Homebrew How does .sav buffer overflow work?

  • Thread starter Thread starter _V1qY
  • Start date Start date
  • Views Views 1,304
  • Replies Replies 1

_V1qY

Well-Known Member
Member
Joined
May 31, 2012
Messages
138
Reaction score
36
Trophies
0
XP
176
Country
I know that you can use eepinator to extract the .sav of a game and put it back in but how do you modify it to contain code?

I know that a buffer overflow is required, for example the name of the player or something. But is there some kind of checksum which has to be assigned for .sav files? Because it isn't working for me.
 
Yes, in most cases games will apply checksums to their saves. These can vary greatly from game to game as far as I know, and you basically need to reverse engineer the game's binary to work out the checksum calculations for a particular game. Then you can write a program/script to apply that checksum to your save file, make the modifications you want to make, apply the checksums and the game should accept it.

But there are a few other things to consider:

(i) you need some way of monitoring the RAM of the DS in real time while loading the save so you can see what areas of RAM you are having an influence on. If you manage to achieve a crash, you need an exception handler to show you which instruction is crashing, so you can work out if the crash is exploitable or not. The closest thing I can think of is the Action Replay Trainer Toolkit, which can do the former (monitor RAM), but I don't think the later (handling exceptions). I don't know of anything for doing the later, actually. (Could possibly be done using NO$GBA's debugger, but that's not running on hardware, although in theory it should be the same; if you can get it working on the emulator, it should probably work on hardware)

(ii) DS save game exploits are pointless. For DS and DS Lite (and DS mode on DSi and 3DS), we already have homebrew execution via flash cards. There's no need for any alternative method, especially seeing as it would require a method for running homebrew to get the save onto the cart (or an R4i Save Dongle, which I believe is more expensive than a flash card anyway).
 

Site & Scene News

Popular threads in this forum