ROM Hack Question [REQUEST] Ys VIII save editor

[Yomiichi]

bump

 

[Kazelle]

need +1 thx

 

[Tere Valentin]

Mega bump

 

[Nazosan]

Another bump. I have an idea though. Why not compare two exact same saves made one right after the other? The only difference at all should be the time -- all items and skills and all would be the same (and extra should be close. Best if it's at 100% so it doesn't change.) Then you know everything going into the checksum except time is the same. Wouldn't that make narrowing it down easier?

 

[Slade.AU]

Another bump. I have an idea though. Why not compare two exact same saves made one right after the other? The only difference at all should be the time -- all items and skills and all would be the same (and extra should be close. Best if it's at 100% so it doesn't change.) Then you know everything going into the checksum except time is the same. Wouldn't that make narrowing it down easier?

That won't work. There may be a random seed or console specific seed or something used to determine the checksum of the save file. You'd be better off trying to reverse engineer the game itself to determine how the save file is generated / written.

Does anyone know if the PC version uses the same save file as the Switch ?
If not, I can have a look using noexs on the Switch and see what I can come up with. It's just....slow. Frustratingly slow. And unstable too. Which is a shame. It'll be nice when USB dumping works.

 

[ctrlaltdelete]

Another bump. I have an idea though. Why not compare two exact same saves made one right after the other? The only difference at all should be the time -- all items and skills and all would be the same (and extra should be close. Best if it's at 100% so it doesn't change.) Then you know everything going into the checksum except time is the same. Wouldn't that make narrowing it down easier?

https://gbatemp.net/threads/request-ys-viii-save-editor.509657/page-2#post-8200042
https://gbatemp.net/threads/request-ys-viii-save-editor.509657/page-2#post-8202634

Does anyone know if the PC version uses the same save file as the Switch ?
If not, I can have a look using noexs on the Switch and see what I can come up with. It's just....slow. Frustratingly slow. And unstable too. Which is a shame. It'll be nice when USB dumping works.

This was briefly discussed on page 1 (posts 4, 6-15). It doesn't look like the saves are compatible, though Misledz seems to think it might be due to version differences.

 

[novalkun]

i also used sysnetcheat. i was not able to find any value at all. i give up

 

[Slade.AU]

i also used sysnetcheat. i was not able to find any value at all. i give up

Perseverance is they key...

Edit: Fire trucking picture won't upload... And I can't remove the old ones. WTF...

 

[novalkun]

Perseverance is they key...

Edit: Fire trucking picture won't upload... And I can't remove the old ones. WTF...

can you edit exp or health?

 

[Slade.AU]

can you edit exp or health?

I haven't looked yet.
I might grab someone's save from this thread and inject that and have a go at fiddling with that save. They'll likely be a lot further down the game than I will, and will have a lot more unlocked. Larger and odd (not odd vs even, but non generic) numbers usually make things easier to find.

 

[ctrlaltdelete]

Wow, great job!

There are items that can be used to raise your XP, level and stats (including health), so if finding XP and health is too difficult then you could just give yourself 999 XP/level/stat boosters.

Would you mind sharing how to fix the checksum with us? We already have the offsets for most of the inventory items (attached file of post #27), so the checksum is all that's stopping us right now.

 

[Slade.AU]

Wow, great job!

There are items that can be used to raise your XP, level and stats (including health), so if finding XP and health is too difficult then you could just give yourself 999 XP/level/stat boosters.

Would you mind sharing how to fix the checksum with us? We already have the offsets for most of the inventory items (attached file of post #27), so the checksum is all that's stopping us right now.

My guess is that health / XP aren't integers, but probably floats or doubles, hence why they're hard to find (or impossible at this stage).
I didn't edit the save file. I have no idea how the checksum is calculated. It's not any of the standard ones that I've seen before, and may well be a unique calculation specific to this game. As I mentioned earlier, reverse engineering the game and watching how it saves might provide more insight into that, however I don't read nor understand ARM cpu instructions. I've done a bit of x86 hacking, but not to this level. I also don't believe there is a debugger available yet, so that's not going to happen for a while.

I edited the items in memory using Noexs. People have a habit of searching once, not finding anything and giving up. A number of the items aren't stored 32bit aligned, so I used a 16bit search, which yielded a few results, that made it much easier to narrow down to the right one.
When I find time, I'll inject one of the saves here, and use that to search, and hopefully repeat the process, editing the items to 999 for each one. If someone has a save that has most items unlocked / in the inventory they would like to donate, then I can happily try that.

 

[ctrlaltdelete]

When I find time, I'll inject one of the saves here, and use that to search, and hopefully repeat the process, editing the items to 999 for each one. If someone has a save that has most items unlocked / in the inventory they would like to donate, then I can happily try that.

My saves (attached) have all of the items in the inventory except for the key items you can only get 1 of. 001 is in a Dana section and 002 is just before climbing Gendarme iirc. Do you think you could give the 001 file 999 Tempest Elixers, Power Elixers, Defense Elixers and Life Elixers? On Infinity Nightmare the Dana-section bosses are huge damage sponges that kill you in 2-3 hits and grinding Dana in that dungeon is incredibly tedious.

 

[novalkun]

My guess is that health / XP aren't integers, but probably floats or doubles, hence why they're hard to find (or impossible at this stage).
I didn't edit the save file. I have no idea how the checksum is calculated. It's not any of the standard ones that I've seen before, and may well be a unique calculation specific to this game. As I mentioned earlier, reverse engineering the game and watching how it saves might provide more insight into that, however I don't read nor understand ARM cpu instructions. I've done a bit of x86 hacking, but not to this level. I also don't believe there is a debugger available yet, so that's not going to happen for a while.

I edited the items in memory using Noexs. People have a habit of searching once, not finding anything and giving up. A number of the items aren't stored 32bit aligned, so I used a 16bit search, which yielded a few results, that made it much easier to narrow down to the right one.
When I find time, I'll inject one of the saves here, and use that to search, and hopefully repeat the process, editing the items to 999 for each one. If someone has a save that has most items unlocked / in the inventory they would like to donate, then I can happily try that.

I thought 8,16,32 bit would be not much different. I also just realised that yesterday when searching in zelda botw that some value would be in different bit. I'll try look for some

 

[Slade.AU]

I thought 8,16,32 bit would be not much different. I also just realised that yesterday when searching in zelda botw that some value would be in different bit. I'll try look for some

It makes a huge difference. Lets make a few assumptions about a random game. It has an inventory system that uses a byte value (max different items 255) for the item type and a byte value for any specialities on that item and then 2 bytes to store the number of said item, and lets also assume the game checks to a max of 999 of any one item.
It would mean the data could be store as such:
01 01 E7 03 - Item 01 (hey, it's Milk), 01 - Plain , E7 03 (Little endian on arm CPUs), so decimal 999.

If you were to search for a 32 bit value of 999, you'd be searching for 00 00 E7 03, which is not going to show up in this instance.
Which is why working out the data type is important. If you fail when finding a 32 bit item, search for a lower item. Then lower again, if you can. Some games may limit you to a max of 99 items (63 in hex), which is a single byte or 8 Bits.
Bigger isn't always better

I hope that helps. Back to work. Will look at the saves, in a few hours.

 

[novalkun]

It makes a huge difference. Lets make a few assumptions about a random game. It has an inventory system that uses a byte value (max different items 255) for the item type and a byte value for any specialities on that item and then 2 bytes to store the number of said item, and lets also assume the game checks to a max of 999 of any one item.
It would mean the data could be store as such:
01 01 E7 03 - Item 01 (hey, it's Milk), 01 - Plain , E7 03 (Little endian on arm CPUs), so decimal 999.

If you were to search for a 32 bit value of 999, you'd be searching for 00 00 E7 03, which is not going to show up in this instance.
Which is why working out the data type is important. If you fail when finding a 32 bit item, search for a lower item. Then lower again, if you can. Some games may limit you to a max of 99 items (63 in hex), which is a single byte or 8 Bits.
Bigger isn't always better

I hope that helps. Back to work. Will look at the saves, in a few hours.

Thank you. Now i understand. I thought the bit was related to the value. So it is related to the address

 

[Slade.AU]

Thank you. Now i understand. I thought the bit was related to the value. So it is related to the address

It's the size of the data.
8 Bit = 1 Byte or 00 to FF
16 Bit = 2 Bytes or 00 00 to FF FF
32 Bit = 4 Bytes or 00 00 00 00 to FF FF FF FF

Then you have floats and doubles, which just get a little more confusing when trying to show them as integers.... So we'll skip that for now.

If you search for bytes, you're going to get a lot more results than searching for other data lengths. If you have 4 potions, and you're searching through memory, every single 04 is going to show as a result, no matter what it's surrounded by. However, if you search for a 32 bit value and you have 4 potions, only those results that look like 00 00 00 04 will return a result.

At this rate, we'll have you hacking games in no time

 

[Wierd_w]

I thought 8,16,32 bit would be not much different. I also just realised that yesterday when searching in zelda botw that some value would be in different bit. I'll try look for some

It is wasteful of memory to store a value that never goes above 999 as a 32bit integer. (you can easily store that in a 16bit integer!)

Rule of thumb:

0 to 255 (Or, -127 to 128 signed) == 8 bit
0 to 65535 (or, -32767 to 32767 signed) == 16bit
0 to ~4million (or, -2million to 2 million signed) == 32bit

For floats, the magic sauce is the number of significant digits. I forget the exact details, but most floats will be single float, unless they are storing values for things like physics calculations.

Considering that the game caps the item number register at 999, we can safely assume that it is 16bit integer. Experience points is likely to be 32bit though.

Typically, item data in memory is stored in a data structure, the structure of which can help you find it, even with layout randomization. Sometimes there are unique character strings (like "bone"), or even character name (Adol), that can help you find the structure.

I never bothered to pick up the fancier debugging / injecting code into the game to cause stuff to happen type skills here, but the concept is similar. Locate appropriate memory (in this case, by tracing stack pointers and pals), then scribble on top of it using your memory editor tool. Doing that can cause the game to stop doing certain things, like decrementing Adol's health, etc. (as the code that handles that gets replaced with a no-op and return, or similar. )

For just putting stuff into your inventory, finding and documenting the memory structure would be sufficient.

 

[Slade.AU]

Well, shit...
I haven't been able to restore a save on this game.
EdiZon crashes on backup and Checkpoint crashes on restore...

Anyone know of a way to restore a save file ? I might have to override my original save, after making a backup and see if that works.

Edit: Ok, the latest checkpoint seems OK at restoring the save.
Woohoo. Now to start testing if the save works.

Edit2: Well shit... The save linked above won't load due to a lack of DLC... Let me find that now...

@ctrlaltdelete
Edit3: Please let me know what DLC are in use in that save file. I believe I've managed to "source" all the DLC, but don't want to install stuff you may not have access too or willing to purchase (if you're running a legit copy of the game).

 

[ctrlaltdelete]

@Slade.AU I have all the free DLC that's included in the switch version + the 2 free sets available from the e-shop. For clarity they're called:

Silver Armor
Deserted Pirate Adol/Laxia/Sahad/Hummel/Ricotta/Dana
Tropic Swimwear Adol/Laxia/Ricotta/Dana
Eternian Scholar
Hug Hug Feena/Lilia/Dark
Stylish Glasses Set
Stylish Sunglasses Set
Ancient Mask Set
Free Set 1
Free Set 2

Yeah, I'm indeed running a legit copy.

Thanks so much for this.