Hacking This is how to cheat Freedom Wars Savegame

[liomajor]

This is how to cheat your savegame (make backup!):

1. Write down your Value to cheat, ex. your points: 5625 > F9 15 HEX
2. Export your savegame either with savemgr or manualy
   (eboot.bin from vitashell temp. replacement for games eboot)
3. FTP transfer your decrypted save to your PC from savedata0:
   
4. Use your fav hexeditor like HxD to open user_data000.dat
5. Search and change the desired value (should be near your players first name)
6. To make a valid file, we have to fix the first 4 bytes crc
   

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   00000000  1A C6 79 A6 04 00 00 00 54 4F 50 00 CF 86 06 00  .Æy¦....TOP.φ..
   00000010  01 00 13 00 19 00 00 00 04 00 00 00 41 46 44 00  ............AFD.
   00000020  68 00 00 00 01 00 01 00 C2 B1 9D 83 A8 FC E1 00  h.......±.ƒ¨üá.
   00000030  7C F9 43 A1 A8 FC E1 00 2A BE 2E A7 A8 FC E1 00  |ùC¡¨üá.*¾.§¨üá.

   Old CRC32 is 1A C6 79 A6 > A679C61A
   Select everything except the first 4 bytes (select block in HxD)
   Calculate the files new CRC32 (HxD > Analysis > Checksums > CRC32)
   Edit the first 4 bytes to match, ex. 01020304 gets > 04030201
7. Save and transfer it back to your vita -Done-

(Don't cheat online or you might get banned!)

Have Fun

 

[Skardale]

Any idea about materials? Wouldn't that be hard to locate?

 

[rjshooter]

What possibility can we do with editing the savegame? More materials? Getting the weapon that we've never use before? (example: knuckle, pistol)

 

[liomajor]

I guess someone will make a save editor since manipulating things is very easy.

As a starter you will need known values or compare for/after new item/weapon pickup to receive unknowns.

Cheat Engine, File 1 > File 2 > File 3...

You could also cheat via DLC to get items easy, but both is limited and amend each other.

Ex. for unclaimed (each DLC can only claimed once per gamestart) DLC (gift_setting.xml)

SW_0041 > Auto-Resuscitator +
SW_0001 > Frag Grenade
WG1_0001 > EZ Katze II Ausf. G
and so on...

Spoiler: Item + Weapons

Ex. <Item id="SW_0001" count="999"/>

SW_0001 > Frag Grenade
SW_0002 > Bouncing Grenade
SW_0003 > Sticky Grenade
SW_0004 > Flash Grenade
SW_0005 > Debilitator
SW_0006 > Thorn Jammer
SW_0007 > Decoy Mine
SW_0008 > Anti-Abductor Mine
SW_0009 > Anti-Personnel Mine
SW_0012 > First Aid Kit
SW_0013 > Regenerator
SW_0014 > Auto-Resuscitator
SW_0015 > AMMO Pack
SW_0016 > Adrenaline
SW_0017 > Painkillers
SW_0018 > Will'O Packs
SW_0019 > Amplifier
SW_0020 > Suppressor
SW_0021 > Flare Knife
SW_0022 > Thrusterboard
SW_0023 > Thrusterboard LS
SW_0024 > Thrusterboard HS
SW_0025 > BENKEI
SW_0026 > BENKEI GL1
SW_0027 > BENKEI Auto
SW_0028 > BENKEI GL1 Auto
SW_0029 > Frag Grenade
SW_0030 > Bouncing Grenade
SW_0031 > Sticky Grenade
SW_0032 > Flash Grenade
SW_0033 > Debilitator
SW_0034 > Thorn Jammer
SW_0035 > Anti-Abductor Mine
SW_0036 > Anti-Personnel Mine
SW_0039 > First Aid Kit
SW_0040 > Regenerator
SW_0041 > Auto-Resuscitator
SW_0042 > AMMO Pack
SW_0043 > Adrenaline
SW_0044 > Painkillers
SW_0045 > Amplifier
SW_0046 > Suppressor
SW_0047 > Flare Knife

Ex. <MainWeapon id="WG1_0000" level="10" rarity="9"></MainWeapon>

WG1_0000 > EZ Katze I
WG1_0001 > EZ Katze II Ausf. G
WG1_0002 > EZ Katze Kralle I
WG1_0003 > EZ Katze Fang I
WG1_0004 > EZ Batrach K1
WG1_0005 > EZ Vorfuß K1
WG1_0006 > Arisaka MK 1
WG1_0007 > Arisaka Mk2
WG1_0008 > Arisaka Neuwirth Mk 3
WG1_0009 > Arisaka Oldman Mk 4
WG1_0010 > Arisaka Kaczynski Mk 5
WG1_0011 > Arisaka Schneier Mk 6
WG1_0012 > Barbara's Easy Blaster
WG1_0013 > Barbara's Easy Blaster P
WG1_0014 > Joyshot II
WG1_0015 > Lady Lock 'n' Load
WG1_0016 > Blasted Before Breakfast
WG1_0017 > Miss Fire
WG1_0018 > SR-42/LA
WG1_0019 > SR-42/Custom
WG1_0020 > SR-44/ET
WG1_0021 > SR-44/ED
WG1_0022 > SR-44/EC
WG1_0023 > SR-44/ES
WG1_0024 > AR-7/L
WG1_0025 > AR-7/Custom
WG1_0026 > AR-8/ET
WG1_0027 > AR-8/ED
WG1_0028 > AR-8/EC
WG1_0029 > AR-8/ES
WG1_0030 > Pulsar
WG1_0031 > Pulsar 1000
WG1_0032 > Pulsar AMR
WG1_0033 > Pulsar B250
WG1_0034 > Pulsar DUAL
WG1_0035 > Pulsar ETERNAL

WG3_0000 > AAW-M2
WG3_0001 > AAW-M2E1
WG3_0002 > AAW-M3/ET
WG3_0003 > AAW-M3/ED
WG3_0004 > AAW-M3/EC
WG3_0005 > AAW-M3/ES
WG3_0006 > EZ Nashorn III
WG3_0007 > EZ Nashorn IV/V
WG3_0008 > EZ Nashorn Kralle III
WG3_0009 > EZ Nashorn Fang III
WG3_0010 > EZ Nashorn Batrach III
WG3_0011 > EZ Nashorn Vorfuß III
WG3_0012 > EZ Igel VI
WG3_0013 > EZ Igel VIII ausf. D
WG3_0014 > EZ Igel Kralle VI
WG3_0015 > EZ Igel Fang VI
WG3_0016 > EZ Igel Batrach
WG3_0017 > EZ Igel Vorfuß VI
WG3_0018 > Blaster
WG3_0019 > Blaster 6000
WG3_0020 > AP/AV Blaster
WG3_0021 > Heat Blaster
WG3_0022 > Blaster Plus
WG3_0023 > Shield Blaster
WG3_0024 > Dragonfire
WG3_0025 > Dragonfire
WG3_0026 > Dragonfire - Gale Force
WG3_0027 > Dragonfire - Heat Haze
WG3_0028 > Dragonfire - Thunderclap
WG3_0029 > Dragonfire - Lightning Flash
WG3_0030 > Nambu Mk 25
WG3_0031 > Nambu Mk 26
WG3_0032 > Nambu Neuwirth Mk 27
WG3_0033 > Nambu Oldman Mk 28
WG3_0034 > Nambu Kaczynski Mk 29
WG3_0035 > Nambu Schneier Mk 30

WG4_0000 > MG-M7
WG4_0001 > MG-M7/E1
WG4_0002 > MG-M9/ET
WG4_0003 > MG-M9/ED
WG4_0004 > MG-M9/EC
WG4_0005 > MG-M9/ES
WG4_0006 > EZ Wolf I Aust. F
WG4_0007 > EZ Wolf II
WG4_0008 > EZ Wolf Kralle I
WG4_0009 > EZ Wolf Fang I
WG4_0010 > EZ Wolf Batrach I
WG4_0011 > EZ Wolf Vorfuß I
WG4_0012 > Phalanx
WG4_0013 > Phalanx B1500
WG4_0014 > AP/AV Phalanx
WG4_0015 > Phalanx Inferno
WG4_0016 > Phalanx Bane
WG4_0017 > Phalanx Longbow
WG4_0018 > Dragonfang
WG4_0019 > Dragonfang
WG4_0020 > Dragonfang - Gale Force
WG4_0021 > Dragonfang - Heat Haze
WG4_0022 > Dragonfang - Thunderclap
WG4_0023 > Dragonfang - Lightning Flash
WG4_0024 > Creamy Screamy Jr.
WG4_0025 > Creamy Screamy
WG4_0026 > Mean Machine
WG4_0027 > Linda's Noisy Blaster
WG4_0028 > Twinkle Twinkle
WG4_0029 > Kiss Kiss Bang Bang
WG4_0030 > Adelring
WG4_0031 > Hrunting
WG4_0032 > Kusanagi
WG4_0033 > Putheus
WG4_0034 > Ascalon
WG4_0035 > Ak Kelte

WS1_0000 > Murasame Mk 9
WS1_0001 > Murasame Mk 12
WS1_0002 > Murasame Neuwirth Mk 14
WS1_0003 > Murasame Oldman Mk 10
WS1_0004 > Murasame Kaczynski Mk 15
WS1_0005 > Murasame Schneier Mk 18
WS1_0006 > EZ Falke II
WS1_0007 > EZ Schwarzfalke II
WS1_0008 > EZ Falke Kralle II
WS1_0009 > EZ Falke Fang II
WS1_0010 > EZ Falke Batrach II
WS1_0011 > EZ Falke Vorfuß II
WS1_0012 > Hawkshadow
WS1_0013 > Hawkshadow
WS1_0014 > Hawkshadow - Gale Force
WS1_0015 > Hawkshadow - Heat Haze
WS1_0016 > Hawkshadow - Thunderclap
WS1_0017 > Hawkshadow - Lightning Flash
WS1_0018 > Happy Chopper
WS1_0019 > Happy Chopper Pro
WS1_0020 > Pete' Easy Chopper
WS1_0021 > Smilemaker V
WS1_0022 > Mr Useful II
WS1_0023 > Choppy Go Lucky
WS1_0024 > Kris
WS1_0025 > Kris 3000
WS1_0026 > AP Kris
WS1_0027 > Reaper Kris
WS1_0028 > ACC Kris
WS1_0029 > Shadow Kris
WS1_0030 > Damascus Knife
WS1_0031 > Ea's Knife
WS1_0032 > Imanotsurugi
WS1_0033 > Carnwenhan
WS1_0034 > Azoth
WS1_0035 > Bronllavyn

WS2_0000 > TB-32/H
WS2_0001 > TB-32/Custom
WS2_0002 > TB-34/ET
WS2_0003 > TB-34/ED
WS2_0004 > TB-34/EC
WS2_0005 > TB-34/ES
WS2_0006 > Aftershadow
WS2_0007 > Aftershadow
WS2_0008 > Aftershadow - Gale Force
WS2_0009 > Aftershadow - Heat Haze
WS2_0010 > Aftershadow - Thunderclap
WS2_0011 > Aftershadow - Lightning Flash
WS2_0012 > Mimas
WS2_0013 > Mimas's Power
WS2_0014 > Daidara's Deathblow
WS2_0015 > Atlas's Disaster
WS2_0016 > Ymir's Pandemonium
WS2_0017 > Gyges's Catastrophe
WS2_0018 > Kannagi Mk 5
WS2_0019 > Kannagi Mk 7
WS2_0020 > Kannagi Neuwirth Mk 6
WS2_0021 > Kannagi Oldman Mk 8
WS2_0022 > Kannagi Kaczynski Mk 9
WS2_0023 > Kannagi Schneier Mk 11
WS2_0024 > Tebutje
WS2_0025 > Tebutje 5000
WS2_0026 > AP/AV Tebutje
WS2_0027 > Sadistic Tebutje
WS2_0028 > Mass Tebutje
WS2_0029 > Bludgeoning Tebutje
WS2_0030 > Caliburn
WS2_0031 > Excalibur
WS2_0032 > Green Dragon Crescent Blade
WS2_0033 > Durendal
WS2_0034 > Dáinsleif
WS2_0035 > Tyrfing

WS3_0000 > L-GE1
WS3_0001 > L-GE1 Custom
WS3_0002 > L-7E1/ET
WS3_0003 > L-7E1/ED
WS3_0004 > L-7E1/EC
WS3_0005 > L-7E1/ES
WS3_0006 > Exodus
WS3_0007 > Exodus 7500
WS3_0008 > AMW Exodus
WS3_0009 > Exodus Legion
WS3_0010 > Exodus Plus
WS3_0011 > Exodus Era
WS3_0012 > Gration
WS3_0013 > Motorized Gration
WS3_0014 > Goliath's Deathblow
WS3_0015 > Prometheus's Disaster
WS3_0016 > Bergelmir's Pandemonium
WS3_0017 > Briareus's Catastrophe
WS3_0018 > Moonshadow
WS3_0019 > Moonshadow
WS3_0020 > Moonshadow - Gale Force
WS3_0021 > Moonshadow - Heat Haze
WS3_0022 > Moonshadow - Thunderclap
WS3_0023 > Moonshadow - Lightning Flash
WS3_0024 > Holy Lance
WS3_0025 > Bleeding Lance
WS3_0026 > Honebami
WS3_0027 > Gungnir
WS3_0028 > Areadbhar
WS3_0029 > Gáe Bulg
WS3_0030 > Hyuga Mk 2
WS3_0031 > Hyuga Mk 3
WS3_0032 > Hyuga Neuwirth Mk 7
WS3_0033 > Hyuga Oldman Mk 4
WS3_0034 > Hyuga Kaczynski Mk 5
WS3_0035 > Hyuga Schneier Mk 10

 

[Skardale]

Dang. Now we just gotta compare files to see where the value are for to make it a late bloomer rank 1. And to do the modules.

 

[Sabishinbo]

Nice find.

 

[Skardale]

Nice find.

Are you by chance going to do research again on freedom wars?

 

[Rakidas]

Oh my god perfect, works beautifully Cool 3 mil of EP. Just had a thought- would this same process be applicable to God Eater 2 Rage Burst or Resurrection???

 

[CollosalPokemon]

Was kinda hoping this and the DLC trick would be kept quiet in case Freedom Wars 2 ever might have had a chance of happening. =/
Anyways the cat's out of the bag by now. Might as well share some additional info.

I'll say that with the DLC trick you can add pretty much any number of items using count= to your inventory, for example you can do

<Item id="SW_0041" count="50000"/>

and that will actually give you 50,000 Auto-Resuscitator +. This also works with any material(s) and civilians. note that the game will split the 50,000 into 50 slots of 999 (+ 1 slot of the remainder of 50000/999) so in order to receive all that you'll need that many item/material/civilian slots open!

Just had a thought- would this same process be applicable to God Eater 2 Rage Burst or Resurrection???

short answer:
No.

long answer:
The God Eater games encrypt their saves using a custom encryption (underneath vita's save encryption) so first off you'd have to decrypt the save completely (both vita's encryption and the custom encryption). they use a unique encryption so knowing how to decrypt vita saves in general isn't enough.
Then they have at least 1 MD5 protecting their save, which is a more secure hash than CRC32. so you also have that to deal with.
Then you'd have to re-encrypt the save back using the custom encryption.

side notes:
the long answer describes the "proper" way to modify God Eater saves. If you know assembly there is another option, which is to skip encrypting/decrypting the save and not check the MD5 sum(s) when loading. however, doing that would make original saves not work on the modified version (and vice-versa).
I'm personally not interested in cheating in the God Eater series. I love playing the game.

also:
Interestingly God Eater avatar cards are NOT encrypted (ie not beyond normal vita encryption) however they're protected with an MD5 as well.
If you want to check those out you can find them along with SECURE.BIN if you've been online and traded avatar cards. the names are CXX.bin where XX is 00~99 (in order of who you traded avatar cards with).

 

[liomajor]

There are nowadays more and more games with different checks to prevent cheating.

Ex. Sword Art Online Lost Song does have 8 Bytes to protect the saves integrity and a counter.

As long you can fix the check after manipulating the save, you are good to go.

Worst was what i've seen so far, console encryption + own encryption + crc for section parts.

Freedom Wars was annoying and bored me fast, i had more fun to fiddle with the save/dlc as playing it.

I ended up creating my own special DLC to finish the game.

  <MainWeapon id="WS2_0031" level="10" rarity="9">
     <Effector id="3"/><Effector id="3"/><Effector id="3"/>
     <Effector id="48"/><Effector id="48"/><Effector id="48"/>
     <Effector id="108"/><Effector id="108"/><Effector id="108"/>
     <Effector id="56"/><Effector id="56"/><Effector id="56"/>
   </MainWeapon>

Most likely i'll never play the game again and i guess there will be no Freedom Wars 2.

 

[Skardale]

There are nowadays more and more games with different checks to prevent cheating.

Ex. Sword Art Online Lost Song does have 8 Bytes to protect the saves integrity and a counter.

As long you can fix the check after manipulating the save, you are good to go.

Worst was what i've seen so far, console encryption + own encryption + crc for section parts.

Freedom Wars was annoying and bored me fast, i had more fun to fiddle with the save/dlc as playing it.

I ended up creating my own special DLC to finish the game.

  <MainWeapon id="WS2_0031" level="10" rarity="9">
     <Effector id="3"/><Effector id="3"/><Effector id="3"/>
     <Effector id="48"/><Effector id="48"/><Effector id="48"/>
     <Effector id="108"/><Effector id="108"/><Effector id="108"/>
     <Effector id="56"/><Effector id="56"/><Effector id="56"/>
   </MainWeapon>

Most likely i'll never play the game again and i guess there will be no Freedom Wars 2.

What does your custom dlc do? And does the codes make your weapon a random type for late, normal, early bloomer? And what is an effector?

Was kinda hoping this and the DLC trick would be kept quiet in case Freedom Wars 2 ever might have had a chance of happening. =/
Anyways the cat's out of the bag by now. Might as well share some additional info.

I'll say that with the DLC trick you can add pretty much any number of items using count= to your inventory, for example you can do

<Item id="SW_0041" count="50000"/>

and that will actually give you 50,000 Auto-Resuscitator +. This also works with any material(s) and civilians. note that the game will split the 50,000 into 50 slots of 999 (+ 1 slot of the remainder of 50000/999) so in order to receive all that you'll need that many item/material/civilian slots open!


short answer:
No.

long answer:
The God Eater games encrypt their saves using a custom encryption (underneath vita's save encryption) so first off you'd have to decrypt the save completely (both vita's encryption and the custom encryption). they use a unique encryption so knowing how to decrypt vita saves in general isn't enough.
Then they have at least 1 MD5 protecting their save, which is a more secure hash than CRC32. so you also have that to deal with.
Then you'd have to re-encrypt the save back using the custom encryption.

side notes:
the long answer describes the "proper" way to modify God Eater saves. If you know assembly there is another option, which is to skip encrypting/decrypting the save and not check the MD5 sum(s) when loading. however, doing that would make original saves not work on the modified version (and vice-versa).
I'm personally not interested in cheating in the God Eater series. I love playing the game.

also:
Interestingly God Eater avatar cards are NOT encrypted (ie not beyond normal vita encryption) however they're protected with an MD5 as well.
If you want to check those out you can find them along with SECURE.BIN if you've been online and traded avatar cards. the names are CXX.bin where XX is 00~99 (in order of who you traded avatar cards with).

Do you by chance no the id(s) to where items are/civilians? I've already beat the game and atm have to replay value.

 

[liomajor]

It creates Excalibur with high rate level and elements.

Sorry, i just edited and in the i didn't write them down.

 

[Skardale]

It creates Excalibur with high rate level and elements.

Sorry, i just edited and in the and didn't write them down.

So to make your own dlc you just make a code like yours into param file?

 

[liomajor]

Just use a valid DLC and edit it.

TITLEID = Games TitleID depending on Region
E = EUR, U for US
J can't conflict with real DLC

addcont_plain > TITLEID > E000100ITM00900J > sce_sys > param.sfo (EP9000-PCSF00446_00-E000100ITM00900J / TITLEID)

Edit "gift_setting.xml" with all items/stuff you want, claim ingame (no graphic, but it will work)

J used? Next is K and so on, HF.

 

[Skardale]

Just use a valid DLC and edit it.

TITLEID = Games TitleID depending on Region
E = EUR, U for US
J can't conflict with real DLC

addcont_plain > TITLEID > E000100ITM00900J > sce_sys > param.sfo (EP9000-PCSF00446_00-E000100ITM00900J / TITLEID)

Edit "gift_setting.xml" with all items/stuff you want, claim ingame (no graphic, but it will work)

J used? Next is K and so on, HF.

Awesome now I just got to find a dlc I haven't used unless I can name my own dlc id.....gah gonna have fun finding the code for the addons on the weapon for attributes like attack up HL, attack up L, etc


And civilians ugh

 

[CollosalPokemon]

Do you by chance no the id(s) to where items are/civilians? I've already beat the game and atm have to replay value.

I don't know many specific IDs but

for combat items it's SW_XXXX where XXXX is between 1 and 47
for materials it's RES_XXXXX where XXXXX is between 1 and 10080 (supposedly) although from what I've seen it seems more like between 1 and 600 or 700-ish.
for civilians it's CIT_XXXX where XXXX is between 0 and 41
for key items it's KEY_XXXX where XXXX is between 1000 and 2027 (WARNING: proceed with caution as these usually affect events!)

IMPORTANT: all use leading zeroes, so like if you want to try civilian 27 then the ID would be CIT_0027 (however many zeroes let the number match the number of Xs)

 

[Skardale]

I don't know many specific IDs but

for combat items it's SW_XXXX where XXXX is between 1 and 47
for materials it's RES_XXXXX where XXXXX is between 1 and 10080 (supposedly) although from what I've seen it seems more like between 1 and 600 or 700-ish.
for civilians it's CIT_XXXX where XXXX is between 0 and 41
for key items it's KEY_XXXX where XXXX is between 1000 and 2027 (WARNING: proceed with caution as these usually affect events!)

IMPORTANT: all use leading zeroes, so like if you want to try civilian 27 then the ID would be CIT_0027 (however many zeroes let the number match the number of Xs)

Hummmmm I love you xD anyway now once I get food in my belly I'll be motivated now! Ima try and map out all the numbers for items and stuff. Does savemgr work for cartridge freedom wars? Not dumped?

And do you know the location for items in inventory? And able to edit them? Like the weapon stats and attributes like attack up, damage to pod up, etc. I don't need the numbers for the corresponding attribute just location I'll figure out each one.

 

[CollosalPokemon]

Does savemgr work for cartridge freedom wars? Not dumped?

Don't know. My copy was digital.

Also I got those numbers from the game's code and while it seems those ranges are valid, not *every* ID inbetween those ranges is valid.
If you happen to try a non-existent ID, nothing is given to you (effectively nothing happens).

 

[Skardale]

Never mind. Someone on vita piracy beat me to it xD go look they have a good guide there.

 

[Skardale]

Ok having a problem. My entitlement points are 4757 so in hex that is 34373537....when I search for that says nothing found