4

I recently overwrote the save game file of a video game that my girlfriend and I had been playing through. After trying to recover the file a few different ways (game didn't erase but overwrote the save file), I'm resigned to trying to rebuild the save data manually.

I've played with reverse engineering binary executables from crackmes.de in the past with Ollydbg, but this is different and I feel like I'm a bit out of my waters.

The game (Sonic All Stars Racing) uses a single .bin file to store records for four in-game accounts. Using a hex editor, pen and paper, I've begun to plot out the file structure and locate offsets for various records.

The problem I have is that whenever I make a modification to the file, same size or otherwise, the game declares the save file corrupted and fails to use it. I assume that this is because the game is implementing some form of CRC/checksum on the data to prevent using a corrupted file. (Aside: are CRC and checksum interchangeable terms?)

The game saves the data to a file named "ssr_save.bin" which is responsible for four in-game profiles.

What I did was create four different save files by making a backup of the save file after creating each profile.

Each file is largely the same. 727040 bytes large. The only difference seems to be the first 12 bytes (0x00 to 0x0B inclusive). These first twelve bytes are completely unique between the four files.

There does, however, appear to be more than one data object in that range as there are 3 bytes of zero in the centre of the 12.

File 1: 19 8E 0B 60 13 00 00 00 F9 3E 00 B0
File 2: 93 7B 0F 36 13 00 00 00 B6 35 02 9B
File 3: 69 71 1B 14 13 00 00 00 A1 30 08 8A
File 4: D9 47 32 E8 13 00 00 00 D9 9B 13 74

What I'm trying to figure out is what these bytes represent and how I can manipulate them to let me modify the body of the save data and not throw the corruption error in the game.

Can anyone help me find out how the game is checksumming the file and reverse engineer the process so I can create a valid file?

Here is an archive of the four save-data files

Troy.

TroyDowling
  • 43
  • 1
  • 5
  • "are CRC and checksum interchangeable terms?" Generally, no, though most people don't bother to differ. Checksum has a broader meaning, which includes CRC variants as specific checksum functions. – Dmitry Janushkevich Jul 10 '14 at 12:50

1 Answers1

4

This is quite hard question to answer due to variables within reverse engineering.

I would recommend you start off with:

  • Start game
  • Get some coins or whatever is saved then save the game.
  • Restart the game and get more coins and save the game.
  • Replace the new save with your old file.
  • Does it load? See Answer 1. Otherwise, Answer 2.

Answer 1 Your modified versions of your game files are just in the incorrect format. You will need to some reverse engineering of how the bytes are used within the game. I'd recommend you breakpoint CreateFile and ReadFile and step through your debugger and see how each byte is been read. Ofcourse, this can become a massive task.

Answer 2 The game file checksum could be stored somewhere on the file-system or registry to ensure data-integrity of the file. You could use tools such as Process Monitor to help you locate this file or you could set breakpoint on CreateFile and ReadFile and search for it yourself manually. http://technet.microsoft.com/en-gb/sysinternals/bb896645.aspx

Let me know if you get answer 1 or 2 then I can expand my answer in more in-depth details of things you should look out for and so on.

I hope this will be a good starting point to your issue.

Paul
  • 467
  • 2
  • 6
  • I did as you said. Started the game with a fresh savefile, made some progress, saved a copy of that savefile, made some more progress, saved a copy of that savefile. I was able to swap around savefiles no problem as long as they were renamed properly to "ssr_save.bin" as the game expects. I could even swap out to other savefiles of completely different profiles. It all worked properly. – TroyDowling Jul 10 '14 at 18:15
  • 1
    I forgot to include, here is the output log from ProcessMonitor for the activity of the game while it loads the savefile. I filtered it to the PID of the game. Linked are all relavent lines. – TroyDowling Jul 10 '14 at 18:20