0

So I've set myself the goal of editing Crash Bash saves for the PS1. I'm using RetroArch + PCSX, so I'm editing memory card .srm files binary contents directly.

Uploaded a zip with some save games, in case you want to look at them: https://drive.google.com/file/d/1xZgQGt4MmSoduK5lWjAT1osa1hBEbsEE/view?usp=drive_link

After editing file contents, the game ignores the save. Through trial and error, I've seen that I can't modify anything inside the range [0x2200, 0x2850), so that must be CRC-checked.

Anything before 0x2200 (e.g. file name, icons) is defined in the specs for the memory card file format in here: https://www.psdevwiki.com/ps3/PS1_Savedata

The files end up with what looks to be a 32-bit CRC hash. 0x2850: 01 00 00 00 00 00 00 00 00 00 00 00 E3 B6 0C E7

Weirdly enough, the hash is at 0x285C, but the hash is not covering the gap between (0x2850, 0x285C), so I can edit those bits and the game recognizes and loads the save just fine. I think it's safe to say that the game data is in the [0x2200, 0x2860) range and that the game is the one (i.e. not the system) running the CRC-check over [0x2200, 0x2850).

I've tried copying the hex values of the save into https://crccalc.com/ to see if any of the values would match, but no luck.

I've also tried using https://reveng.sourceforge.io/, https://crc-reveng.septs.app/ with options: -w 32 -l -s

So that:

  • -w: Assuming that the hash is 32 bit
  • -l: I think that PSX is little-endian, so I assume that this CRC should also be little endian
  • -s: search mode from reveng

Since reveng seems to work better with more samples, I've been doing some additional saves, so I have 6 sample files.

But that returns no results. Judging the usages I've seen (https://hackaday.com/2019/06/27/reverse-engineering-cyclic-redundancy-codes/), I think it should be fine with 6 saves, but all use cases I've seen have always been running over smaller data, so who knows.

So I'm running a bit out of ideas here. Let me know if you have any recommendations.

1

1 Answer 1

1

Note: I also posted this answer at the following ROMHacking.net forum post: Re: Figuring a CRC to edit a PS1 save file

It looks like the "hash" function is just a simple 32-bit sum: In the files you provided, if you treat each group of 4 bytes in the range [0x2200, 0x2850) as a little-endian unsigned integer and sum them all up (modulo 232), the sum will match the 4-byte little-endian unsigned value at 0x285C.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.