ZSR Forums

I guess I'm starting to work on a VC save generator.  Edit: (other stuff (http://forums.zeldaspeedruns.com/index.php?topic=374.0))

Right now I'm working on a save game generator that hopefully we can use to generate VC saves. So far I've been able to use FE100 (http://wiibrew.org/wiki/FE100) to decrypt and extract VC saves and load them straight into PJ64, but I haven't been able to create VC saves that the wii will allow you to copy over yet.

Once I'm able to copy my injected saves to the Wii, my plan is to try and work on a more dedicated program to generate save files. If I can figure out how FE100 decrypts/encrypts the files, I could write a program that generates both a valid VC save and a .sra for emulators. Otherwise I'll just have to generate a .sra or something and make you guys inject it with FE yourselves. But before I can even do that, I'll need to figure out the save file format.

Here's what I've figured out from the save file so far.
IMPORTANT: PJ64's .sra files store save game data differently from how the Wii stores it. In PJ64, every 4 bites is mirrored, like this

3

2

1

0

|

7

6

5

4

These values are based on how they're stored on the wii.

0x0 - Appears to be a 32 byte header
0x20 - Start of the first of 6 game files (Save slots 1-3, and then repeated). Each is exactly 5200 (dec) bytes long, so adding 0x1450 to the following values should allow you to modify the other save games.

0x3C - The word "ZELDA" appears here, only appears next to filenames that have been created
0x42 - The death counter is stored here (2 bytes)
0x44 - The player name is stored here (8 bytes). Name "cutscene" = C7 D9 D8 D7 C7 C9 D2 C9, the capital letter "A" = AB, and the terminating character is DF repeated if the name is less than 8 characters
0x58 - Some sort of clock value (2 bytes) is stored here.
0xC0 - This row stores data for various quest/inventory items. It appears that the memory address 11A670 corresponds with 0xC0, which is awesome, because it means we can most likely use existing codes to map out the .sra format, and for the values we don't know we can just use a memory watcher/gameshark codes, instead of having to change values, save, then view the .sra file in a hex editor

I don't know what you just said.

This is a pretty sweet idea.  I think I could help.

New to programming with binary/hexidecimal values, but a brain is a brain. I'm here to help to the best of my abilities. From the looks of it you have the algorithm solved 1 way so far :)

just tell me what i need to do, and i will try and help. i have wanted one of these for a while (although im no programmer yet)

what is it that you are trying to do here?

You've got your fair share of helping hands already, but if there's anything I can do, I'll be glad to help.

I'm an experienced reverse code engineer but I don't know any MIPS (n64 is mips, right?)

I thought MIPS was the rabbit you had to catch in SM64. :3

I would really like to help if I had more time, but these days I'm too busy so all I could say is good luck.
I think you'd already know but http://forum.xentax.com/ is a place where people from all around the world gather and talk about various file formats and how to reverse them. I used to get lots of help from there in the past when I was reversing some unknown proprietary file format. Just my two cents.

OK, so I have a good idea of what I'm gonna need for this project, and what I'm gonna do. I'm writing the program in C#, being that it's the language I'm most comfortable with. I want the program to be able to have customize saves beyond just doing say the equipment screen, inventory screen, boot screen + start location. I want to be able to strip out specific cutscenes (no intro/master sword cutscene ftw), mess with which chests have been opened and which NPC's you've talked to (think doing the Deku tree without a sword, but without Mido's dick blocking the way),  have custom (as in super fast) scarecrow songs, and some other cool things I haven't thought of.

So here's what I'll need:

---

I need someone to figure out what sort of check-sum algorithm is used to verify that a game file hasn't been corrupted. I've already mentioned this to petrie, but if someone else wants to beat him to it then fine =p

Since the save file matches up perfectly to a spot that's loaded in memory when the game starts, I'll need a list of Version 1.0 Gameshark codes between 11 A5D0 and 11 BA20, and an explanation of what each code does (Remember that the 80/81 part of the code isn't actually part of the address).

Last I need someone to pick apart FE100's source (found here (http://wiibrew.org/wiki/FE100)) and figure out how the fuck that thing works so that I can make some valid VC saves lol.

i just thought of something. when i tried copying that save over for you and it didnt work, i was using the save manager that comes installed in the wii. however that is restricted, so if i used a homebrew save backup/installer (that would allow you to copy stuff like animal crossing, which normally is not allowed) it might work, so could you send it to me please? thanks

bump because I'm still looking into this one.

(http://img96.imageshack.us/img96/6233/ocarinasavegen.png)

Bonus points if you can figure out the scene the file on the right was on when it was saved.

don't know where it was saved but glancing at the numbers, it looks like a non-glitch playthru in which you have at least gotten up to the megaton hammer, but not yet at the longshot, also you did the mask quest :P

Bumped because this shit is still being worked on.

I still haven't figured out how the individual game files are validated, but I came up with a way (and implemented it) to get around all that, and it's actually a simple solution. When the File Select screen is up, a copy of the cart's SRAM (containing the 'header' and all 3 files) is loaded into a block of ram. And since the save data has already been validated, you can simply inject an OoT SRAM file into a savestate, and start one of the game files. Then all you do is save and the game file is written, and OoT won't reject it when you reset.

Right now my major goals are to

• Implement a GUI interface which requires these things
  • Create a collection of tables that map out the Game File data
  • Create a system that will read the tables into memory
  • Create some sort of dynamic interface system that allows users to edit the data through various interfaces
• Re-write a decent amount of code so that you can edit a Game File or SRAM file with the Hex Editor and the GUI interface side by side.
• Add the ability to keep the various files in seperate folders (ex. VC folder for SRAM dumps that are compatible with the Wii, Savestates in another folder, etc.)
• Add the ability to rip Game File data off of Savestates, and add support for Mupen savestates.
• Make the Hex Editor less shitty.

Sounds cool. Too bad you're using C# though (I use C++)

I've managed to successfully inject a modded VC save in OoT. I plan on making a "Medals Stones Child" save shortly that will attempt to make it possible to beat every dungeon and Ganon as a child (though the only way to reach Ganon would be to use Farore's Wind.

neat. that should be very interesting to see.

Someone finally posted a Checksum algorithm for Ocarina of Time on spinout's Z64 (http://z64.spinout182.com), and I've added that into the program.

I also added a hack in that randomly generates a save game that is moderately playable at the very least. It's kind of neat going out to grab bombs or the hookshot, knowing that you have a 50/50 chance that the chest they're in has already been open, or a 25% chance that a boss door can't possibly be opened, or that on average, 77.3% of you inventory items will be completely useless, not factoring in child/adult only situations.

Blind racing randomly generated saves sounds amazing. It will be the new bingo.

Random saves sound pretty awesome to fuck around in.

But I am concerned people might use a save file generator to provide fake proof

You could remove the ability to change a filename in order to counter that, I suppose.

That information has already been posted.

Providing fake proof really isn't that hard if someone wants to put in the time to make it convincing.
you could do at least two things (probably more)
1) Photoshop the right letters onto a proof photo (prone to failure upon close examination, which #zelda specializes in)
2) It shouldn't be that hard to find the addresses for your name, and then create a code to change your name (and of course use separate codes to generate the requisites for proof)

My point is, if you want to put in the effort cheat, you can (the real question to ask is why), all the generator would do is make it easier, which is really a good thing imo. Cheaters who would use the generator to cheat probably are not trying that hard, so they will probably have inconsistencies in there story (which is where peer pressure comes in).

Truly short of streaming, its impossible to 100% verify that a time is legit in a race.

p.s. and if your concerned about cheating becoming a rampant thing, just make the penalty harsher (banned for x amount of time on first offense, instead of just being required to stream)

Been working on this, and I've made some modifications that allow me to edit MM saves, and add other games in the near future. Knowing how OoT's checksum is calculated, I was able to figure out how and where MM's checksum is calculated. I've already been able to generate MM saves, so now I'm looking into MM's save format.

Sorry to bump a long dead thread
Did this ever go anywhere mzx? Do you have anything stable enough to release?
Thanks

I wasn't able to achieve anywhere near what I wanted in terms of making it easy to modify saves, and you couldn't just generate a file that you could just copy onto an sd card and load, but other than that you could still load saves into the hex editor, edit them if you wanted, and convert them to a VC or PJ64 save (you would then have to repack the VC save with another program), or save the game file by itself.