Savedata issue in Invizimals (discord report)

[hrydgard]

TheDarkAron reports:

Hello there. I have little problem with Invizimals - Shadow Zone and Invizimals - The Lost Tribe. It seems, that I cant load any savedata in this two games. In first Invizimals, the loading is working normally as in other games like Ghost of Sparta or WipEout but in this two I am getting this error which I screenshoted.
I tried to look up some info about this problem but I didn't find anything helpful, so I would be really glad, if you could help me. By the way, I found one old discussion #10000 and I tried what LunaMoo posted, but I didnt find SavedataUpgrade in the ppsspp.ini. I only found SavedataUpgradeVersion, which I guess is the same thing, and it was already set on True.
Additional info: I already tried to reinstall. I have up to date gold version 1.9.4 and the games are in region Europa, same as savedata. Also, I have tried to load my old personal savedatas and savedata from https://gamefaqs.gamespot.com/psp/605208-invizimals-shadow-zone/saves. Neither of them worked.

[hrydgard]

Further comment on discord:

[6:46 AM] XXX_nr3: The game seems to have a protection so the saves cannot be (easily) transfered to a different console
[6:46 AM] XXX_nr3: I think that this is not a ppsspp error

Not sure how we could confirm this though, and whether it's possible to work around?

[Abbanon]

Additional comments:

[11:41 AM] XXX_nr3: ok, so I started a new game ( Invizimals - Shadow Zone ) on a PSVita/ePSP using a redump verified file and I saved at the beginning.
Then I moved the save file on a different console - PSP3000 - and using the same redump verified game, it refuses to load

[anr2me]

i just tested invizmals shadow zone, apparently save data affected by mac address 😅 i created a new game save and then try to load it which is working properly, then i tried to change the mac address and try to load again and bam! getting error 80110306 😄 nowonder in the console log i'm seeing it uses sceWlanGetEtherAddr to get the mac address while loading save data

[hrydgard]

Haha, so that's how it does it. Well, PPSSPP allows you to set a custom Mac address so...

Not a bug, closing.

[Abbanon]

You can manually set a MAC? I thought you could only cycle through randomly generated ones.
I'm guessing for a manual one it's done through the .ini file? (EDIT: I discovered that's how you do it)

Might be good to add an option in Networking for setting it manually, and then changing the existing option to "generate a random MAC address"

[hrydgard]

Oh right... Maybe we didn't make UI for that. But yes, through the ini file will work.

[anr2me]

Btw does PPSSPP able to get the game key? if it can, may be we can create a compatibility-hack to patch the mac stored in the savedata with the new mac (in case we don't know the old mac) on-the-fly or when upgraded, something like in this guide https://youtu.be/Jop20OXdaEk?t=245

PS: different game may store the mac address at different location, but we can always find the location by creating new savedata with known mac (assuming we know how to decrypt/encrypt the savedata using game key)

[wad11656]

I'm trying to import an Invizimals: Shadow Zone (EUR) save that's been downloaded from the internet that has most/all of the monsters captured:

https://gamefaqs.gamespot.com/psp/605208-invizimals-shadow-zone/saves
https://www.thetechgame.com/Downloads/id=167762/eu-invizimals-shadow-zone-248-invizimals.html
https://psp.brewology.com/gamesaves/savedgames.php?g=687802&l=I#a_687802
(These are all the same save)

...but the mismatched MAC address between the save file and the console (PPSSPP) it's being loaded on seems to be blocking the save from loading, and thus throwing the 8011036 error. Using the MagicSave plugin doesn't bypass the error either.

I used the SED plugin to decrypt the GAMEDATA file that's stored within the game's save folder:
https://drive.google.com/file/d/1lbDAbtvaUVa4f0ZSuUSDbJr9oUuN_kjv/view?usp=share_link

When viewing the file in a hex editor, you can see all the decrypted monster names, which is a good sign, but I still don't see the MAC address anywhere in there.

Does anyone know where the save file's MAC address is located within the Invizimals: Shadow Zone save data files? If we can identify where the MAC address is hidden in the save files, we can change the MAC address in PPSSPP (or PSP) to match it, and thus theoretically successfully boot the save.

Alternatively, a hacker could find cheat codes to unlock all the monsters in the game.

Also copying to Discord. Any help would be appreciated!

[bucanero]

I'm trying to import an Invizimals: Shadow Zone (EUR) save that's been downloaded from the internet that has most/all of the monsters captured:

https://gamefaqs.gamespot.com/psp/605208-invizimals-shadow-zone/saves https://www.thetechgame.com/Downloads/id=167762/eu-invizimals-shadow-zone-248-invizimals.html https://psp.brewology.com/gamesaves/savedgames.php?g=687802&l=I#a_687802 (These are all the same save)

...but the mismatched MAC address between the save file and the console (PPSSPP) it's being loaded on seems to be blocking the save from loading, and thus throwing the 8011036 error. Using the MagicSave plugin doesn't bypass the error either.

I used the SED plugin to decrypt the GAMEDATA file that's stored within the game's save folder: https://drive.google.com/file/d/1lbDAbtvaUVa4f0ZSuUSDbJr9oUuN_kjv/view?usp=share_link

When viewing the file in a hex editor, you can see all the decrypted monster names, which is a good sign, but I still don't see the MAC address anywhere in there.

Does anyone know where the save file's MAC address is located within the Invizimals: Shadow Zone save data files? If we can identify where the MAC address is hidden in the save files, we can change the MAC address in PPSSPP (or PSP) to match it, and thus theoretically successfully boot the save.

I was doing some research regarding these saves, so I'm sharing some notes in case it's useful:

For the record, the decrypted save file you shared has the following MAC address: 90:34:FC:25:09:D6
If you change PPSSPP's mac value to that address, the save will load correctly when playing Invizimals: Shadow Zone (UCES01411).
The mac value is stored in many places, but the first appearance is always at offset 0x34.

The save-data also has a hash checksum stored at offset 0x0C. I think they're using a custom CRC algorithm so that would need dedicated code reversing before any save-game editing can be done.

So right now, the only way to load that save is to change the MAC address, because even if you edit the save-data and replace all the mac address you find with another value, the CRC checksum will fail and the game will not start.

[hrydgard]

I suppose we could add a special hack that reads the MAC from the save and switches to it temporarily...

[bucanero]

I suppose we could add a special hack that reads the MAC from the save and switches to it temporarily...

I was doing some additional reversing of the original EBOOT to solve the Invizimals save-game checksum, and by luck I also found that developers left a flag at save-data offset 0x30. If it's 1 (default), it will check "wlan ownership", if it's 0, it will skip the "save owner" check.

Since I already reversed the custom checksum, I made and tested a simple tool that:

• patches the GAMEDATA file, setting flag at offset 0x30 = 0
• calculates the new checksum
• updates the new hash at offset 0x0C
• result: save is fully unlocked to be used on any PSP system 🎉

Btw, I checked invizimals titles UCES01411, UCES01525, UCES01581, UCUS98760 and all use the same save-data header structure, wlan mac address at offset 0x34, "psp check flag" at 0x30, custom checksum at 0x0C.
So I guess a hack could be added to support any of those titles.

On a side note about these locked saves: "SOCOM Fire team Bravo 2" also uses the wlan mac owner check. In FTB2, the mac addr is stored at offset 0x08. It has no checksum or any hash, so it can either manually updated or a hack could be added to emulate that value.

[henry-clasher]

I suppose we could add a special hack that reads the MAC from the save and switches to it temporarily...

I was doing some additional reversing of the original EBOOT to solve the Invizimals save-game checksum, and by luck I also found that developers left a flag at save-data offset 0x30. If it's 1 (default), it will check "wlan ownership", if it's 0, it will skip the "save owner" check.

Since I already reversed the custom checksum, I made and tested a simple tool that:

• patches the GAMEDATA file, setting flag at offset 0x30 = 0
• calculates the new checksum
• updates the new hash at offset 0x0C
• result: save is fully unlocked to be used on any PSP system 🎉

Btw, I checked invizimals titles UCES01411, UCES01525, UCES01581, UCUS98760 and all use the same save-data header structure, wlan mac address at offset 0x34, "psp check flag" at 0x30, custom checksum at 0x0C. So I guess a hack could be added to support any of those titles.

On a side note about these locked saves: "SOCOM Fire team Bravo 2" also uses the wlan mac owner check. In FTB2, the mac addr is stored at offset 0x08. It has no checksum or any hash, so it can either manually updated or a hack could be added to emulate that value.

Hello, how can I do that change from 1 to 0? In wich file is it write?

[bucanero]

Hello, how can I do that change from 1 to 0? In wich file is it write?

it's the only data file, GAMEDATA, but as I mentioned, it the save has a custom checksum hash, so you can't hack the save unless you also update the checksum.

Users with real PSPs can use Apollo Save Tool homebrew app to hack and unlock Invizimals and SOCOM2 saves directly on the PSP. I didn't test on emulators so no idea if it works or not outside real hardware.

If enough people need it, I might create a small checksum-fixer tool for Invizimals, that can be used on a PC

[henry-clasher]

Hello, how can I do that change from 1 to 0? In wich file is it write?

it's the only data file, GAMEDATA, but as I mentioned, it the save has a custom checksum hash, so you can't hack the save unless you also update the checksum.

Users with real PSPs can use Apollo Save Tool homebrew app to hack and unlock Invizimals and SOCOM2 saves directly on the PSP. I didn't test on emulators so no idea if it works or not outside real hardware.

If enough people need it, I might create a small checksum-fixer tool for Invizimals, that can be used on a PC

Yes, I´m talking about real hardware (PSP).
This is my situation: I have a save with every Invizimal (and resonances) that I completed on a PSP that stopped working, so I bought a new one and I wanted to able to see my monster list again but since the devs made this block and I dunno how to make the custom checksum.
If you are able to create the checksum-fixer tool for invizimals or have knowledge of any youtube video that explains it I would be very grateful!

[bucanero]

Yes, I´m talking about real hardware (PSP). This is my situation: I have a save with every Invizimal (and resonances) that I completed on a PSP that stopped working, so I bought a new one and I wanted to able to see my monster list again but since the devs made this block and I dunno how to make the custom checksum. If you are able to create the checksum-fixer tool for invizimals or have knowledge of any youtube video that explains it I would be very grateful!

If you have a PSP and can install and run homebrew apps, as I mentioned just install Apollo Save Tool , https://github.com/bucanero/apollo-psp/releases , then:

• run the app
• select the internal saves menu
• open your Invizimal save
• select the patch codes "Unlock Save", and "Update custom checksum"
• click "Apply changes & resign"

that's all, your save will be unlocked to be used on any PSP system, even emulators. Just in case, remember to make a backup of your Invizimal save before doing any changes, for safety.

Edit: here's the small PC tool I made to fix Invizimals save checksums and disable the copy-lock: https://github.com/bucanero/save-decrypters/tree/master/invizimals-checksum-fixer

[Isaaccc5053L]

I really didn't understand how to fix it and what happens if I play on PSP Vita? psp games

[DJKacu]

Yes, I´m talking about real hardware (PSP). This is my situation: I have a save with every Invizimal (and resonances) that I completed on a PSP that stopped working, so I bought a new one and I wanted to able to see my monster list again but since the devs made this block and I dunno how to make the custom checksum. If you are able to create the checksum-fixer tool for invizimals or have knowledge of any youtube video that explains it I would be very grateful!

If you have a PSP and can install and run homebrew apps, as I mentioned just install Apollo Save Tool , https://github.com/bucanero/apollo-psp/releases , then:

* run the app

* select the internal saves menu

* open your Invizimal save

* select the patch codes "Unlock Save", and "Update custom checksum"

* click "Apply changes  & resign"

that's all, your save will be unlocked to be used on any PSP system, even emulators. Just in case, remember to make a backup of your Invizimal save before doing any changes, for safety.

Edit: here's the small PC tool I made to fix Invizimals save checksums and disable the copy-lock: https://github.com/bucanero/save-decrypters/tree/master/invizimals-checksum-fixer

This is amazing. Unfortunately it only works for Shadow Zone and Lost Tribes, but not for the original Invizimals. There is no issue with using psp save files on the emulator, but save files from emulator won't work on PSP. It gives the same error message as the other games. Will you help with that too?

[bucanero]

This is amazing. Unfortunately it only works for Shadow Zone and Lost Tribes, but not for the original Invizimals. There is no issue with using psp save files on the emulator, but save files from emulator won't work on PSP. It gives the same error message as the other games. Will you help with that too?

I don't own the game so if you can provide some decrypted save data files from the game, and the title-id of this Invizimals edition, I can take a look at some point and see if they're using a similar protection or not.

You can use the emulator to get decrypted save data. (On real hardware you'll need Apollo save tool and the key dumper plugin)

[DJKacu]

Here you go. Title-id is UCES01241. Thanks for the help!
UCES01241.zip

[bucanero]

Here you go. Title-id is UCES01241. Thanks for the help! UCES01241.zip

I have reversed the custom checksum for this title (it's similar to the checksum in UCES01411 but uses a different magic value 0x88456799).
What I didn't find is any check to the mac address like the other games had, so I'm not sure if this game actually has a copy-lock, or the error was showing up for a different reason. (the game for example checks the save-game data version, if the save was created with a different game version it won't load)

If I have a chance I'll take another look, but at least on my tests with PPSSPP I could swap saves and inject save-data from other users with no issues. Also changing the mac address in the emulator had no effect on the game loading. (for example, if you changed the emulator mac-addr on Lost Tribes you'll get an error message)

[DJKacu]

Here you go. Title-id is UCES01241. Thanks for the help! UCES01241.zip

I have reversed the custom checksum for this title (it's similar to the checksum in UCES01411 but uses a different magic value 0x88456799). What I didn't find is any check to the mac address like the other games had, so I'm not sure if this game actually has a copy-lock, or the error was showing up for a different reason. (the game for example checks the save-game data version, if the save was created with a different game version it won't load)

If I have a chance I'll take another look, but at least on my tests with PPSSPP I could swap saves and inject save-data from other users with no issues. Also changing the mac address in the emulator had no effect on the game loading. (for example, if you changed the emulator mac-addr on Lost Tribes you'll get an error message)

I checked if there was another version of the rom and it turns out I got Invizimals (europe) v2 on the emulator. I searched another rom without v2 and tried to load the save on that one. It won't load, so I guess it is caused by different save-game data version. Unfortunately I made a back up of the wrong save, so now I am stuck with broken save file.

[bucanero]

I checked if there was another version of the rom and it turns out I got Invizimals (europe) v2 on the emulator. I searched another rom without v2 and tried to load the save on that one. It won't load, so I guess it is caused by different save-game data version. Unfortunately I made a back up of the wrong save, so now I am stuck with broken save file.

Thanks for the feedback, that explains the issue then. It's not a copy-lock protection, but a save-game version check.

From the game code I reversed, the v2 game should be able to load an older "v1"/"v0" save, but of course the old game v1 won't load any save from a higher version (v2, v3, etc). (save version value seems to be at offset 0x10 in GAMEDATA)

With the custom checksum fixer, you could in theory change the version value in the header to make the save "older", and then update checksum so the game loads it anyway, but I feel that you'll end up crashing the game or get weird results as the save data could be in a different structure than what the game expects.

I'll later update my checksum fixer to support UCES01241, in case someone needs it in the future.

[DJKacu]

I checked if there was another version of the rom and it turns out I got Invizimals (europe) v2 on the emulator. I searched another rom without v2 and tried to load the save on that one. It won't load, so I guess it is caused by different save-game data version. Unfortunately I made a back up of the wrong save, so now I am stuck with broken save file.

Thanks for the feedback, that explains the issue then. It's not a copy-lock protection, but a save-game version check.

From the game code I reversed, the v2 game should be able to load an older "v1"/"v0" save, but of course the old game v1 won't load any save from a higher version (v2, v3, etc). (save version value seems to be at offset 0x10 in GAMEDATA)

With the custom checksum fixer, you could in theory change the version value in the header to make the save "older", and then update checksum so the game loads it anyway, but I feel that you'll end up crashing the game or get weird results as the save data could be in a different structure than what the game expects.

I'll later update my checksum fixer to support UCES01241, in case someone needs it in the future.

I tried to import save file from the second rom (without any "v") from emulator to PSP and I got different error. This time game tells me that this file is corrupted on loading screen before I even try to load it, when the previous error was displayed after I try to load it, so I am kinda lost. If you provide the updated checksum fixer I will gladly try it, even if it may break some stuff.

In the meantime I will try to find what is the issue this time. Thank you for the help.

[bucanero]

I tried to import save file from the second rom (without any "v") from emulator to PSP and I got different error. This time game tells me that this file is corrupted on loading screen before I even try to load it, when the previous error was displayed after I try to load it, so I am kinda lost. If you provide the updated checksum fixer I will gladly try it, even if it may break some stuff.

In the meantime I will try to find what is the issue this time. Thank you for the help.

The updated checksum fixer can be found here. (Source code only)
Anyways, my suggestion would be to use the same game version on both the PSP hardware and the emulator, that way you won't have issues moving saves around.

[DJKacu]

Thank you for your help!
Yeah I didn't realise that I got different game versions until you pointed that out.

Last question and I won't bother you anymore. I'm not an IT guy, as you might have guessed, so how do I update checksum fixer? Should I patiently wait for the next apollo update or should I do what readme file suggests? (./invizimals-checksum-fixer 0 and put that into root folder or apollo folder?) Thanks in advance.

[bucanero]

Last question and I won't bother you anymore. I'm not an IT guy, as you might have guessed, so how do I update checksum fixer? Should I patiently wait for the next apollo update or should I do what readme file suggests? (./invizimals-checksum-fixer 0 and put that into root folder or apollo folder?) Thanks in advance.

It's only the source code, you'd have to build the application with a GCC compiler, and then run invizimals-checksum-fixer -0 GAMEDATA, but you also need to decrypt the save file before any fixing can be done. So unless you're very technical I guess the best would be to use Apollo Save Tool.

The checksum fix can be added easily to Apollo: if your PSP can connect online, go to "Settings", then "Update application data", the app should try to connect and download new patch files, including the Invizimals fix.

If that didn't work, just download this savepatch file https://github.com/bucanero/apollo-patches/raw/main/PSP/UCES01241.savepatch , and add it to the /PSP/GAME/APOLLO/DATA folder on the PSP memstick.

[anr2me]

I tried to import save file from the second rom (without any "v") from emulator to PSP and I got different error. This time game tells me that this file is corrupted on loading screen before I even try to load it, when the previous error was displayed after I try to load it, so I am kinda lost. If you provide the updated checksum fixer I will gladly try it, even if it may break some stuff.
In the meantime I will try to find what is the issue this time. Thank you for the help.

The updated checksum fixer can be found here. (Source code only) Anyways, my suggestion would be to use the same game version on both the PSP hardware and the emulator, that way you won't have issues moving saves around.

Btw, you have build.yml and build-win.yml on your repo, right? why not builds the invizimal-checksum-fixer from those workflows too?