Hacking Save Edit: Project X Zone, need help

[Zonard]

Hi,

I was trying to edit my project X zone save to change xp levels, however it doesn't work for some reason.. everytime I try to import a modified savegame, the game detects "corrupt data" and erases it... I'm using HxD.

if someone else managed to do it, I'd like to know how In the mean time I will still explain what I'm doing :

btw, EUR and USA save are cross compatible, just like fantasy life

once you extract the save with SDF, you'll find two type of files in folder 00000c64:

"discondata.bin" which is the ingame quick save
"savedataXX.bin" which is the data save at slot XX.

LVL can theoretically be set to max by just putting maximum XP, according to what I found on Cyber Save Edit japanese forum... the values are stored in both type of saves but not at same offset (starts from 410 in discondata, but 408 in savedata00).

example with discondata.bin

starting from offset 410h, you have :
pair1 xp (4 bytes), solo unit? (4 bytes)
pair2 xp (4 bytes), solo unit? (4 bytes)
and so on...

example with my save, starting from offset 00000410 :

6D 29 00 00 02 01 00 00 < kogoro & mii have 10605 xp, which is 296Dh (6D29 in little endian)
5A 2D 00 00 00 00 00 00 < jin & xiaoyo have 11640 xp => 2D5Ah => 5A 2D

and so on...


on the japanese forum, they put codes like
20000410 0001869F

which seems to fit, as 1869Fh = 99999.
of course we have to write it as little endian in the savefile, so 9F8601

However, when I do it then reimport save, i get a message from the game "corrupt quicksave data, erasing data..." or "corrupt save data, erasing data.."

am I supposed to change stuff in the 00000c64.dat and 00000c64_.dat ? I don't understand what these files are...
this is the first time I'm editing 3ds games, but I don't see mention of anything else to do when modifying savefiles in other tutorials..

I hope someone can help me find a solution..

 

[liomajor]

When the imported save is corrupt, it can be because the game has either stored the values more than once or crc checks.

If you can offer me two decrypted saves with different values for exp (not hex edited), i can look into that.

"20000410 0001869F" looks like action replay code.

 

[Zonard]

Hi,
thanks for your reply.. sorry I got it late.
I'm still looking into the files, and prepared 4 saves for you, since the game has a total playtime counter, I figured it would be easier to have differing saves with the least amount of actual ingame differences... so in the attached zip, the folders "about_xx_yy" mean the playtime on the save is roughly xx minutes yy seconds (it's in a different menu so i can't be very precise about them..).

the important files are "discondata.bin", generated by the "quick save" feature ingame (whereas savedata01.bin refers to a real savegame in another saveslot)

the values appear to be stored only once, the differences appear at offsets (in hex) :

000->003 (likely candidate for a checksum value of some kind)

094->096 (probably the playtime itself, as 96 was "00" on an earlier save with less than a minute playtime, I'm not sure yet how it is stored, though, also at offset 98 comes other global stats for the game like maximum hit, total number of enemy ko, etc)

541->542 (no idea at all..)

indeed the codes found on the jap forum look like action replay codes, but they are for the cybergadget saveeditor (jap version of powersaves, with ability to add your own codes).. there is still the possibility that the japanese version has a different save system, I haven't tested the japanese .cia of the game... found another url referencing them (http://ds-cheat.boy.jp/cysv/pjxzone.html )

 

[willdunz]

Have you tried not changing the number but only switch them around?

for example 6D 29 00 00 you change it to 29 00 6D 00, which should give you 7143465 XP. or 29 6D 00 00 (27945 XP)

 

[Zonard]

just tried and no it doesn't work.. still corrupt
I guess our best bet is to wait for gateway to support realtime cheats, or dstwo+ if the rumors are true.. in the mean time i'll probably write a small script to check for subparts of the file and run common checksum algorithms and compare against those first 4 bytes... but still I have low hopes

also I should try the japanese version cia just to see if it doesn't feature such protection...

 

[liomajor]

Ok, i took a deep look into it.

I tried to get around the game's check with exp.

My current exp was 342 > hex 01 56, in the savedata its reversed (56 01),
to check how tight the protection is i changed it to 22017 > hex 56 01.

File CRC 125EE before and after hex edit.

The game doesnt check only the whole file, but protects important bytes as well.

The only way to edit the save is to break protection or at least re-calculate it.

 

[Zonard]

yea I think the 4-byte header serves as an integrity check somehow... anyway thanks for having a look