Hacking Hacking with 3DS Save DeEncrypter

[Immortal_no1]

Yeah, i'm not sure how useful that will be. At the moment, if people want to help out, see if you can find the starting locations of the files that you can see using "File Info" from the software's File Menu. once one of those is found, we can see where the locations are and then extraction of the files can begin.

 

[loco365]

I found something cool in my Samurai Warriors Chronicals save file (after using this tool) :

Something to do with loading a sound from the ROM (actually, there are around 3 more of these I was just too lazy to screencap them all)

I love how this is in plaintext. I doubt it's exploitable though, I'm sure KT is smarter than that simple text, still, it's pretty cool but there's no way for us to tell 100% for sure yet because modifying that means the CRC would change =P But I really doubt an exploit would come this early so I'm not expecting anything.

I think I know exactly what that is. I think it's referring to a file within the game, like the standard DS file format. So therefore, I have reason to believe that 3DS games run on a file format system like it's predecessors.

 

[CollosalPokemon]

I found something cool in my Samurai Warriors Chronicals save file (after using this tool) :

Something to do with loading a sound from the ROM (actually, there are around 3 more of these I was just too lazy to screencap them all)

I love how this is in plaintext. I doubt it's exploitable though, I'm sure KT is smarter than that simple text, still, it's pretty cool but there's no way for us to tell 100% for sure yet because modifying that means the CRC would change =P But I really doubt an exploit would come this early so I'm not expecting anything.

I think I know exactly what that is. I think it's referring to a file within the game, like the standard DS file format. So therefore, I have reason to believe that 3DS games run on a file format system like it's predecessors.

herp.

It's a sound file. My question: Why is a ROM instruction like that even in the save? (I know it has to instruct the ROM in some ways, so the game knows where you're at in the game, score, etc...)\
Sound should be handled by the ROM already knowing "After battle X, play sound Y." (or anywhere in the game it should know when to play sounds without instructions from the save file) I'm more confused as to why it's even in plaintext. I wonder if replacing it with something like "sd: /.files/xyz.3ds" would work instead of playing the sound =P That would be really funny, but I doubt developers that stupid in today's world.

 

[hergipotter]

Perhaps in this game you can choose a certain sound for a certain action (e.g. the sound that is played when you win a fight or something...) and this information has to be saved. But i don't know why it's in plain text.

 

[CollosalPokemon]

Perhaps in this game you can choose a certain sound for a certain action (e.g. the sound that is played when you win a fight or something...) and this information has to be saved. But i don't know why it's in plain text.

There are actually like 3-4 plaintext sound commands, but they're not changeable in-game. I have the game and there's no option for changing the sounds. (there's options for changing volume for bgs and etc but not the actual sounds)
I don't understand why it would reference something like that to the ROM, much less why it's saved in plaintext either, and even lesser why Koei Tecmo didn't catch it. Maybe they assumed everything was OK just because of the XOR encryption put on the saves ?
I've been finding XOR is a really crappy encryption everywhere I go.

EDIT: Other pics like the one I posted previously

^ I dunno but it seems this one is encrypted, so why didn't the other 3 end up encrypted? Was KT lazy/assumed the others were encrypted/safe?

 

[Immortal_no1]

3DS Save De/Encrypter v1.5a is now available

v1.5a -Checksum data for all checksums found so far, load decrypted save from Experimental menu.

Download

 

[CollosalPokemon]

3DS Save De/Encrypter v1.5a is now available

v1.5a -Checksum data for all checksums found so far, load decrypted save from Experimental menu.

Download

After using this on Samurai Warriors Chronicles here's a log of the experimental menu:

http://www.mediafire.com/?kj8ty164oo6id7h

 

[pachura]

It's a sound file. My question: Why is a ROM instruction like that even in the save?

I bet it is some junk leftover that happened to be in the memory area allocated for the savegame before it was written to the SD card. This happens quite often when you allocate memory for a structure but do not clear it.

 

[how_do_i_do_that]

A game would reference any DLC like that and store the info in the save space for a related save state/slot.

 

[Immortal_no1]

It's a sound file. My question: Why is a ROM instruction like that even in the save?

I bet it is some junk leftover that happened to be in the memory area allocated for the savegame before it was written to the SD card. This happens quite often when you allocate memory for a structure but do not clear it.

I quite agree.

There is also a possibility that it could be used to determine different sound themes for title sequences, i don't know if there is anything like that on the game, but it's a possibility.
It's most likely though a log file stored to EEPROM of recent actions. I wouldn't be surprised.

 

[Arisotura]

Hey Immortal_no1, great job on figuring out those checksums, now it'd be nice if you could add the info to 3dbrew or put it up somewhere so that everyone can access it.

 

[FireGrey]

I found something cool in my Samurai Warriors Chronicals save file (after using this tool) :

Something to do with loading a sound from the ROM (actually, there are around 3 more of these I was just too lazy to screencap them all)

I love how this is in plaintext. I doubt it's exploitable though, I'm sure KT is smarter than that simple text, still, it's pretty cool but there's no way for us to tell 100% for sure yet because modifying that means the CRC would change =P But I really doubt an exploit would come this early so I'm not expecting anything.

I think I know exactly what that is. I think it's referring to a file within the game, like the standard DS file format. So therefore, I have reason to believe that 3DS games run on a file format system like it's predecessors.

herp.

It's a sound file. My question: Why is a ROM instruction like that even in the save? (I know it has to instruct the ROM in some ways, so the game knows where you're at in the game, score, etc...)\
Sound should be handled by the ROM already knowing "After battle X, play sound Y." (or anywhere in the game it should know when to play sounds without instructions from the save file) I'm more confused as to why it's even in plaintext. I wonder if replacing it with something like "sd: /.files/xyz.3ds" would work instead of playing the sound =P That would be really funny, but I doubt developers that stupid in today's world.

Someone should test that out.
Although i bet that you would have to patch xyz.3ds with the common key..

 

[Shuji1987]

Someone should test that out.
Although i bet that you would have to patch xyz.3ds with the common key..

I'm not sure if that's neccessary. Just try to figure out what triggers the rom to execute that file from the save and possibly replace that with a simple hello world by standards of the NDS format (or heck, even replace it with all sort of things, pictures, MPO's, music or a similair file to check if it can actually run off SD). We have no idea how the 3DS works in that aspect we still have a lot to figure out and everything is comming in small little steps.

Though with limited coding experience I'm not sure if it works that way either let alone if Nintendo would allow NDS code to run in 3DS mode (or if you can access the SD card at all with that game).

Actually, I'm not sure where to begin, but if I would have a copy of that game I'd try a thing or two.

Maybe I'll look into getting one.

 

[ichichfly]

Perhaps in this game you can choose a certain sound for a certain action (e.g. the sound that is played when you win a fight or something...) and this information has to be saved. But i don't know why it's in plain text.

There are actually like 3-4 plaintext sound commands, but they're not changeable in-game. I have the game and there's no option for changing the sounds. (there's options for changing volume for bgs and etc but not the actual sounds)
I don't understand why it would reference something like that to the ROM, much less why it's saved in plaintext either, and even lesser why Koei Tecmo didn't catch it. Maybe they assumed everything was OK just because of the XOR encryption put on the saves ?
I've been finding XOR is a really crappy encryption everywhere I go.

EDIT: Other pics like the one I posted previously

^ I dunno but it seems this one is encrypted, so why didn't the other 3 end up encrypted? Was KT lazy/assumed the others were encrypted/safe?

this is only what I think what happend I have/can not check if it is true

easy they allocated some memory lets say 100 byte now they write data to this but only to the first 50 bytes and write the 100 byte to the save than the rest of the buffer is uninited so the data that was written to this before it get allocated and in this case someone has written the path to it before it get allocated or they allocated less than they write to the save.

 

[Arisotura]

One possible reason of the name of a sound file ending up in the save is that the game was playing a certain sfx/music/ambience sound at the time the player saved, and wants to resume said sound when the player resumes their game...

 

[PolloDiablo]

I made that icon

 

[Yu-Gi-Oh 100]

ok what im i supposed to do with this?

 

[Immortal_no1]

I made that icon

"That icon" has nothing to do with "My Icon" or user picture, completely different, don't add anything to the thread unless it's relevant please.

 

[Immortal_no1]

ok what im i supposed to do with this?

You extract your gamesave from your cartridge using a NDS ADAPTER PLUS or something similar, then using this application you decrypt the game save so that it can be interrogated.

Hopefully soon we can re-CRC the data and play with modified gamesaves and swap regions of gamesave

 

[Immortal_no1]

Has anyone had any luck modifying gamesaves with the new Checksum information?