ROM Hack WIP Scramble - "NEO: The World Ends with You" Save Editor

[uzimakiuchiha]

Sorry for triple post heh.

If anyone bought the PC version and wants to donate their save files for research, that'd be super
I already anticipated key differences like graphics settings and the like, so a converter will be on the way even if the save structure remains the same.

I'm going to get it start of the month, so if not one has got you a save by then, I will

 

[SPARKisnumber1]

Sorry for triple post heh.

If anyone bought the PC version and wants to donate their save files for research, that'd be super
I already anticipated key differences like graphics settings and the like, so a converter will be on the way even if the save structure remains the same.

I have the pc port but not sure where I'd find my save data

 

[uzimakiuchiha]

I have the pc port but not sure where I'd find my save data

Most PC games put it somewhere in appdata\local\[publishername(Square Enix in this case)]
But I'm not sure yet as I haven't played it

 

[Taishiro]

I managed to get the game so I'll be tinkering with it and I'll let you guys know

Update:
Save file for PC release is located in "Documents/Neo The World Ends with You"
The editor is not compatible with this save file at the moment.

I'm working on it.
Interestingly enough, the game's save file is called "f1fc4b9d54965358d41213ae8ff0a0f7"... which is the MD5 checksum for the word "gamesave".

Update 2:
PC save file is "encrypted" (in quotation because I don't really know if it's really encryption)
There is also 1060 more bytes than in the PS4/Switch save file.

We need to figure this out in order to have support for PC files ^^ I'd appreciate any help because this looks like it's gonna take a while.
I've documented what I could find in here:

So first of all, I could find three important parts in the save file:

(1). offset 0 to 31: (32 bytes) some sort of key, hash or device identifier
(2). offset 32 to 1135 (1104 bytes) general game settings. this is completely encrypted.
(3). offset 1136 to 3201071 (3199936 bytes) all 10 save slots, and (very) possibly some tiny extra data. completely encrypted as well

Key/hash at (1) will remain the same always. For me, it is "CE37ECF1EC66A3A71F16ABF7682AA7A52D131F5E2C3DA2560D29187A8C12B083"
If anyone has a different value, let me know. If it's a device identifier, it's unlikely that it will help us decrypt the save file.

(2) will change if you modify any global game settings, such as graphics, volume, controls, voice language, etc. (1) and (3) will not be affected by this.
(3) will change if the game saves any of your files, either autosave or 1-9. (1) and (2) will not be affected by this.

It is clear that there is more assigned data to both settings and game save data, so offsets will possibly have to be adjusted if we manage to decrypt the save file.

 

[sonic2005]

I managed to get the game so I'll be tinkering with it and I'll let you guys know

Update:
Save file for PC release is located in "Documents/Neo The World Ends with You"
The editor is not compatible with this save file at the moment.

I'm working on it.
Interestingly enough, the game's save file is called "f1fc4b9d54965358d41213ae8ff0a0f7"... which is the MD5 checksum for the word "gamesave".

Update 2:
PC save file is "encrypted" (in quotation because I don't really know if it's really encryption)
There is also 1060 more bytes than in the PS4/Switch save file.

We need to figure this out in order to have support for PC files ^^ I'd appreciate any help because this looks like it's gonna take a while.
I've documented what I could find in here:

sorry I'm not a programmer but i will progress through the game ( i want to download it now ) and send a save when i reached that location

 

[sonic2005]

sorry I'm not a programmer but i will progress through the game ( i want to download it now ) and send a save when i reached that location

just like before i will try to reach the ending

 

[sonic2005]

just like before i will try to reach the ending

since it didn't have denvous ( for the first time )

 

[Ulcar246]

I managed to get the game so I'll be tinkering with it and I'll let you guys know

Update:
Save file for PC release is located in "Documents/Neo The World Ends with You"
The editor is not compatible with this save file at the moment.

I'm working on it.
Interestingly enough, the game's save file is called "f1fc4b9d54965358d41213ae8ff0a0f7"... which is the MD5 checksum for the word "gamesave".

Update 2:
PC save file is "encrypted" (in quotation because I don't really know if it's really encryption)
There is also 1060 more bytes than in the PS4/Switch save file.

We need to figure this out in order to have support for PC files ^^ I'd appreciate any help because this looks like it's gonna take a while.
I've documented what I could find in here:

The bytes at (1) are exactly the same for me


if you want to check it out, here's my save folder:

 

[Ulcar246]

I still need to go through the code with a c++ decompiler, but I did find this property in the SaveDataRoot class, maybe this would help?

MagicNumber = "mt)~#Eag!HG]~d>)yjzTJsS."

 

[Taishiro]

I still need to go through the code with a c++ decompiler, but I did find this property in the SaveDataRoot class, maybe this would help?

View attachment 277618

MagicNumber = "mt)~#Eag!HG]~d>)yjzTJsS."

This is certainly helpful. I believe it is AES encryption? But I'll take a look at it in a few.
Where is this class located?

 

[Ulcar246]

This is certainly helpful. I believe it is AES encryption? But I'll take a look at it in a few.
Where is this class located?

It's just in the base assemby-csharp namespace it seems, not in any of the defined namespaces

In there, I think you want the SaveDataRoot class and the SaveHeader class

What I just did is run GameAssembly.dll through il2cppinspector to get all the c# type definitions, and found it in there

 

[Taishiro]

It's just in the base assemby-csharp namespace it seems, not in any of the defined namespaces

In there, I think you want the SaveDataRoot class and the SaveHeader class

What I just did is run GameAssembly.dll through il2cppinspector to get all the c# type definitions, and found it in there

I see now. I have tried loading GameAssembly.dll in il2cppinspector but it is apparently obfuscated. I did load the il2cpp metadata too. What were the steps you made?

 

[sonic2005]

I see now. I have tried loading GameAssembly.dll in il2cppinspector but it is apparently obfuscated. I did load the il2cpp metadata too. What were the steps you made?

well if epic use the same system of save that used for kh series it will be a hell

 

[Taishiro]

This has officially beaten me, for now at least. I am tired for today.
Been looking at the decompiled .dll's and also the main .exe in assembler language, but can't make up anything . This confirms I am no cracker, unfortunately

Hopefully someone more savvy in the reverse-engineering department can figure it out, because it's there.
The static class "SaveLoadController" and the class "SaveDataRoot" both contain information about loading a file, that's called "gamesave" (and yet, whatever happens internally, generates a file using the md5 hash of "gamesave" as name LOL). Whatever happens in these method is a mystery for me at the moment.

However. There are good news for Switch/PS4 players. What I could find in the decompiled data is every single property that's inside the save file and their offsets, and ~95% of it is also present in the console release, so here's to a more complete save editor.

 

[tafice]

it seems that Rijndael with specific key and iv was used.

 

[Taishiro]

it seems that Rijndael with specific key and iv was used.

That's correct. Can we get the key and IV, that's the question...
Makes me wonder if the magic number in question (a few posts above) is the IV since it is 24 characters long. but it's not hexadecimal hm. I'll check it tomorrow.

Update:
I'm silly. This magic number is also present in Switch saves (first 16 bytes). Looks like some sort of validity check.
Which leads me to believe, that if we manage to decrypt the save file there's a chance it will be exactly the same as a Switch/PS4 file in size and structure.

 

[sonic2005]

That's correct. Can we get the key and IV, that's the question...
Makes me wonder if the magic number in question (a few posts above) is the IV since it is 24 characters long. but it's not hexadecimal hm. I'll check it tomorrow.

Update:
I'm silly. This magic number is also present in Switch saves (first 16 bytes). Looks like some sort of validity check.
Which leads me to believe, that if we manage to decrypt the save file there's a chance it will be exactly the same as a Switch/PS4 file in size and structure.

hope its would be soon

 

[sonic2005]

i still couldn't think why epic made its save like this ?? png save file that you cant get from net easily , 2 part save file and config in registery

 

[johnnymaq]

Is there any chance transferring Switch saves to PC would be possible once the PC saves are decrypted?

I've nearly finished the game on Switch somehow not knowing it was coming to PC, and would like to do endgame on PC.

Otherwise the tool will still be helpful so thank you for your work.

 

[Taishiro]

Is there any chance transferring Switch saves to PC would be possible once the PC saves are decrypted?

I've nearly finished the game on Switch somehow not knowing it was coming to PC, and would like to do endgame on PC.

Otherwise the tool will still be helpful so thank you for your work.

Yes. If PC save files get cracked, I'll add a converter between PS4/Switch and PC saves.