Hacking Homebrew Question about editing switch playtime

[funke_monke]

I am currently trying to edit the playtime info on my Switch. I recently reset my console and noticed that my user playtime has been out of wack. The system’s logs seem to contain only the data accumulated since the reset; however, on my user profile, it appears to keep only the past 20 titles’ info—any other games outside those 20 that I boot appear to have never been played. My understanding is that there are at least two places where these logs are stored: one that appears on my user profile and the other being within the system itself. There is only one user profile that matters, so the best-case scenario for me is that I can sync the two. This doesn’t seem to be widely discussed, so I have decided to post about it directly.

Through my research, it appears that there are two system folders of note: 8000000000000080 and 80000000000000F0 according to this post: https://gbatemp.net/threads/play-time-editor-switch-homebrew.660862/. One or both of these folders contains the file ‘playlog.bin’, which, according to JK_, should only be for information on my user profile: https://gbatemp.net/threads/modify-activity-log-is-possible.579118/. I was able to use JKSV to access some of the system saves; some were encrypted, and some were not. JKSV can dump all types of files, but I could not locate 80…080 or 80…0F0. I obtained my system keys to decrypt all of my encrypted files through NX NAND Manager; however, none of the encrypted files seemed to be the ones I wanted. According to this report (https://www.diva-portal.org/smash/get/diva2:1441718/FULLTEXT02), I might have been able to view and possibly edit these files through mounting a virtual drive on my computer, however my OS does not seem to support it; I could always try again on another computer though.

This is the extent of what I have tried, and I am asking for any help or guidance on what I can do next. I know that the NX Activity Log works; however, I would like this data to show on OFW for my purposes. I also had issues with the import JSON function, so I decided to ignore this program. I am not too worried about a ban, but this post indicates that it could be possible: https://gbatemp.net/threads/user-play-history-editing-deleting.523772/. However, earlier posts contradict this, so any clarification would be appreciated. I am new to Switch homebrew, so if you could include as much detail and guidance in your responses as possible, I would appreciate it.

 

[JK_]

Let me clear some stuff up: The file named playlog.bin, if I remember correctly, contains the times displayed when you view your user profile in account applet? It doesn't actually change the played times as far as I remember. That was a while ago. I do remember the format wasn't very difficult to figure out. I had all my play times maxed out to 999:99 or whatever it was, but that was before my dev Switch got banned.

 

[funke_monke]

Let me clear some stuff up: The file named playlog.bin, if I remember correctly, contains the times displayed when you view your user profile in account applet? It doesn't actually change the played times as far as I remember. That was a while ago. I do remember the format wasn't very difficult to figure out. I had all my play times maxed out to 999:99 or whatever it was, but that was before my dev Switch got banned.

Do you remember how you were able to edit it? You mentioned it was through the JKSV save editor, but I couldn't figure out how to do it. Also did you get banned for making that edit? Because if so, I might decide against it.

 

[JK_]

I just dumped the file and edited it in a hex editor, I think. I think you need to go into the settings and enable Show Account System Saves? It should show up then. I don't really know what got me banned. I was doing a lot of stuff back then that could have caused it.

 

[funke_monke]

Thanks. I don't know how I missed it the first time, but I found a file called 'playlog.v2.bin.' I was able to open it in a hex editor but it is just incoherent. I don't know if it is still encoded or if I just lack the skills to interpret it properly. I've tried hactools as a method of decryption, but it is not very intuitive and I can't seem to figure it out.

 

[JK_]

It's in binary. I don't know when I'll get to it. I need to charge my Switch and get it booted, but I'll take a look again. Give it a day or two. I'll figure it out.

Post automatically merged: Feb 21, 2025

Zero shits given about double posting. So, here's what I figured out (again) so far:

I remember editing one of those values changed the time displayed under my account applet profile way back. I don't remember which ones though. I might be wrong about the whole thing being a single data structure too. Seems odd to have the title ID twice if that's the case? Anyways, I tried dumping the same file from my other Switch (that can still go online), and interestingly enough, the file doesn't seem present on that one to compare with. Granted, I'm using rewrite JKSV which is far from finished or perfect at this point. If anyone wants to throw me theirs to see if I can figure anything else out. Feel free.

Gonna @funke_monke and hope they see this since the forum won't let me bump the thread.

 

[funke_monke]

It's in binary. I don't know when I'll get to it. I need to charge my Switch and get it booted, but I'll take a look again. Give it a day or two. I'll figure it out.

Post automatically merged: Feb 21, 2025

Zero shits given about double posting. So, here's what I figured out (again) so far:
View attachment 487306
I remember editing one of those values changed the time displayed under my account applet profile way back. I don't remember which ones though. I might be wrong about the whole thing being a single data structure too. Seems odd to have the title ID twice if that's the case? Anyways, I tried dumping the same file from my other Switch (that can still go online), and interestingly enough, the file doesn't seem present on that one to compare with. Granted, I'm using rewrite JKSV which is far from finished or perfect at this point. If anyone wants to throw me theirs to see if I can figure anything else out. Feel free.

Gonna @funke_monke and hope they see this since the forum won't let me bump the thread.

I really appreciate all the help you have given me so far. What program are you using there? From what I can tell, Time/stamp A refers to the date in Epoch time in which you first booted the game, and Time/stamp B is the time last played. I don't know why the ID would be there twice though, but it seems that the game is Selfloss from the ID. And unless you have played 46 million hours I don't know what Unknown B refers to. You have obviously played the game, so the time shouldn't be zero, unless you happened to delete it. In that case Unkown A could be time played. From what I can tell, the switch counts based on seconds, so any time data will be in that format. Thanks again for taking the time to help me with this!

 

[JK_]

I really appreciate all the help you have given me so far. What program are you using there? From what I can tell, Time/stamp A refers to the date in Epoch time in which you first booted the game, and Time/stamp B is the time last played. I don't know why the ID would be there twice though, but it seems that the game is Selfloss from the ID. And unless you have played 46 million hours I don't know what Unknown B refers to. You have obviously played the game, so the time shouldn't be zero, unless you happened to delete it. In that case Unkown A could be time played. From what I can tell, the switch counts based on seconds, so any time data will be in that format. Thanks again for taking the time to help me with this!

It's something I threw together quick to make reading and analyzing the file a bit easier. Looking at it in a hex editor, you can definitely make out the overall structure of it, but reading it all is another matter. I don't have anyway in the code to add menus to the windows yet, so I don't think throwing it out there as-is is the best idea. I'll fiddle with it some more when I can to see if I can make more sense of it. I just wish I knew why my other Switch doesn't seem to have the same file?

 

[funke_monke]

I have the receipts of my previous dumps of 8000000000000080, and that file is not there. As far as what I did from the first to last dumps, I manually deleted play activity through OFW, which does not do anything except aesthetically remove the info from the applet; every time you reboot a game, the original number of hours appears. I performed a NAND dump but didn't replace anything, dumped my title keys, and deleted and redownloaded most of my digital purchases. The 'v2' does not make sense to me, as I have never seen it online besides my file. Other than that, I cannot think of how it appears in the first place.

 

[JK_]

I'm just taking stabs at it. The last two are the timestamps for sure. They match what NX Activity Log is showing me. Looking at it closer, I'm starting to think Unknown B is actually two 32 bit values instead of one 64. Should have noticed that now that I'm looking at it.

Edit: Here's the end result. I'm pretty sure this only applies to the account/activity feed. I don't think I ever located where the system stores the actual logs.

I'm pretty sure the system stores the playtime in nanoseconds now. I'd have to do some hunting when I have time to find where the other logs are. They have to be stored somewhere. Even if it means terminating the process to get to it.

 

[funke_monke]

I'm just taking stabs at it. The last two are the timestamps for sure. They match what NX Activity Log is showing me. Looking at it closer, I'm starting to think Unknown B is actually two 32 bit values instead of one 64. Should have noticed that now that I'm looking at it.

Edit: Here's the end result. I'm pretty sure this only applies to the account/activity feed. I don't think I ever located where the system stores the actual logs.
View attachment 487347
I'm pretty sure the system stores the playtime in nanoseconds now. I'd have to do some hunting when I have time to find where the other logs are. They have to be stored somewhere. Even if it means terminating the process to get to it.

Wow. I can't thank you enough for your help with this. When you feel it is ready, I would really like to use your program myself. I have been looking for something like this from the beginning, and I'm sorry you had to make it yourself. Please let me know if there's anything I can do or provide you with to help you along.

AFAIK the other system logs could be within that SYSTEM folder from the NAND dump. I am by no means an expert, but it seemed like they couldn't be accessed through JKSV.

 

[JK_]

It's not implemented in the rewrite yet, but the master branch of JKSV has two ways to pull that off. The first is to turn off "Force Mount" in the settings and then terminate the process. The second is to terminate the process and then rescan titles, which wouldn't work in this case since I'm assuming the save is open in the account service and JKSV trying to rescan would immediately crash the system because of trying to use the account service after it's been terminated. JKSV has a lot of extra stuff and settings a lot of people don't know about. It's actually why rewriting it is more challenging than you'd think.

As for the app... I need to figure out how I want to tackle adding and handling menus first. It's not written in C#, Python, or something like that like most GUIs people write around here. It's written in C using win32 API. I can't just drag, drop, and double click shit to add it. Also navigating Microsoft's documentation is a nightmare sometimes. We'll see.

Edit: I wrote this quick script that more-or-less accomplishes the same thing. As for editing, we can worry about that later, or if/when I find where the system actually stores this information.

https://github.com/J-D-K/switch_playlog_viewer

 

[funke_monke]

It's not implemented in the rewrite yet, but the master branch of JKSV has two ways to pull that off. The first is to turn off "Force Mount" in the settings and then terminate the process. The second is to terminate the process and then rescan titles, which wouldn't work in this case since I'm assuming the save is open in the account service and JKSV trying to rescan would immediately crash the system because of trying to use the account service after it's been terminated. JKSV has a lot of extra stuff and settings a lot of people don't know about. It's actually why rewriting it is more challenging than you'd think.

As for the app... I need to figure out how I want to tackle adding and handling menus first. It's not written in C#, Python, or something like that like most GUIs people write around here. It's written in C using win32 API. I can't just drag, drop, and double click shit to add it. Also navigating Microsoft's documentation is a nightmare sometimes. We'll see.

Edit: I wrote this quick script that more-or-less accomplishes the same thing. As for editing, we can worry about that later, or if/when I find where the system actually stores this information.

https://github.com/J-D-K/switch_playlog_viewer

Thanks for this. I had to teach myself some basic Python and get some help from ChatGPT, but I've been able to use and understand the program. But from what you tell me, it wouldn't change anything, even if I can somehow edit playlog.v2.bin and then import 80...080 again through JKSV. I did see that it only includes 20 titles, which is a bummer because that tells me this isn't really what controls the timers. I don't know how you were able to edit your times in the first place because my assumption is that this file is only what appears visually, and another file dictates this one to tell it what to say. And I'm just guessing here, but if I do edit this file and upload it, it sounds like the system files will overwrite this one as soon as I play something, making this process pointless. Also, I don't really understand the intricacies of JKSV; all I know is that it can import and export files. But I don't think I will test this process if I don't know if it will work.

 

[JK_]

What I'm assuming is this: There's another save somewhere on the system that stores the "master" play log data if that makes sense. The system keeps it open the entire time it's running. That's why it doesn't show up in JKSV. I have an idea for how to locate it somewhat quickly. After that, it's pretty much cake work, for me at least.

 

[funke_monke]

What I'm assuming is this: There's another save somewhere on the system that stores the "master" play log data if that makes sense. The system keeps it open the entire time it's running. That's why it doesn't show up in JKSV. I have an idea for how to locate it somewhat quickly. After that, it's pretty much cake work, for me at least.

Is this 'master' playlog what you edited before? You mentioned previously that you had edited your playtime in the past. Also, I thought any and all modifications to switch system files would result in a ban. I don't know if such a modification would trigger telemetry.

 

[JK_]

Is this 'master' playlog what you edited before? You mentioned previously that you had edited your playtime in the past. Also, I thought any and all modifications to switch system files would result in a ban. I don't know if such a modification would trigger telemetry.

That was the file I edited. It seems to only do anything to the recent history displayed in the account profile page. The closest thing I've found is a file inside 80000000000000F0. It has files named PlayEvent.dat and BaseTimePoint.bin. I'm going to see what they do sometime during next week.

I'm working on an auction sniping program right now that is more time critical. If I don't get the changes done by tomorrow night, I'm not going to be able to bid on stuff with pinpoint, last second precision, and watch people rage and call me names while I laugh at them. I can't risk it. It's funny and saves me a ton of money.

 

[funke_monke]

That was the file I edited. It seems to only do anything to the recent history displayed in the account profile page. The closest thing I've found is a file inside 80000000000000F0. It has files named PlayEvent.dat and BaseTimePoint.bin. I'm going to see what they do sometime during next week.

I'm working on an auction sniping program right now that is more time critical. If I don't get the changes done by tomorrow night, I'm not going to be able to bid on stuff with pinpoint, last second precision, and watch people rage and call me names while I laugh at them. I can't risk it. It's funny and saves me a ton of money.

All good. Whenever you have time. I really appreciate all you have done.

 

[JK_]

Not sure if there's a point in releasing this. I'm not going to open source it beyond the python script I wrote earlier, but yeah, this is 100% for sure what I edited way back:

And, to go with it:

I don't see it as much more than a novelty. A novelty that might have the possibility of getting you banned. I mean, Nintendo can't say they know for 100% sure you never leave your house or know what the sun looks like, but yeah... I'll look into the other file later.

 

[funke_monke]

Within 80000000000000f0 is a file called 'playevent.dat', which I was able to extract with NxNANDManager and then run with the Python script at this link in Appendix E (https://www.diva-portal.org/smash/get/diva2:1441718/FULLTEXT02). There is also an NRO made by tallbl0nde called PlayEventParser, which dumps the same information in a TXT file instead. Both programs provide all data on your activity from first play, including timestamps, title ID, focus status, and more. Mine only contains info from 12/31/24, the date of my reset. I could edit this data and import it back, but since it contains thousands of lines, it is not feasible. I doubt a program that could edit this data exists or will ever exist, and even if I could edit and import it, there's always the risk of a ban, so I think I will call off my search here. The Switch 2 will come out soon too, so I hope that this data doesn't import over and I will be able to start fresh with a hopefully improved activity log. I might give another stab at editing the JSON from NxActivity Log but beyond that, I'm done. I appreciate your help through all of this though!

 

[Shadas]

Not sure if there's a point in releasing this. I'm not going to open source it beyond the python script I wrote earlier, but yeah, this is 100% for sure what I edited way back:
View attachment 488142
And, to go with it:
View attachment 488143
I don't see it as much more than a novelty. A novelty that might have the possibility of getting you banned. I mean, Nintendo can't say they know for 100% sure you never leave your house or know what the sun looks like, but yeah... I'll look into the other file later.

Will you plane to add remove function for titleID from playevent, if you will release it?