ROM Hack Research: SNES virtual console save files

[k1r92]

Hello! I originally posted this months ago on reddit.com/r/3dshacks

I'm hoping to get some more helpful eyes to look at this.

There is a 48 byte header appended to SNES virtual console saves extracted from 3DS and WiiU.

An extracted SNES virtual console save contains 4 files. .cfg, .vea, .ves and .vew

.cfg is a configuration file.
.vea is a resume point for the emulator to load.
.ves is a file that contains the actual save data.
.vew is the save state (if any)

If you open up a .ves file in a HEX editor, you can see that Nintendo appends 48 hex bytes before the actual save file. I've dumped a bunch of virtual console saves and tried to make sense of the 48 bytes...


START SIZE DESCRIPTION
0x00 0x2 Always 0x0100
0x02 0x2 checksum-16 little endian, decrease first byte down a single hex value
0x04 0x2 game preset ID
0x06 0x2 Always 0x0000
0x08 0x5 Always 00's on 3DS. Different for each WiiU vc game? [why though?!?]
0x0d 0x3 Always 0x000000
0x10 0x8 Always 0xC13586A565CB942C [why though?!?]
0x18 0x2 save size kb little endian
0x1a 0x2 Always 0x0000
0x1c 0x4 changes 0x???????? [why though?!?]
0x20 0x10 Always 0x00000000000000000000000000000000

I'm stumped for bytes 28-31 (start 0x1c). Perhaps more encryption? A timestamp?

If any of my research is unclear, or if anyone has a question, let me know and I can try to explain/elaborate.


EDIT: Did some testing. Here's how to add the correct 48-byte header to an SNES save to get it working on a N3DS.

1. Append a 48 byte header (all 0's) to the beginning of your save file.
2. Change the 1st byte of the header to 0x01
3. Change the 5th and 6th bytes to the game's preset id. (ex. EarthBound = 6E10, Super Metroid = 4010, etc)
4. Change bytes 17-24 to 0xC13586A565CB942C
5. Generate a Checksum-16 for the entire save file. Reverse the byte order and decrease the first byte down a single hex value. Add to the save file as 3rd and 4th byte.
6. Make sure your save file is named properly. The name is based off the serial/product code. So for Earthbound, my save file would be named 'KTR-UAEE.ves'
7. Import your save (a folder containing ONLY a .ves) using JKSM and it should properly appear when you boot the game.

Here are some examples for altering the checksum-16 to be correct,
if the checksum is 470F, the value we add to the save file would be 0E47.
checksum-16 '470F' -> '0E47' new value
checksum-16 'B1D5' -> 'D4B1' new value
checksum-16 '6120' -> '1F61' new value


Notes: still confused about the following
START SIZE DESCRIPTION

0x08 0x5 Always 00's on 3DS. Different for each WiiU vc game? [why though?!?]
0x10 0x8 Always 0xC13586A565CB942C [why though?!?]
0x18 0x2 save size kb little endian
0x1c 0x4 changes 0x???????? [why though?!?]

I don't currently have my WiiU set-up so I haven't been able to do any testing regarding Start 0x08, Size 0x5. Perhaps someone can do some testing?
Not entirely sure what 0xC13586A565CB942C does, but it is absolutely needed.
The save size isn't needed. I've been able to get my saves working without setting it.
Start 0x1c, Size 0x4. Always changing when a save is made. However, doesn't seem to be needed. Can be turned to 00's.​

 

[Zidapi]

Interesting stuff, thanks for the work you put in

 

[raphamotta]

This is great I tried while ago to edit the save to work both on wiiu and 3DS and no luck. Thanks for that. IIRC on wiiu is easier to get the 3DS save working.

 

[alnt88]

Thanks for working on this. I've been trying for a long time to figure out how to import snes vc saves and I couldn't find this info anywhere else. I was having trouble getting the correct checksum, but I downloaded a program called HxD and it has the option for the checksum-16. Finally got it to work.

 

[Klavice Gavin]

So I tried this and it didn't work. I'm trying to transfer my SoK from my Earthbound file on SNES9x which was originally on the 3DS VC and want to transfer the Snes9x SRM save back to the N3DS VC so I can use the Sword of Kings in my file without having to grind the weapon again from those damn Starman Supers.

 

[Miketb101]

I was a bit lost on step 5, since it's a bit unclear for me. On HxD, how would I generate the Checksum-16 and reverse the byte order, also altering that Checksum-16?

 

[0bvious]

Did anyone ever program a way to automate this? I am no programmer, but I imagine it wouldn't be too tricky to mock up an automated method in .bat format

 

[Azazel8073]

Complicated directions for people who do not know how to hex edit and wanting to import save to 3ds.

I was able to export my save, open save with hex editor, copy everything from 0x30 onward and save as .srm so that I can edit save file through PC emulation but for someone who knows nothing about hex editing, these directions for importing are very complicated.

If anyone can give a better explanation that would be great. I'm trying to import my Breath of Fire 2 save data because it's been forever since I played the game and skipped getting ChopChop and really do not want to go back and start over.

Any help would be greatly appreciated.

 

[suaviant]

Hi there guys. I want to thank kl192 for this research.

I successfully used this method to convert my FFVI SNES srm to a 3DS ves file and restored it. It worked and I was able to carry on my game on my new 3ds.

I kept screwing up by adding 48 hex bytes as the header (48 in hex = 72 in decimal) accidentally because I didn't notice which radio button was set in HxD. Once I fixed that mistake the method worked.

I'm working on a tool to automate the process as its time consuming and easy to mess up. It will be nothing special but I will post it when its done.

My motivation is down since some attacks in FFVI seem to lag on new 3ds and the sound screws up a bit, so I've restarted my game on the GBA version. Still I'm sure it will be handy for someone.

 

[EddieEddie90]

Hi there guys. I want to thank kl192 for this research.

I successfully used this method to convert my FFVI SNES srm to a 3DS ves file and restored it. It worked and I was able to carry on my game on my new 3ds.

I kept screwing up by adding 48 hex bytes as the header (48 in hex = 72 in decimal) accidentally because I didn't notice which radio button was set in HxD. Once I fixed that mistake the method worked.

I'm working on a tool to automate the process as its time consuming and easy to mess up. It will be nothing special but I will post it when its done.

My motivation is down since some attacks in FFVI seem to lag on new 3ds and the sound screws up a bit, so I've restarted my game on the GBA version. Still I'm sure it will be handy for someone.

Did you actually completed this tool? I'd like to know because I have a ton of srm save files I'dl like to restore on my VC games.

 

[ChokingVictim87]

Did you actually completed this tool? I'd like to know because I have a ton of srm save files I'dl like to restore on my VC games.

Im dying to get my snes earthbound save onto my 3DS VC one...

 

[Neville_Shorttop]

Im dying to get my snes earthbound save onto my 3DS VC one...

I'm working to make a tool that would automate the process. If you would like, send me your save file and I can convert it for you.

 

[mossywell]

Just picking this up as I'm keen to get a savegame.bin converted to a VES file. (I assume there is still no tool out there to do that?!) What I have is a valid VES file grabbed from the game just to make sure I'm doing the checksum OK. Unfortunately, I'm not. A couple of questions:
1. When it says "the whole file", presumably it means from the 4th byte (the preset ID)? I've tried from byte 48 as well but can't get it to match the actual checksum in the file.
2. Is is a plain 16 bit checksum (add up all the words and then do a modulus 65536 on it), or it is some other checksum (such as 2s compliment, CRC etc)?
3. Any XOR with magic numbers?

Thanks

EDIT: solved
It is not a 16 bit checksum (as in the checksum of 2-byte words). It is the sum of all the bytes starting from position 0 (so the first byte) assuming that the two checksum fields are 0 (which avoids the circular checksum issue asked by Miketb101), modulus 0x10000 minus 1. IOW, it's more like an 8-bit checksum (without 2s compliment) mod 16 bits (minus 1 at the end). Then just LE it.

EDIT2: Will post code later today when I have had a chance to test it.

 

[mossywell]

It works: I converted a savegame.bin to a ves file, overwrote the ves file from an earlier backup, restored it and the save was there and working. Here is the code:

https://github.com/mossywell/PS5-Convert-WiiVCSavegame2WiiUVCSavegame

 

[ZTylerDurden]

It works: I converted a savegame.bin to a ves file, overwrote the ves file from an earlier backup, restored it and the save was there and working. Here is the code:

https://github.com/mossywell/PS5-Convert-WiiVCSavegame2WiiUVCSavegame

This worked marvelously with my FFVI language mod inject SRM to VES (WiiU). If you're injecting, whichever "basegame" you're using, use those ID's for the script.

Make sure to power off the WiiU in-game so it doesn't create a save point restoration because it was overwriting the VES created by the script.

 

[Duplino]

This worked marvelously with my FFVI language mod inject SRM to VES (WiiU). If you're injecting, whichever "basegame" you're using, use those ID's for the script.

Make sure to power off the WiiU in-game so it doesn't create a save point restoration because it was overwriting the VES created by the script.

I tried using this script, but ran into a problem when finding the SNES ROM name for Shin Megami Tensei.

I guess because it isn't an official ROM, it isn't on the list you provided, so I tried looking at the .srm in HxD and couldn't find anything that resembled the ROM names in the list.
I even downloaded a Super Metroid .srm to have a look for the example ROM name and couldn't find it, so what could I be doing wrong?

 

[Sceptre]

I hope this doesn't count as necro-posting, but in examining the save files used for some NES games on the Virtual Console that use the .ves/.vea format (on the Wii U, but probably 3DS too), I've come across some findings of my own that I think would be helpful to be recorded somewhere:

First, as mentioned on r/3dshacks some years ago, bytes 0x08 to 0x0c of any .ves save actually correspond to the date and time of the snapshot/savestate. So, if these bytes were (to give this Earthbound Beginnings save as an example) 0x1008060c13, that corresponds to a date time of 12:13pm on August 6, 2016.

Now, onto the NES-specific details: a NES .ves save has a 32-byte header (as opposed to 48 bytes). As far as I can tell, bytes 0x00 to 0x0f are identical in purpose to SNES VC saves. Certainly, the checksum generation method for 0x02 and 0x03 (i.e.: add all the bytes except the checksum, xor 65536, subtract one, then swap the bytes) is the same. I strongly suspect 0x04 and 0x05 also correspond to the GameCode/Preset ID (also little-endian) of the game but I have no way of verifying.

The other half of the header is different. In the NES .ves saves that I've seen, these sixteen bytes are the same: 0x0c0001102000002d5352414d2000. I'm not sure if bytes 0x10 through 0x17 make up a magic number like for SNES .ves saves, but as far as 0x18 to 0x1f are concerned… well, I don't think it's a coincidence at all that 0x5352414d, when converted to ASCII, spells "SRAM".

I hope this is helpful to those who are still working away at the VC coalface.