0

I bring you either a hard challenge or the easiest challenge you've ever had.

I have a save file for this game The first bytes are:

F9 29 CE 54 02 4D 71 04 4D 71 00 00 

this is the same throughout every save file I create, now this is where I come to you guys, I can't see anywhere in IDA where it's generating this "checksum" I looked at the string refs for "savegame.dat" it's reffed in 3 places but when I do C psuedo-code I can't see any writing to file happening around the refs, so maybe I am going crazy?

Anyway, like I was saying, the check sum I get back looks like this:

45 13 CD 5A 02 00 00 00

It might not end in the trailing 00's, I only include them because this goes up to 8 bytes which seems logically, there is still lots of file to go, but it goes randomly like 05, 02, 01 etc so I don't think it would be needed however a better person will likely prove me wrong :).

45 56 42 E5 01 00 00 00
C4 94 3D 73 08 00 00 00
4C 67 FA 44 01 00 00 00
45 13 CD 5A 02 00 00 00
D8 9A F1 E6 0A 00 00 00
F7 84 4F 99 02 00 00 00
18 4B 4F 56 02 00 00 00
25 44 F6 AF BF 00 00 00

What little advice I can offer is there was a section later in this file that had

00 00 00 00 00 00 00 00 00 00 00 00 E2 07 00 02 07 77 18 00 46 00 00 00 E2 07 00 02 07 B7 B0 00 66 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00

which after testing with someone we determined this is "Creation" and either "Last accessed" or "Last modified" we found this out because what goes into E2 07's in INT16 - Little Endian is what the year is, although we don't know what the last few parts are. But that isn't what this is about. It's more an idea saying that it might be fully Little Endian.

Any advice how I could find in Ida or anything else would be greatly appreciated :).

0

Turns out it was a XOR'd checksum, managed to figure it out and will be here: https://github.com/Arefu/Wolf if people want to see it in action in the future.

| improve this answer | |
  • Please mark your answer as accepted :) – Megabeets Jan 8 '18 at 8:42
  • Waiting for the new day :). – Jalomba Jan 9 '18 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.