So I've set myself the goal of editing Crash Bash saves for the PS1. I'm using RetroArch + PCSX, so I'm editing memory card .srm files binary contents directly.
Uploaded a zip with some save games, in case you want to look at them: https://drive.google.com/file/d/1xZgQGt4MmSoduK5lWjAT1osa1hBEbsEE/view?usp=drive_link
After editing file contents, the game ignores the save. Through trial and error, I've seen that I can't modify anything inside the range [0x2200, 0x2850), so that must be CRC-checked.
Anything before 0x2200 (e.g. file name, icons) is defined in the specs for the memory card file format in here: https://www.psdevwiki.com/ps3/PS1_Savedata
The files end up with what looks to be a 32-bit CRC hash. 0x2850: 01 00 00 00 00 00 00 00 00 00 00 00 E3 B6 0C E7
Weirdly enough, the hash is at 0x285C, but the hash is not covering the gap between (0x2850, 0x285C), so I can edit those bits and the game recognizes and loads the save just fine. I think it's safe to say that the game data is in the [0x2200, 0x2860) range and that the game is the one (i.e. not the system) running the CRC-check over [0x2200, 0x2850).
I've tried copying the hex values of the save into https://crccalc.com/ to see if any of the values would match, but no luck.
- -w: Assuming that the hash is 32 bit
- -l: I think that PSX is little-endian, so I assume that this CRC should also be little endian
- -s: search mode from reveng
Since reveng seems to work better with more samples, I've been doing some additional saves, so I have 6 sample files.
But that returns no results. Judging the usages I've seen (https://hackaday.com/2019/06/27/reverse-engineering-cyclic-redundancy-codes/), I think it should be fine with 6 saves, but all use cases I've seen have always been running over smaller data, so who knows.
So I'm running a bit out of ideas here. Let me know if you have any recommendations.