GBAtemp Maniac

    Joined:
    Mar 8, 2012
    Messages:
    1,459
    Country:
    United States
    Okay, I'll keep that in mind.
     
  17. eduall

    Member eduall GBAtemp Regular

    Joined:
    May 29, 2014
    Messages:
    143
    Country:
    Venezuela
    MOH Rising sun isnt in the db, my Mcard emulation was corrupted. i lost my last savegame but with cheats can replay the mission. thanks for this tool ! :)
     

Share This Page