Hacking RPG Maker DS/DS+: password hacking?

YuukiNandesyouka

Member
OP
Newcomer
Joined
Apr 17, 2021
Messages
9
Trophies
0
Age
27
XP
78
Country
China
So I found tons of fan-made games using RPG Maker DS (RPG tkool DS) and RPG Maker DS+ on https://ux.getuploader.com/tkoolds/ , they're .sav files and you could load them as normal sav file.
But the problem is, many of them are locked with password, so you can't edit them. Is there a way to hack the game or sav file so that you can passthrough the password?
For example, you could use RPG Tkool DS (Japan) to load this game: https://ux.getuploader.com/tkoolds/download/76, and it's locked too.
I'm not familier with hacking, I tried RAM searching but no luck, maybe I didn't do it right. Can you help me?
 

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,348
Country
United Kingdom
There are multiple approaches they could have used here.

The most basic would have been a flag. That is to say a small area you put to 1 or 0 depending upon whether it is edit locked.
This sort of thing is fig leaf security but it is common enough in things that don't matter or would be complicated to handle otherwise.
Easy enough to try this. Make a level (does not matter what). Save it. Grab the save. Go back, password the level (maybe even remake from scratch if it was simple enough). Grab the save and compare. Any differences then being what you want to look at.

Sorting this gets harder. You might have to learn the save checksum/hash routine and fix that, or stop the checksum from mattering ("compare checksum to stored checksum if equal then proceed to works outcome if not equal then proceed to invalid save" can so easily be tweaked to always take the valid checksum path, with the added bonus that the game will probably fix it for you next time it saves and can be exported back to a unmodified game). Of course if the password itself it not going to be a dissimilar concept (check if good, if not then... yeah) then you can possibly attack the password aspect itself -- find where the save is loaded into RAM to be operated upon and then you will know where the password part is stored, easy enough to nerf it that way.
If it is a basic flag then you might find where the save lands in memory and some time between the copy and the final load you might be able to disable the flag. Timing of things can be tricky here but you might also be able to do it manually if you play around a bit and find out if it does not do anything with read only flags before.

Passworded however does not mean encrypted (data unreadable, indeed that the game can be played but not edited would speak to a lack of encryption worth much). To this end some might find the data of the level (be it in RAM or in save) and export that around to create a "new" level.

You might even get lucky and find the password stored in the save in something you can read or maybe bypass on the PC side of things. As before you are going to want many saves, I don't know if you set passwords or they are generated. If they are set then you are going to want to make save, set password as AAAA or whatever and then AAAB and then AAAC... to get an idea of where the password is stored in the save. In an ideal world it will be in some kind of plaintext, if the devs were slightly tricky they might do some maths on it to change things and make that harder and in big boy security they would have done some kind of salted hash (storing passwords is bad for what are hopefully obvious reasons, storing a unique hash of the password and an extra random piece of data such that the game does not know the password but can be mathematically sure of the right one being entered is good).
If it is a hash then you might get to play rainbow tables instead. AAAA through ZZZZ is a lot to write out by hand but trivial for a modern computer, more characters (maybe lower case and numbers and punctuation) and longer passwords make things harder but the chances of a DS game having high end takes here are slim. At this point you look up the hash and find the/a matching password.

Other than the cheat based flag or plaintext stored password I don't know if I would suggest it for a first project as most of that will see you run into at least light assembly work. If however it is going to be the thing that gives the project some sticking power for you then go for it.

A minor note on wear levelling. Saves for things with valuable saves will possibly have two slots for it and alternate between the two to both stop one section from being written all the time and also providing something of a "lost progress since last save" backup but better a couple of hours than a couple of weeks of work. To this end the naive compare two files of a hex editor might not work. Find what sections constitute these sections/slots and rip those out to compare to relevant parts, or save twice (or more if it is weird and has many slots) such that it ends up back at the main slot.
 
  • Like
Reactions: ILuvGames

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • K3Nv2 @ K3Nv2:
    Nearly 4 hours without power :(
  • Veho @ Veho:
    SO POWERLESS
  • K3Nv2 @ K3Nv2:
    Tell Kanye I need power
  • DinohScene @ DinohScene:
    Better start running in your hamster wheel
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Meth addicts on a treadmill connected to a generator "Unlimited POWER!!!'
  • Veho @ Veho:
    Before or after a hit?
    +1
  • Veho @ Veho:
    Do you dangle a baggie in front of them, like a carrot?
    +1
  • The Real Jdbye @ The Real Jdbye:
    they're the same thing
    +1
  • The Real Jdbye @ The Real Jdbye:
    i like that idea
    +1
  • Veho @ Veho:
    What's the same thing?
    +1
  • The Real Jdbye @ The Real Jdbye:
    before or after a hit
    +1
  • Veho @ Veho:
    Nah, a hit gives them mad meth powers, but makes them more difficult to control.
    +1
  • Veho @ Veho:
    Before a hit they're like zombies, persistent but slow.
    +1
  • Veho @ Veho:
    It's a tradeoff.
    +1
  • The Real Jdbye @ The Real Jdbye:
    no i mean, before a hit is after the previous hit
    +1
  • The Real Jdbye @ The Real Jdbye:
    if you keep them well enough fed, it's the same thing
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    By the power of Florida Man, I have the power!!! *Lifts up meth pipe* Meth Man!!! lol
  • BakerMan @ BakerMan:
    Guys, I just learned my little brother is in the hospital because he had a seizure last night.
  • cearp @ cearp:
    Sorry to hear that BakerMan
    +2
  • BakerMan @ BakerMan:
    Just found out he's doing alright, doing a lot of complaining too, rightfully so. Who wouldn't complain after having a seizure and being hospitalized?
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Glad he is OK and complaining is cool :)
    +1
  • K3Nv2 @ K3Nv2:
    Yeah been there had that no fun
    +1
  • K3Nv2 @ K3Nv2:
    They'll give him sleep studies eegs and possibly one week hospital stay
    K3Nv2 @ K3Nv2: They'll give him sleep studies eegs and possibly one week hospital stay