How does .sav buffer overflow work?

Discussion in 'NDS - Emulation and Homebrew' started by _V1qY, Nov 2, 2012.

  1. _V1qY

    _V1qY GBAtemp Regular

    May 31, 2012
    I know that you can use eepinator to extract the .sav of a game and put it back in but how do you modify it to contain code?

    I know that a buffer overflow is required, for example the name of the player or something. But is there some kind of checksum which has to be assigned for .sav files? Because it isn't working for me.
  2. SifJar

    SifJar Not a pirate

    Apr 4, 2009
    Yes, in most cases games will apply checksums to their saves. These can vary greatly from game to game as far as I know, and you basically need to reverse engineer the game's binary to work out the checksum calculations for a particular game. Then you can write a program/script to apply that checksum to your save file, make the modifications you want to make, apply the checksums and the game should accept it.

    But there are a few other things to consider:

    (i) you need some way of monitoring the RAM of the DS in real time while loading the save so you can see what areas of RAM you are having an influence on. If you manage to achieve a crash, you need an exception handler to show you which instruction is crashing, so you can work out if the crash is exploitable or not. The closest thing I can think of is the Action Replay Trainer Toolkit, which can do the former (monitor RAM), but I don't think the later (handling exceptions). I don't know of anything for doing the later, actually. (Could possibly be done using NO$GBA's debugger, but that's not running on hardware, although in theory it should be the same; if you can get it working on the emulator, it should probably work on hardware)

    (ii) DS save game exploits are pointless. For DS and DS Lite (and DS mode on DSi and 3DS), we already have homebrew execution via flash cards. There's no need for any alternative method, especially seeing as it would require a method for running homebrew to get the save onto the cart (or an R4i Save Dongle, which I believe is more expensive than a flash card anyway).