True Swing Golf (Nintendo Touch Golf) NDS - save/rom

matt! · Dec 6, 2018

I started a game of True Swing Golf (USA version) a while back, and I am quite far through the game.
However the game takes your player name from the NDS profile, so I am stuck with something that is not my name and I'd like to change it. How vain!?

I extracted the save using TWLSaveTool and then did some experiments with DeSmuME.

However, the save game has a checksum that I have been unable to figure out.

Here are a bunch of save games, and a small .c program to display the checksum of each save: https://forumfiles.com/fdhbXemfb3/true-swing-golf-NDS-saves_zip
Each save file is named as the NDS profile player name I used to create it, and all other settings are equal.
All saves were created from blank by deleting the previous save in the game and restarting DeSmuME.

What I've found so far:
- 0x0 .. 0x3 = checksum (4 bytes)
- 0x4 .. 0x7 = some flags
- 0x4 = increments with every save (not shown in attached save files)
- 0x5 = set to 1/true after the game has been initialised (player has been created)
- 0x8 .. 0xB = magic phrase "DSG " (game codename was DS Golf)
- 0xC .. 0x27 = unknown, can be changed with no effect on save game loading
- 0x20 and 0x24 = change with every save; in-game timer?

- 0x28 .. END = seems to be the area that is protected by checksum
I have corrupted a handful of places over this range and they all resulted in "corrupt save data" error on game launch.
(note: it's possible to corrupt the save in a way that doesn't raise an error on launch = the "See Player Data" button will not appear on the title screen)

- 0x5C .. 0x73 = player name (I want to change this)
- 0x74 .. 0xAB(?) = player message

So, I guess there are two approaches to changing my name in the save:

1. crack the checksum and recalculate it after changing the player name data
2. create a temporary cheat code or rom patch to stop the check for a corrupt save file

I'd appreciate some help or advice on how to achieve either!

Thanks

matt! · Dec 6, 2018

Ah! Just thought of a third way.

1. Load valid save into DeSmuME (Windows version)
2. Edit value in memory
3. Save game!

matt! · Dec 7, 2018

Done, using the third way.

- Load save game
- Dump memory from emulator
- Search memory in hex editor
- Edit memory in emulator
- Save in game
- Export save from emulator

Had to view the player profile in the clubhouse golf shop, then back out, to force the game to re-save the whole save data.

Then imported modified save using TWLSaveTool onto real cartridge.

FAST6191 · Dec 7, 2018

The "third way" is the one I would usually look at first. You can often convert it into a cheat as well if you wanted.

Anyway for others that might stumble upon this then the firmware settings are typically dumped into memory (in my experience quite far into the memory, just before where the memory has a section given to overlays). Most hackers that look at them are concerned with the language flag to force it for those games, emulators and flash carts that don't play, or for when a language is hidden (stuff like the Advance Wars that did not get released in Japan had Japanese in the game but was locked out, forcing the language flag allowed it) but all the other settings like birthday and favourite colour are also there.

http://problemkaputt.de/gbatek.htm#dsfirmwareusersettings has more on the specifics of the settings.

If it is not a firmware based setting and just a user one then you can still look at memory, force it to something else and see if it saves it back again. Not all will (older systems are where it is more likely such a thing will fail and you will have to learn to edit saves, or disable the check the game does*) but most modern games/systems will take the easy route of dumping settings to and from memory each save rather than some kind of piecemeal approach.

*typically a game will load the save, do a check, have a IF equal then carry ELSE go to failed check routine (or in DS assembly more likely a BNE aka break if not equal) and you can force that to always go down the "it works" path. When saving however it will recalculate it all again and make a proper save, you then can import the save back to a non modified version of the game.

matt! · Dec 7, 2018

The reason I came up with that method third, was I was trying so hard to not have to boot up Windows. Hahahahahaha. DeSmuME for MacOS didn't have the debugger or memory viewer.

I had disassembled the game but my ARM knowledge wasn't enough for me to find the save game load function. I'm still interested in seeing that just for completeness.