PS3 Need help modifying Assassin's Creed II save file

[ChestnutEnjoyer]

Hi, I'm trying to modify ACII save files to unlock the content that cannot be accessed anymore due to uPlay being closed and the online servers decommissioned. I know how to do it in a PC save file after finding this hex map with the location of all the important flags in Steam, but I can't get it working on a PS3 save file.

I've managed to find the equivalent byte locations by looking at its neighbours and modified the family crypt and altairs outfit hex flags, but it's like the game is just ignoring it.

I've also tried to something simpler first, like modifying the money, since this is the first time I mod a save file, but I haven't able to make it work either:
- If I modify the decrypted AC2_0.sav file, the game just ignores the money amount I've introduced.
- If I modify not only the decrypted AC2_0.sav file but also the decrypted BK_0.sav file (with the same amount) I get a damaged save data message in the first save game slot.

Can someone point me in the right direction? I'm very new to save game modding.

 

[Berion]

I hope You know that after decrypting and modyfing save, you need encrypt it back and rehash PARAM.SFD.

 

[atreyu187]

Hmm interesting I hate how this stuff gets lost. Not much of a save user but have you tried Apollo? The few times I used it it worked great.

 

[ChestnutEnjoyer]

I hope You know that after decrypting and modyfing save, you need encrypt it back and rehash PARAM.SFD.

100% sure I'm encrypting the files back, and I think I'm rehashing all the needed files. I can't find any .SFD files, but the .SFO file has been re-hashed and resigned according to this screenshot from bruteforce save data, right? Again, I'm a noob when it comes to modding save files so I may overlooking something very basic.

The game is loaded without any problems, so I guess it has been resigned and rehashed properly, but once I get to the save slot selection screen it says "Save data damaged" instead of the slot file name

I only get this problem when I modify both AC2_0.SAV and BK_0.SAV. If I only modify AC2_0.SAV I can choose the save slot without any problems and start the game, but the hex values I've modified (just the money amount by a small quantity) are ignored

 

[ChestnutEnjoyer]

Hmm interesting I hate how this stuff gets lost. Not much of a save user but have you tried Apollo? The few times I used it it worked great.

I'm on OFW, so I'm afraid I cannot use Apollo . I'd like to make this work in OFW so that anyone can enjoy this lost content on PS3 without modifying it. I've used Bruteforce Save Data and Save Resigner so far, but I get to the same roadbloack with any of them. Thanks anyway for the suggestion, I really appreciate it!

 

[Berion]

PFD, not SFD. I don't know why I'm wrote that. :/ If PARAM.PFD securing save contents and meta data, they changed and You didn't rehash it, then XMB will refuse to import from USB. I know that on hacked consoles we have access to HDD freely but this is easy way to check if save is at least ready for a game to read.

I'm not familiar with Bruteforce Save Data Tool but yes that looks good.

If game refusing to read data it means You broke it. ;] Maybe AC2 have some checksums to control data integrity and prevent You from changing stuff. That's quite common on console world.
@bucanero [?]

 

[bucanero]

just to rule things out, try resigning with bruteforce savedata without making changes and see if you can still load the save.
Then change 1 byte and see if you can still load the save or not.
If the game rejects the save, then probably it has some CRC or checksum validation, but you'll have to reverse the game .SELF binary to find the correct way to re-generate the hash.

 

[atreyu187]

I'm on OFW, so I'm afraid I cannot use Apollo . I'd like to make this work in OFW so that anyone can enjoy this lost content on PS3 without modifying it. I've used Bruteforce Save Data and Save Resigner so far, but I get to the same roadbloack with any of them. Thanks anyway for the suggestion, I really appreciate it!

I might be able to see if I can get it working. Have a few on OFW as well

 

[JediKnight007]

Interesting...if this method works, could it be used for any other AC game? I know that Liberation has a level + some weapons that are only available through uPlay.

 

[Berion]

Not possible to make save works on all OFW consoles because PS3 saves are tied to NP Account ID (on accounts bind with SEN) or for UN+PSID (not binded).

 

[ChestnutEnjoyer]

@bucanero it's just as you mentioned, even modifying money amount by 1 byte pops the "data damaged" error in the story menu
selection screen slot .

An update: according to this steam guide about how to do it on PC, the uplay content has to be unlocked in the OPTIONS file, not the save ones, which are the ones I've been modifying so far. However, after including the options file folder with the OPTIONS file, the changes made on the OPTIONS file are ignored, although the game works fine. I've been told there's a checksum in the options file, so I'm going to do some testing on rpcs3, where I can see what's happening to the file, since Ubisoft decided that AC2 should be copy-protected and there's no way for me extract it back from my OFW ps3.

@JediKnight007 No idea about that, sorry. I guess it depends on how they implemented it.

 

[Berion]

Install HFW and HEN. If You really want keep OFW, then read IDPS in bgtoolset, then make System Backup and extract protected archive. All saves with CP attribute will be there.

 

[ChestnutEnjoyer]

Install HFW and HEN. If You really want keep OFW, then read IDPS in bgtoolset, then make System Backup and extract protected archive. All saves with CP attribute will be there.

Thanks! Do you know if bgtoolset can dump the IDPS in 4.90 OFW? Also, is there some kind of documentation or thread here explaining the utilities available in the latest bgtoolset version and what they do under the hood? I've searched for it but I don't know what exploits are outdated nor how do they work.

 

[Berion]

Dump no, but it is displayed in one of menus. IDPS is also in plain text in NAND/NOR dump. And You need HFW beyond 4.82 if I'm not mistaken.

The only up to date exploit is bgtoolset, from official site of course, because there are (or was) many imitations, partial clones etc. which potentially bricking and stealing data. Newest CFW are 4.90.1 Evilnat and 4.90 DB, older but still great are Rebug 4.84.2 Rex/D-Rex and 4.86.1 Lite.

 

[ChestnutEnjoyer]

just to rule things out, try resigning with bruteforce savedata without making changes and see if you can still load the save.
Then change 1 byte and see if you can still load the save or not.
If the game rejects the save, then probably it has some CRC or checksum validation, but you'll have to reverse the game .SELF binary to find the correct way to re-generate the hash.

Could you provide more information about how to reverse the .SELF binary and finding the correct way to regenerate the hash? Thanks in advance!

 

[bucanero]

It's not a simple thing and it's only possible for skilled devs with strong knowledge of reversing and decompiling PS3 binaries... but, anyways here's the basics:

decrypt .SELF to ELF, then use a decompiler tool like Ghidra or IDA with the proper PPC arch plugin (ps3 powerPC), and read through the decompiled code to see how the save-data is generated, stored, and loaded.

Once you found the code that handles the hash, you need to export that code and generate your own "checksum tool" that mimics what the original game function is doing.

 

[bguerville]

Dump no, but it is displayed in one of menus. IDPS is also in plain text in NAND/NOR dump. And You need HFW beyond 4.82 if I'm not mistaken.

You can dump the IDPS to file, the feature was added last year iirc.
You don't need HFW, the Toolset works on all firmware types from 4.80 up as well as on all cex firmwares from 4.75 up.
I still plan to add support from 4.46 up eventually, it just means a lot of extra testing for esc0.. lol

 

[honhon]

Hi, I wanted to make a thread about this. I wanted to access the ACII Uplay exclusive map. I was thinking of several ways to do it.

Since it is a protected save, it is difficult to work with. I haven't seen many save edits or cheats for this game either. I tried to use Apollo but it doesn't seem to be able to decrypt the protected save. (I'm going to try using ps3 game genie which seems to have support for protected saves)

If you could glitch through the game and through the walls , could you pass throught the door and access the map?

Another method would be to get a save with the uplay rewards already activated and start a new game. That was a PC method that some people used

 

[bucanero]

Apollo can't decrypt AC2 save-data because it's not encrypted at all. (so there's nothing to decrypt)

The save-data file is plain data, you can check it by using the "Hex editor" option from Apollo. From previous comments, the game do have some kind of internal checksum or hash verification. You'll need to fix that before save-editing will work.

 

[honhon]

The checksum seems to be the biggest problem, (but I'm not sure it is something 100% confirmed). The next best option could be using cheats or modifying the game