Hacking Importing a SAV for a NES game from an emulator to your Virtual Consol

[9th_Sage]

I was wondering if anyone had ever tried to take a SAV file from an emulator and import it into their Wii save of the same game (in my case the first Legend of Zelda on the NES)? I dumped my save with Savegame Manager, and added the header present in the Wii save's SRAM to my sav, but just could not get it to work. It appears to me as though it should, but there must be something I'm missing. I'm hoping someone has tried it before and could give me a tip.

Yes yes, I know I could just use FCEUX, but that's not the point of me trying to do this.

 

[s3phir0th115]

While I haven't worked with NES saves due to using fceux, I have worked with getting a snes save and a few Nintendo 64 saves to virtual console titles. They may or may not apply to nes ones, but I can give you some information that applies for all of them.

In any case, you must know that simply copying your save to an SD card and editing that directly will not work. Your save is packed and encrypted with your wii's keys. In order to get these keys, you have to use something like xyzzy or bootmii. And you must use FE100 or the Unix tool it is based on to unpack your save with the keys. This same tool will allow you to pack saves once edited that will work on your wii.

Now, as for the save format themselves. The snes save was completely standard, and I was able to just copy it over and it would work with snes9x. (Well, I copied that FROM the wii. But I could have just as easily packed a save and sent it to the wii.)

The Nintendo 64 saves were a bit more difficult. For one thing, Nintendo 64 emulators will often byteswap game saves. Roms can also be byteswapped too. In order to get these saves on the wii, you usually will have to use a hex editor to byteswapped saves that are byteswapped. (I know it's confusing. It's the same action. Doing it will undo it if you did it before.)

Now Majora's Mask was more of a bitch for me. It needed to be byteswapped, but Nintendo's emulator also added a footer that made the save over twice as big. All this required was getting a hex editor and adding the same thing to a regular save, then copying.

Now, I doubt any NES saves would be complicated, but having not dealt with them specifically, I can't say for sure how they'll act. My prediction, would be just copying it over, and MAYBE adding padding. (What's confusing to me is that the snes save was smaller than the Nintendo 64 save, yet it had no padding at all.)

 

[9th_Sage]

Well, as I said, I got the save by using Save Manager (therefore it was unencrypted already). It looks as though the save from the Wii has a header, which I added, and there was an extra byte at the end I added to my save from the emulator as well as adding the header to it.

Must be something else I'm missing. It *does* look like it's the same as the save from the emulator on my PC that I was using (in a hex editor it looks to begin and end in the same way pretty much, except for that extra byte). Or I'm just doing something wrong. I ought to try it when it's not late at night again.

 

[s3phir0th115]

Well, as I said, I got the save by using Save Manager (therefore it was unencrypted already). It looks as though the save from the Wii has a header, which I added, and there was an extra byte at the end I added to my save from the emulator as well as adding the header to it.

Must be something else I'm missing. It *does* look like it's the same as the save from the emulator on my PC that I was using (in a hex editor it looks to begin and end in the same way pretty much, except for that extra byte). Or I'm just doing something wrong. I ought to try it when it's not late at night again.

I'm not quite sure you understand what all I said. I meant using the save manager to get the save on the SD card. The wii encrypts the save when it's placed on the SD card, to prevent modification. That's why you have to extract your wii's keys in order to modify the save using the PC tool.

Also, virtual console saves from the save manager don't just contain the save data from the emulator. They also contain the pictures used to make the animation you see when you select it in the menu. Actually, I'm fairly certain all saves have these animation pictures.

So simply appending your emulator save on and trying to make it copy won't work. You must also consider that the wii expects encrypted saves.

 

[9th_Sage]

So simply appending your emulator save on and trying to make it copy won't work. You must also consider that the wii expects encrypted saves.

No no, I mean Wanikoko's Save Manager application. It pretty much just copies/restores the files directly from NAND. It's similar to what you'd get from using FE100 on a save copied using the Wii's Data Management menu, but without the extra step of decrypting the save.

I do know what and how FE100 works. I used it a while back to 'rescue' a Conduit save that wouldn't copy back to my system. I used FE100 to get at the files and used Save Manger to copy it back.

 

[s3phir0th115]

So simply appending your emulator save on and trying to make it copy won't work. You must also consider that the wii expects encrypted saves.

No no, I mean Wanikoko's Save Manager application. It pretty much just copies/restores the files directly from NAND. It's similar to what you'd get from using FE100 on a save copied using the Wii's Data Management menu, but without the extra step of decrypting the save.

I do know what and how FE100 works. I used it a while back to 'rescue' a Conduit save that wouldn't copy back to my system. I used FE100 to get at the files and used Save Manger to copy it back.

Ahh, I understand. I was under the impression that you were trying to work with a .bin retrieved straight from the Wii System Menu save manager.

To make it simple, FE100 basically takes your wii's keys, and it is able to decrypt and unpack or encrypt and pack saves from a wii's who's keys it is given. I usually use it with the wii's save manager or ftpii if I want files straight from the nand.

Anyway, what files exactly came from waninkoko's save manager for this game?

Also, you mentioned a header for the file you believe is the save file. Have you also checked for a footer? As I mentioned with my experience with Majora's Mask's save, there was a huge footer filled with 0's that made the file twice as big as it needed to be, and I needed to add the same padding to my save before it would work.

 

[9th_Sage]

Ahh, I understand. I was under the impression that you were trying to work with a .bin retrieved straight from the Wii System Menu save manager.

To make it simple, FE100 basically takes your wii's keys, and it is able to decrypt and unpack or encrypt and pack saves from a wii's who's keys it is given. I usually use it with the wii's save manager or ftpii if I want files straight from the nand.+
Yeah, I know that's how it works.

It had savedata.bin, the banner, and the nocopy folder that apparently has the save state in it (for when you exit the game using the Wii Menu). I presume that because normally those don't appear to copy when you copy your save to SD (and it's in the nocopy folder). Also, it doesn't save the state when you exit by turning off the Wii. I did this before copying the save, and that file is completely blank, though it still exists in the nocopy folder.

QUOTEAlso, you mentioned a header for the file you believe is the save file. Have you also checked for a footer? As I mentioned with my experience with Majora's Mask's save, there was a huge footer filled with 0's that made the file twice as big as it needed to be, and I needed to add the same padding to my save before it would work.

Well, like I said, there was some sort of header (it had the game ID and such, FAKE in this case) and then something that appeared to look exactly the same as what the emulator's battery save looked like in hex. Well, not exactly since the save data is different, but the start of the sav file looked exactly the same as what came under this header, so I presumed that's where the extra data ended and the actual save began. As a test I ought to try that save in an emulator, actually, just to be sure (the one extracted from the Wii save data). There was a single extra byte at the end of the save also, which was 00. I also added this to mine, but it doesn't work. I was thinking though...it could be this header is something more. I wonder if they bothered to check the checksum or something? Nothing like that jumps out at me though.

 

[s3phir0th115]

Yeah, I know that's how it works.

Oh, just read it again. My apologies. That's what I get for staying up as late as I am. lol

It had savedata.bin, the banner, and the nocopy folder that apparently has the save state in it (for when you exit the game using the Wii Menu). I presume that because normally those don't appear to copy when you copy your save to SD (and it's in the nocopy folder). Also, it doesn't save the state when you exit by turning off the Wii. I did this before copying the save, and that file is completely blank, though it still exists in the nocopy folder.

Hmm.... Perhaps the savedata.bin is just an unencrypted form of what'd you get it if you copied it form the system menu's save manager? If so you might be able to extract that, repack it and then be in business. That would explain the header and such in the file.

I think this because in my work with rom injection and save editing on the wii's, .bin's are usually containers for other files. I think that's likely the case here because of the saves I have worked with, NONE of them had any headers or anything else except maybe padding. (And of course I had to normalize that data because Nintendo's emulator can't handle byteswapped N64 saves.)

QUOTE

Well, like I said, there was some sort of header (it had the game ID number and such) and then something that appeared to look exactly the same as what the emulator's battery save looked like in hex. Well, not exactly since the save data is different, but the start of the sav file looked exactly the same as what came under this header, so I presumed that's where the extra data ended and the actual save began. As a test I ought to try that save in an emulator, actually, just to be sure (the one extracted from the Wii save data). There was a single extra byte at the end of the save also, which was 00. I also added this to mine, but it doesn't work. I was thinking though...it could be this header is something more. I wonder if they bothered to check the checksum or something? Nothing like that jumps out at me though.

Yeah, I would suspect the .bin is a container for other files. Perhaps try U8 tool or something to extract it and see if that does it? Or maybe Fe100?

Also, saves from my experience don't even have file extensions. But they do have "RAM" in their name. (At least the n64 ones. I don't remember what exactly the snes one had.)

Of course I'm shooting a bit in the dark here. But that's what I'd try next.

Regarding the checksum theory, I've seen checksums used in the game content itself when I've worked with rom injection. When you're done packing certain files, you'd have to alter the tmd in a hex editor to make the checksum match the new one. (A find and replace action really, if you were smart and kept a checksum for the file pasted somewhere.) But I have no seen any such measures used in saves for VC games. I think Nintendo stopped at the encryption on those.

 

[9th_Sage]

Hm, yeah, I hadn't thought to try U8 on it (if that DID spit out the portion I think is the header and the save seperately, that would surely make things smoother). I should try that. Not tonight though. I have a bad case of insommnia tonight, I really should be in bed.