Page 1 of 1

Has any work been done with the protected GameCube saves?

Posted: Fri Sep 17, 2010 9:57 pm
by gtmtnbiker
I understand that some games on the GameCube protect the saves so that you cannot copy them. Has any work been done to remove the protection?

Does the libogc library contain any routines to get around this? Does anyone know how the save is encrypted?

I was toying with the idea of exploring this area myself in GC development if it hasn't been done before.

Re: Has any work been done with the protected GameCube saves

Posted: Sat Sep 18, 2010 1:44 am
by emu_kidid
Some games can be copied by just changing a single byte on them which gets set every time the game is run. (so you can copy it to your pc and install it on another memcard).

Others like F-Zero aren't possible to copy since the game itself checks some stuff against the save.

Re: Has any work been done with the protected GameCube saves

Posted: Sat Sep 18, 2010 2:43 am
by gtmtnbiker
According to this: http://wiibrew.org/wiki/GCMM#Protected_Savegames

http://wiibrew.org/wiki/GCMM#Protected_Savegames wrote: Protected Savegames
Protected savegames are encrypted with the "unique" random serial number that is given to a memory card each time it is formatted. Due to this fact the savegame will only work on the original memory card it was backuped from if that card hasn't been formatted.
To be confirmed if some protected savegames also rely on the block number the savefile starts (or how many blocks where occupied before the savegame was created).
Restoring a raw image to a different card has still to be tested to see if that will permit using a protected gamesave on another memory card.
Known protected savegames: Medal of Honor: Frontline, F-Zero GX, Pokemon Coloseum, Fire Emblem.
When restoring a savegame with GCMM, its permissions will be set to xxP (move, copy, public), meaning the file can be moved or copied by the WII/GC native memory card utility. Being able to move or copy the file doesn't mean it will work for the reasons explained above.
It seems like this would be a nifty puzzle to solve.

Re: Has any work been done with the protected GameCube saves

Posted: Sat Sep 18, 2010 4:07 am
by jeremy654
I had looked into the f-zero save a couple years ago. Instead of decrypting the save, I had suggested changing the serial number on the memory card to the one the f-zero save expected to see. I had located the number in the f-zero save, it was split into four sections or something. I'm not a programmer, so I couldn't do anything with it. I probably still have that information somewhere if anyone wants it.

Re: Has any work been done with the protected GameCube saves

Posted: Sat Sep 18, 2010 4:47 am
by gtmtnbiker
If you can find the info easily, sure, post it in this thread for someone to come across it.

The Viper GC modchip has the ability to dump/save saves. I've done some minor hacking of saves (switching the GameID to use PAL version versus NTSC version) before.

The other thing might be to use the Dolphin Emulator. Does F Zero work in the Dolphin emulator? It might be easier to debug/reverse engineer it by doing it all on the PC.

Re: Has any work been done with the protected GameCube saves

Posted: Sat Sep 18, 2010 4:58 am
by YuanZ
emu_kidid wrote:Some games can be copied by just changing a single byte on them which gets set every time the game is run. (so you can copy it to your pc and install it on another memcard).

Others like F-Zero aren't possible to copy since the game itself checks some stuff against the save.
Is there a homebrew to copy GC Saves to a SD card and revert them later to a memory card?

Re: Has any work been done with the protected GameCube saves

Posted: Sat Sep 18, 2010 5:24 am
by gtmtnbiker
MCBackup is the tool that you want to use. Google for it. Here's a link that I found:
http://thepurplecube.org/index.php?topic=9784.0

Re: Has any work been done with the protected GameCube saves

Posted: Sat Sep 18, 2010 3:59 pm
by YuanZ
gtmtnbiker wrote:MCBackup is the tool that you want to use. Google for it. Here's a link that I found:
http://thepurplecube.org/index.php?topic=9784.0
Thanks, I used this app since it's more updated:

http://wiibrew.org/wiki/GCMM

Unfortunately it only works with original memory cards on GC Mode.

Re: Has any work been done with the protected GameCube saves

Posted: Sun Sep 19, 2010 5:14 am
by jeremy654
Here's the information on the f-zero save.

The memory card serial number seems to be 8 bytes. In the F-Zero save it is split into four pairs of two bytes. They can be found in the save file at the following offsets.

The first two bytes are at offset 20A6 - 20A7.
The third and forth bytes are at offset 20A0 - 20A1.
The fifth and sixth bytes are at offset 75C0 - 75C1.
the last two bytes are at offset 2240 - 2241.

You can use the memcardedit dol I attached to verify this for yourself. It reads the serial number on the memory card, among other things. And since it can read it, I would assume a program could also write a new serial number. I don't know who made this program and there is no souce code though.

Open up the f-zero save in a hex editor and compare it to the serial number you got with the dol. I verified this by using saves from three different memory cards.

To restore a f-zero game save, you would need a program that would read the serial number from the f-zero save and write it to the memory card, assuming there would be no problems when the serial number of the card is changed.

If anyone wants to give a try, good luck.

As for backing up saves, I prefer the sdmc file I have attached. This is a beta softdev wrote, and I think it is one of the last things he did before he quit coding for the gc. I've found that it works pretty well. You need to create a folder called mcbackup on the root of your sd card. The buttons are:

Left trigger - Select SD listing
Right trigger - Select MC listing
A - Transfer
Y - Dump Screenshot

The Z button creates an image of the entire card, but I don't think it works properly.