Hardware GCN MemCard Recover

[GerbilSoft]

I Played a japanese GC game and accidentally saved on my real memory card, and the Card was corrupted, i formatted it, lucky, the only save i lost is from Tomb Raider: Legend, others saves i already had a backup, but the program can't find Tomb Raider Legend save when i search for lost files, is this game on database?

This game is not in the database. If you can send me a full dump of the card with the deleted save, and a known good save, I can add it and attempt to restore the file.

Sidenote: Saving a JPN save file should *not* result in the card getting corrupted. Worst case is that it ends up setting the encoding field to Shift-JIS, which will make US/EU systems *think* it's corrupted, but is easily dealt with using GCMM and the like. (Copy files off of card, reformat, restore files.)

Also, I'm currently adding a few editors to GCN MemCard Recover. I'm implementing a Sonic Adventure DX save file editor (based on SASave by MainMemory), as well as a hex editor. Other editors may be added later on.

 

[Leo Alves]

This game is not in the database. If you can send me a full dump of the card with the deleted save, and a known good save, I can add it and attempt to restore the file.

Sidenote: Saving a JPN save file should *not* result in the card getting corrupted. Worst case is that it ends up setting the encoding field to Shift-JIS, which will make US/EU systems *think* it's corrupted, but is easily dealt with using GCMM and the like. (Copy files off of card, reformat, restore files.)

Also, I'm currently adding a few editors to GCN MemCard Recover. I'm implementing a Sonic Adventure DX save file editor (based on SASave by MainMemory), as well as a hex editor. Other editors may be added later on.

Here's my latest full dump, it is after the corruption, the only save i couldn't recover was from Tomb Raider Legend:
https://drive.google.com/uc?export=download&id=0B3v61S2zNpCGM1p2endzbTVRYVE

I think it encoded the Card to Shift-JIS, as you said, because before i reformatted the card, the only save file left was from the japanese game

 

[gukid]

First of all, thank you so much for the program! Like a few others, I played a Japanese game and wasn't reading the prompts properly, and it formatted my memory card for the Japanese region. I didn't even realize until I tried playing a US game, and then realized that I had potentially lost 14 years worth of Gamecube savegames...

I did a raw dump, and using the MCRecover was able to recover almost everything on the card, minus a few games that you've already mentioned aren't supported yet (Twilight Princess, Mario Kart).

There are a couple others missing that I was hoping to be able to recover: Baten Kaitos Origins, and Fire Emblem: Path of Radiance (which I was right in the middle of my first playthrough...) Are these not yet included in the database? Or are they affected in the same way as TP and Mario Kart?

I should probably mention that when I loaded Fire Emblem and received the message about the memory card being formatted for a different region, I let it format it for the NA region, and it created a new Fire Emblem savegame. I assume that this would have probably overwritten something at the beginning of the file system, but I can't tell what that would have been. Being that there is a new save present on the card, would that prevent MCRecover from displaying the older deleted savegame?

If you can possibly help me out, I can provide save backups, raw dumps, whatever you need!

 

[gukid]

Actually, I just found the xml database file, and I have quite a few games that aren't in the db yet. I also just discovered the feature in the program where you can get an xml search template for an existing save. I'll try creating new saves for any games that aren't present in the database, and add the generated xml to the database to test.

 

[GerbilSoft]

If a save has actually been overwritten, then MemCard Recover won't be able to find it. You should still be able to find saves from other areas of the card.

I haven't done much work on MemCard Recover recently (been doing ROM Properties Page stuff), but if you have save files that aren't present in the current database, you can send them to me and I'll add them in. (The XML template function provides a basic template; for most files, you will still need to manually add variables, which are somewhat documented in an example file.)

For the games that you haven't been able to recover: If you send me the card dump plus known-good GCIs, I can recover them for you. (This includes manual recovery of the unsupported save files like Mario Kart.)

 

[gukid]

It's one of the 1024 block cards, so I imagine the chances of it having overwritten something I want are pretty low, but I understand that this would cause that particular data to be unrecoverable.

I've created some xml entries for a bunch of other games that were missing, which appear to be working. Other than Fire Emblem, Mario Kart and Twilight Princess, I think that may cover everything I've lost (at least everything that I own or can remember playing). I'll send you the xml templates I've generated so you can add them (they may need some tweaks.)

If you're willing to take a look at recovering those last 3 saves, I'll definitely put together some good GCI's along with my raw memory card dump. Should I just email it to you?

Thanks again! You rule!

 

[Zonta85]

@GerbilSoft i see that only few games are in the database for PAL. I have tons of them, Can i send you a Memory card raw backup?

 

[GerbilSoft]

@GerbilSoft i see that only few games are in the database for PAL. I have tons of them, Can i send you a Memory card raw backup?

Sure, you can send me some PAL memory card dumps. I'm still working on some Nintendont and rom-properties stuff, but I might as well get back to mcrecover this weekend as well.

 

[Zonta85]

Sure, you can send me some PAL memory card dumps. I'm still working on some Nintendont and rom-properties stuff, but I might as well get back to mcrecover this weekend as well.

Perfect i Will send you a raw backup of my 64 MB Memory card that has a Lot of games inside when i Will be at home. Are .gci files for single saves ok too?
Because i Can download them from some sites, in this way it Will be easy to increase both PAL and NTSC databases.

 

[GerbilSoft]

I've had problems with GCIs uploaded to various sites before. Among other things, some of them are region-swapped, which works fine for use as a save file, but it doesn't contain the proper information for recovery.

 

[Zonta85]

I've had problems with GCIs uploaded to various sites before. Among other things, some of them are region-swapped, which works fine for use as a save file, but it doesn't contain the proper information for recovery.

Understand. I Will upload only mine then.

 

[Maq47]

@GerbilSoft
I believe I found the relevant checksum code of Yu-Gi-Oh! The Falsebound Kingdom USA.
In the linked image, r28 (special purpose register #28) is the current region of the save that is currently loaded into RAM. r29 is 0x0200, and 800d2354's instruction adds that to the current address (in r28). The "st? rX, 0x00YY (r28)" instructions are adding the ?, where ? is either b (byte) or h (halfword (a halfword is 2 bytes, but considering you made the mcrecover program, I assume you know this, so this is for the 'average' users here)) at current address (stored in r28) + an offset of 0x00YY bytes, and stores it in register X. The 'lbz' instructions are doing the same thing, except they are zeroing the upper 2 bytes of the register afterward (Gamecube/Wii registers are 32-bit).

Image.

The .gci header is stored in 2 locations in RAM: 803ee4e0 and 803f04e0. The save itself is read from 2 locations in RAM as well, with only the first one seems to be used in calculating the checksum: 801bcad0 and 803faa90.

I could be wrong (I still consider myself a noob hacker), but I believe that this subroutine is the key to cracking the checksum for this game.

All of this was done using the Dolphin 4.0 DebugFast build from the SmashBoards Forums (search for 'Dolphin DebugFast 4.0 Emulator' on Google). The game runs super slow in this emulator build, so for plain memory searches I use the latest Dolphin build available with the '-d' flag in Command Prompt.

 

[Maq47]

@GerbilSoft
I believe I found the relevant checksum code of Yu-Gi-Oh! The Falsebound Kingdom USA.
In the linked image, r28 (special purpose register #28) is the current region of the save that is currently loaded into RAM. r29 is 0x0200, and 800d2354's instruction adds that to the current address (in r28). The "st? rX, 0x00YY (r28)" instructions are adding the ?, where ? is either b (byte) or h (halfword (a halfword is 2 bytes, but considering you made the mcrecover program, I assume you know this, so this is for the 'average' users here)) at current address (stored in r28) + an offset of 0x00YY bytes, and stores it in register X. The 'lbz' instructions are doing the same thing, except they are zeroing the upper 2 bytes of the register afterward (Gamecube/Wii registers are 32-bit).

Image.

The .gci header is stored in 2 locations in RAM: 803ee4e0 and 803f04e0. The save itself is read from 2 locations in RAM as well, with only the first one seems to be used in calculating the checksum: 801bcad0 and 803faa90.

I could be wrong (I still consider myself a noob hacker), but I believe that this subroutine is the key to cracking the checksum for this game.

All of this was done using the Dolphin 4.0 DebugFast build from the SmashBoards Forums (search for 'Dolphin DebugFast 4.0 Emulator' on Google). The game runs super slow in this emulator build, so for plain memory searches I use the latest Dolphin build available with the '-d' flag in Command Prompt.

I was wrong.

3 registers are used for the checksum itself, I'll call them by variable names x, y, and z. Variable z will contain the actual checksum once it is fully calculated. There is also an accumulator (variable c) that tells the how many 16-bit values have currently been added, and when the accumulator goes over 0x08A8, then it is compared against the checksum in the save file, which is stored in r8 before this subroutine happens.
The current save offset is in r9, and will be referred to as addr (note that the word 'addr' is in bold here!)
Items inside square brackets ( [ or ] ) refer to the values that are located at that address offset.
For example, "[addr + 0x0410] = x" means 'store the value at the address (addr + 0x0410) in register x'.

Checksum is calculated as follows:

1. addr = 0x4440
2. set c, x, y, and z to zero
3. [addr] = y
4. c + 8 = c
5. [addr + 0x2] = x
6. (y XOR z) + z = z
7. [addr + 0x4] = y
8. (x XOR z) + z = z
9. [addr + 0x6] = x
   
10. (y XOR z) + z = z
11. [addr + 0x8] = y
    
12. (x XOR z) + z = z
13. [addr + 0xA] = x
    
14. (y XOR z) + z = z
15. [addr + 0xC] = y
    
16. (x XOR z) + z = z
17. [addr + 0xE] = x
    
18. (y XOR z) + z = z
19. addr + 0x10 = addr
    
20. (x XOR z) + z = z
21. IF c ≤ 0x08A8 THEN GOTO step 3 ELSEIF addr ≥ 0x55A0 THEN branch to next subroutine

 

[GerbilSoft]

I'll take a look at implementing that algorithm into MemCard Recover.

EDIT: I'm not sure about some of the steps listed - it seems you use left-hand assignment for a few of them, e.g. [addr + 0xE] = x; but then for others, you use right-hand assignment, (y XOR z) + z = z. Can you clarify these?

 

[Maq47]

I'll take a look at implementing that algorithm into MemCard Recover.

Also, for step 4, "c + 8 = c"; did you mean "c = c + 8"?

They mean the same thing. I usually put the new value on the right for simplicity.

 

[GerbilSoft]

They mean the same thing. I usually put the new value on the right for simplicity.

Okay, I'll keep that in mind.

 

[eduall]

MOH Rising sun isnt in the db, my Mcard emulation was corrupted. i lost my last savegame but with cheats can replay the mission. thanks for this tool !

 

[TheSocialZombie]

Will this program fix my Nintendont virtual memory cards? 'Cuz whenever I make a new virtual card, it comes out corrupted and needs a fix, so I just load melee to format it. I just want a way to fix the memory card without having to play melee again. If this doesn't work for virtual memory cards, then I'll just get a GameCube bios so I can format the card.

 

[Toasty813]

Hey, this program you made could save all my childhood memories but I just can't get it to show up on The Homebrew Channel. I've downloaded all the links on both a USB and SD card but nothing pops up. If you could respond and help me I would really appreciate it!

 

[Maq47]

Hey, this program you made could save all my childhood memories but I just can't get it to show up on The Homebrew Channel. I've downloaded all the links on both a USB and SD card but nothing pops up. If you could respond and help me I would really appreciate it!

Use this homebrew and backup the card as raw, then use his PC program:
https://gbatemp.net/download/gcmm.30942/

Edit: Just extract the apps folder to your SD card.

Edit 2: also, I'm pretty sure you needed to run ctr-gcs linked in the OP on your Wii, not his memcard recovery tool (that runs on a Windows PC only)