As some of you are aware, there may be an exploit releasing for this game soon. I've purchased a copy of RPGMaker: Fes as well as the player (all 3 regions of the player), and realized there was a lot of potential for the game. I also noticed there was an active online community for it, and also should note that the USA/EUR/JPN servers are separated, much like the game Zelda: Tri Force Heroes.
I'm a bit worried that the servers for this game could get pulled or die after the exploit comes out, so this is an attempt to preserve as many of the games currently up on the servers as possible.
So, I will be documenting some information in this post/thread, and perhaps in the future I might also create a tool that will take the decrypted save (all.dat, maybe anything else related to the save) and allow people to edit their name and manage projects saved to their system, so people can share them here/some other dedicated website.
For anyone who wants to help preserve the games currently on the website, here is what you should do for now:
1) Download 16 games using RPGMaker Fes Player of any region, keeping in mind that USA, EUR, and JPN all have their own separate servers of games.
2) Using Decrypt9, navigate to "Content Decryptor Options -> SD File Options -> SD Decryptor (SysNAND dir) [EmuNAND if you use that])" Wait a little bit until it prompts you to use your arrow keys.
3) Using your D-pad, press up/down/left/right to navigate to /extdata/00000000/<region titleID high> and then press the A button to decrypt it.
**So for example, if I were using the JPN version of RPGMaker Fes Player, I'd go to /extdata/00000000/000019ED
4) Your decrypted project files should now be exported to SD:/files9/extdata/. Back this up to your PC and delete it (just the one you decrypted to the /files9/ folder) off your SD card
5) Delete all the projects in-app (or maybe it works directly deleting from the /Nintendo 3ds/ folder? I haven't tested) and then repeat this process for another 16 more projects... and back up as many as you can.
In time, someone (maybe me?) will find out how the save structure works, and then we'll be able to rip/manage/study all of the projects as we have them preserved.
Anyway, I just wanted to get this thread going for discussion early just as a pre-caution (I'll have more time this weekend). I'm hoping people will try to preserve as many of the games on the server as possible, backing up several copies of their (NAND-decrypted) /Nintendo 3ds/ folder for the downloaded projects before they're no longer possible to download, and hopefully the data found in this thread could eventually lead to customized RPGMaker mods, too.
The rest of the post below this text is just various findings as I study the game's save structure
----------------------------------------
The TitleIDs for the RPGMaker Fes Games:
USA: 00040000001BD500
EUR: 00040000001B9D00
JPN: 000400000018B300
The TitleIDs for the RPGMaker Fes Players:
USA: 00040000001BD400
EUR: 00040000001BAE00
JPN: 000400000019ED00
----All Data below were the findings from using the EUR Fes Player----
The save file, all.dat, seems to store your player name data from 0x2A through 0x45 as a unicode string, making a total of 14 western-alphabet characters
I've found that the project files downloaded off the internet are stored at SD:\Nintendo 3DS\<3dsID1>\<3dsID2>\extdata\00000000\<regional-titleid-high>\00000000\
The first eight bytes (72 74 6B 30 38 30 35 61) of all.dat seem to spell "rtk0805a" though I am unsure if this is the same for all of the saves. I'll have to do more testing on this later... Maybe it serves as a kind of Magic Number/header?
The rest of all.dat, besides 0x4C-0x4E, seem to be entirely filled with 00, all the way up to 0x703. I have yet to find any way to change these values (so I'll have to do more testing for this too)
Deleting all.dat doesn't seem to delete the projects.
I seem to have found at least one project's name, using Decrypt9 to decrypt SD:\Nintendo 3DS\<3dsID1>\<3dsID2>\extdata\00000000\<regional-titleid-high>\00000000\00000006.file. My slot 3 game's title shows up as a unicode string, and starts at 0x401C... I suspect the null terminator is at 0x404E/0x404F, represented as 0x5400. The author's name immediately follows, ranging from 0x4080-0x40A7
In my decrypted SD:\Nintendo 3DS\<3dsID1>\<3dsID2>\extdata\00000000\<regional-titleid-high>\00000000\00000003.file, slot 1's name appears at 0xA01C-0xA07F. The author's name ranges from 0xA080-0xA0A7.
Noticing a pattern between the two, the Project header (assuming we start from 0) seems to go something like this:
0xC-0x3F: Project name
0x70-0x97: Product Name (People seem to use this as an author field?)
(somewhere in-between should be the Create time, but I haven't found the pattern yet. I assume it's converted from seconds in hex)
0xA4-0xA6: Used Memory, represented in little-endian hex
I'm a bit worried that the servers for this game could get pulled or die after the exploit comes out, so this is an attempt to preserve as many of the games currently up on the servers as possible.
So, I will be documenting some information in this post/thread, and perhaps in the future I might also create a tool that will take the decrypted save (all.dat, maybe anything else related to the save) and allow people to edit their name and manage projects saved to their system, so people can share them here/some other dedicated website.
For anyone who wants to help preserve the games currently on the website, here is what you should do for now:
1) Download 16 games using RPGMaker Fes Player of any region, keeping in mind that USA, EUR, and JPN all have their own separate servers of games.
2) Using Decrypt9, navigate to "Content Decryptor Options -> SD File Options -> SD Decryptor (SysNAND dir) [EmuNAND if you use that])" Wait a little bit until it prompts you to use your arrow keys.
3) Using your D-pad, press up/down/left/right to navigate to /extdata/00000000/<region titleID high> and then press the A button to decrypt it.
**So for example, if I were using the JPN version of RPGMaker Fes Player, I'd go to /extdata/00000000/000019ED
4) Your decrypted project files should now be exported to SD:/files9/extdata/. Back this up to your PC and delete it (just the one you decrypted to the /files9/ folder) off your SD card
5) Delete all the projects in-app (or maybe it works directly deleting from the /Nintendo 3ds/ folder? I haven't tested) and then repeat this process for another 16 more projects... and back up as many as you can.
In time, someone (maybe me?) will find out how the save structure works, and then we'll be able to rip/manage/study all of the projects as we have them preserved.
Anyway, I just wanted to get this thread going for discussion early just as a pre-caution (I'll have more time this weekend). I'm hoping people will try to preserve as many of the games on the server as possible, backing up several copies of their (NAND-decrypted) /Nintendo 3ds/ folder for the downloaded projects before they're no longer possible to download, and hopefully the data found in this thread could eventually lead to customized RPGMaker mods, too.
The rest of the post below this text is just various findings as I study the game's save structure
----------------------------------------
The TitleIDs for the RPGMaker Fes Games:
USA: 00040000001BD500
EUR: 00040000001B9D00
JPN: 000400000018B300
The TitleIDs for the RPGMaker Fes Players:
USA: 00040000001BD400
EUR: 00040000001BAE00
JPN: 000400000019ED00
----All Data below were the findings from using the EUR Fes Player----
The save file, all.dat, seems to store your player name data from 0x2A through 0x45 as a unicode string, making a total of 14 western-alphabet characters
I've found that the project files downloaded off the internet are stored at SD:\Nintendo 3DS\<3dsID1>\<3dsID2>\extdata\00000000\<regional-titleid-high>\00000000\
The first eight bytes (72 74 6B 30 38 30 35 61) of all.dat seem to spell "rtk0805a" though I am unsure if this is the same for all of the saves. I'll have to do more testing on this later... Maybe it serves as a kind of Magic Number/header?
The rest of all.dat, besides 0x4C-0x4E, seem to be entirely filled with 00, all the way up to 0x703. I have yet to find any way to change these values (so I'll have to do more testing for this too)
Deleting all.dat doesn't seem to delete the projects.
I seem to have found at least one project's name, using Decrypt9 to decrypt SD:\Nintendo 3DS\<3dsID1>\<3dsID2>\extdata\00000000\<regional-titleid-high>\00000000\00000006.file. My slot 3 game's title shows up as a unicode string, and starts at 0x401C... I suspect the null terminator is at 0x404E/0x404F, represented as 0x5400. The author's name immediately follows, ranging from 0x4080-0x40A7
In my decrypted SD:\Nintendo 3DS\<3dsID1>\<3dsID2>\extdata\00000000\<regional-titleid-high>\00000000\00000003.file, slot 1's name appears at 0xA01C-0xA07F. The author's name ranges from 0xA080-0xA0A7.
Noticing a pattern between the two, the Project header (assuming we start from 0) seems to go something like this:
0xC-0x3F: Project name
0x70-0x97: Product Name (People seem to use this as an author field?)
(somewhere in-between should be the Create time, but I haven't found the pattern yet. I assume it's converted from seconds in hex)
0xA4-0xA6: Used Memory, represented in little-endian hex
Last edited by mysterypaint,
