Hacking Help! regarding reading win32diskimager formatted mSD card

[juins]

The proper way to recover that save file would be:
1. Make a new save file on a different card and remember the save file's header (first 4 or so bytes)
2. Create a raw disk image of the card you're trying to recover data from.
3. In the resulting disk image file, do a binary search for the header you got from step 1. It should be sector-aligned - meaning it starts at an address divisible by 512.
4. Read from the start of the header you found in step 3 to whatever the size of the new save file was in step 1 - there's your recovered save file.
That's the gist of how to do it. You will need to use a hex editor of your choice for steps 3 & 4. Note that if your save file has already been overwritten by something or was fragmented (unlikely) you're out of luck.

how would i make a raw image? do u suse win32diskimager for that? also, when u say "the save files header" do u mean its filesize? in this case, 512kb, ergo, 524,288 bytes?

 

[npbg6464]

how would i make a raw image? do u suse win32diskimager for that? also, when u say "the save files header" do u mean its filesize? in this case, 512kb, ergo, 524,288 bytes?

Yeah, you can use win32diskimager to make an image of the card. By header, I mean the first few bytes of the file. You can see them if you open the file in a hex editor. For instance in a .bmp, the first 2 bytes are "BM", or in a .jpg the first 3 are 0xFFD8FF. Save files usually have their own 'magic number' at the beginning, but they're different for each game, so a typical file recovery software won't help you find them.

 

[juins]

Yeah, you can use win32diskimager to make an image of the card. By header, I mean the first few bytes of the file. You can see them if you open the file in a hex editor. For instance in a .bmp, the first 2 bytes are "BM", or in a .jpg the first 3 are 0xFFD8FF. Save files usually have their own 'magic number' at the beginning, but they're different for each game, so a typical file recovery software won't help you find them.

hmm, i will try this out tommorow, hopefully i can get this savegame again. im not too into hex editors, but HAVE fiddled around with them in the past. so, to summarize,
i open the image with a hex editor and look for an entry with the header i previously confirmed with another savegame for that same game on another microsd card.

 

[npbg6464]

hmm, i will try this out tommorow, hopefully i can get this savegame again. im not too into hex editors, but HAVE fiddled around with them in the past. so, to summarize,
i open the image with a hex editor and look for an entry with the header i previously confirmed with another savegame for that same game on another microsd card.

Yeah it's kinda like this - for instance, if the save file of your game starts with the value 0x12345678 and then continues for 512KB, by scanning the entire sd card image for 0x12345678, you will be able to locate your save file, even though the file table has been wiped when the card was formatted.
One last tip - if you're getting too many matches, try searching the image with a larger portion of the header. E.g., if your save file starts with 0x123456789abcde, and you're searching the image with 0x12345678 and getting too many matches, try the search with the entire 0x123456789abcde string. The header you find should start at an address that's divisible by 512, if it's not, it's a false match.

 

[juins]

Yeah it's kinda like this - for instance, if the save file of your game starts with the value 0x12345678 and then continues for 512KB, by scanning the entire sd card image for 0x12345678, you will be able to locate your save file, even though the file table has been wiped when the card was formatted.

no re-formatting neccesary?

 

[npbg6464]

no re-formatting neccesary?

Definitely not. With any additional writes you make to the sd card, you risk wiping the data you're trying to recover for good. The golden rule for file recovery is make a raw image right away.

 

[juins]

Definitely not. With any additional writes you make to the sd card, you risk wiping the data you're trying to recover for good. The golden rule for file recovery is make a raw image right away.

thanks for your time. ill post my results tommorrow. appreciate it.

 

[npbg6464]

`

thanks for your time. ill post my results tommorrow. appreciate it.

No prob, good luck!

 

[juins]

`

No prob, good luck!

i found a copy of a very early savefile from KH 3d, here´s a screenshot, so first 5 bytes read "04 00 00 00 01". Im still limited to doing this until tomorrow, dont have that mSD card on me, but maybe u can check if i got the theory of it ok,




so, if im on point atm, I..

-Ctrl+F on opened mSD img inside hex editor
- search for "04 00 00 00 01", choosing datatype: Hex values
-should pop up supposedly.

But after doing that, u say, "read" from the start of the header, but i still dont understand that step #4. I also dont know how to output the data to an actual .sav file. sorry for bothering so much, im so close now

 

[Cyan]

for step 4:
Place your cursor in front of the first matching byte
[HERE] 04 00 00 00 01 00 00 00 AE 02 C4 .....

then select : Edit > Select Block > select the "Length" radio button > set the size to 80000 > select Hex radio button > Select OK
it will select 512K of data

now Copy (CTRL+C, or edit>copy)
create a new file (file > new)
paste (CTRL+V, or edit>Paste insert)
Save the new file to 000400000008D300.sav

 

[juins]

for step 4:
Place your cursor in front of the first matching byte
[HERE] 04 00 00 00 01 00 00 00 AE 02 C4 .....

then select : Edit > Select Block > select the "Length" radio button > set the size to 80000 > select Hex radio button > Select OK
it will select 512K of data

now Copy (CTRL+C, or edit>copy)
create a new file (file > new)
paste (CTRL+V, or edit>Paste insert)
Save the new file to 000400000008D300.sav

Thank u both npbg6464 and Cyan. Will post tommorrow.
npbg6464 and Cyan

 

[juins]

for step 4:
Place your cursor in front of the first matching byte
[HERE] 04 00 00 00 01 00 00 00 AE 02 C4 .....

then select : Edit > Select Block > select the "Length" radio button > set the size to 80000 > select Hex radio button > Select OK
it will select 512K of data

now Copy (CTRL+C, or edit>copy)
create a new file (file > new)
paste (CTRL+V, or edit>Paste insert)
Save the new file to 000400000008D300.sav

save data is corrupted after doing all that. But i couldnt find a string as long as the one u wrote, cyan. 04 00 00 00 01 00 00 00 AE 02 C4.
i could only find something up to 04 00 00 00 01. did everything else u said, a on startup, game cries that data is corrupeted. Options?

EDIT: i can find the file ending though. The exact same string at the end of the savegame i already have can be found in all the data. can i use this to my advantage?

 

[Cyan]

I only copied the beginning of your save file you posted as picture.
It doesn't mean that this is what you needed to find. Your save is probably different.
the start should be the same "04 00 00 00 01 00 00 00", but the next part can change.

It's also possible that 04 and 01 are different. it could be 08 00 00 00 02 00 00 00
I don't know if this header is per game or per save.


If you had different saves on your card (even deleted ones), it's possible you didn't find the correct game's save data.
If you had only one .sav (you played only one game since you had gateway/R4i/Link flashcart), and your new file start with 04 00 00 00 01 00 00 00 etc. and is exactly 512KB (last byte is at position 0x7FFFF), and still doesn't work then your are probably unlucky.
Could you post your save file here? we can take a look.

 

[npbg6464]

save data is corrupted after doing all that. But i couldnt find a string as long as the one u wrote, cyan. 04 00 00 00 01 00 00 00 AE 02 C4.
i could only find something up to 04 00 00 00 01. did everything else u said, a on startup, game cries that data is corrupeted. Options?

EDIT: i can find the file ending though. it ends in the exact same way as the sav file i already have. can i use any of this to my advantage?

A string like 04 00 00 00 01 00 00 00 will probably give you a lot of false matches. Make sure that that string you found in your image starts at an address divisible by 512, if it doens't, it's definitely a false match.
Also, as Cyan said, the header value for this game might actually differ on every save. At this point the best thing to do would be to make 2 new saves on a different card, each progressed to a different point in the game, and compare which parts of the headers are the same for both saves.
If you can upload 2 different save files for this game, I can tell you what's a good string to search for.

 

[juins]

A string like 04 00 00 00 01 00 00 00 will probably give you a lot of false matches. Make sure that that string you found in your image starts at an address divisible by 512, if it doens't, it's definitely a false match.
Also, as Cyan said, the header value for this game might actually differ on every save. At this point the best thing to do would be to make 2 new saves on a different card, each progressed to a different point in the game, and compare which parts of the headers are the same for both saves.
If you can upload 2 different save files for this game, I can tell you what's a good string to search for.

ok, give me 15 minutes

 

[juins]

A string like 04 00 00 00 01 00 00 00 will probably give you a lot of false matches. Make sure that that string you found in your image starts at an address divisible by 512, if it doens't, it's definitely a false match.
Also, as Cyan said, the header value for this game might actually differ on every save. At this point the best thing to do would be to make 2 new saves on a different card, each progressed to a different point in the game, and compare which parts of the headers are the same for both saves.
If you can upload 2 different save files for this game, I can tell you what's a good string to search for.

ok here u go: #2 is like 5 minutes more into the game. Heres hoping u can help me further, thanks again for your time, waiting on you now.

EDIT: btw, ending string of #2 is now different, and that same string CAN NOT be found on my mSD img. Weird thing is, #1´s ending string CAN be found.

 

[Cyan]

The first 512 bytes are perfectly identical, and even matching your previous picture.
If looking for the hex value "0400000001000000AE02C4D8740F0F0F" didn't returned result, your save is probably corrupted.

 

[npbg6464]

Well the two saves are actually identical for the first 500 or so bytes, but you said that you couldn't find a match even within the first 10 bytes. Let's try to confirm that the save file is still even on the sd card at all.

Edit: you mentioned that you found a match at the end of the save file. How many bytes matched? You can try recovering from [the end of the save minus 512KB] to the end of the save that you found.

Edit2: search your disk image for exactly 0F 0F 0F 0F 0F 0F 0F FF FF FF FF. If that can't be found, you're out of luck.

 

[juins]

the first 512 bytes are

The first 512 bytes are perfectly identical, and even matching your previous picture.
If looking for the hex value "0400000001000000AE02C4D8740F0F0F" didn't returned result, your save is probably corrupted.

perfectly identical, and even matching your previous picture.

yes but, it cant be found on the mSD img, only up to 04 00 00 00 01 00 00 00, in other words, if i add "AE" like in the savegame, nothing is found.

 

[juins]

Well the two saves are actually identical for the first 500 or so bytes, but you said that you couldn't find a match even within the first 10 bytes. Let's try to confirm that the save file is still even on the sd card at all.

Edit: you mentioned that you found a match at the end of the save file. How many bytes matched? You can try recovering from [the end of the save minus 512KB] to the end of the save that you found.

Edit2: search your disk image for exactly 0F 0F 0F 0F 0F 0F 0F FF FF FF FF. If that can't be found, you're out of luck.

0F 0F 0F 0F 0F 0F 0F FF FF FF FF WAS Found. 1 match.
Also, the matching data from #1 and msD image are the last 17 lines of data in #1. i dont know how u guys read bytes but its ..

-00524016 to 00524072
-length of 272.

i dont know how to do that "recover from [the end of the save minus 512KB] to the end of the save that I found."

This is all very impressive and educational for me, the way u guys can read this type of data. Waiting on u again.

Is there any way to send u all this hex data? 2gb is too big, but if there was someway just to send over hex data your way and maybe check it out for yourself..