TLDR: Editing the roster update save file "corrupts" the file - even after updating the CRC32 at 0x10. There seems to be another one at 0x60, but I haven't figured out what it is or what it's calculated from. Help would be MUCH appreciated, as I have sunk many hours into this and am at risk of quitting.
Recently I've been putting a lot of time into hacking NBA Jam On Fire Edition for PS3. I'm currently at a mid-way point where I know exactly what I want to change, where it is stored, and how it is stored - but most of it can't be changed because of file protections.
This isn't to say that nothing has been accomplished. I could tease you with screenshots of LeBron and AD on the Lakers, wearing Lakers jerseys, with updated headshots. But most of what I have right now is one-off hacks that doesn't accomplish what everyone really wants: to be able to change all of the ratings, rosters, logos, jerseys, and courts in the game.
I think the first thing to solve is the downloadable roster update save. This save 'NPUB305580200' contains three files:
- ICON0.PNG (save file image - not useful)
- PARAM.SFO (PS3 system file, contains system protections but not protection within the game - doesn't seem useful)
- SYS-DATA
'SYS-DATA' has two payloads (It has two "BGFA1.05" headers). The first is at 0x20 and contains XML files; the last XML file is the roster update file and the rest are Road Trip (campaign mode) matchup definitions. The second is at 0xb90a and contains graphics and other types of files (e.g. TEX, DIF). All files within are compressed with deflate/zlib. If the two payloads are split into separate files, they can be extracted with 'nbajamfire.bms' using QuickBMS.
'ROSTERUPDATE' is the XML roster update file. It defines changes to be applied to the roster database. For testing, I'm simply changing one player rating. I've also tried modifying the "RC" files, as they can be successfully changed in the base game.
The problem is that when the save file is modified, the game says that file is damaged and can't be loaded. The extraction/decompession/recompression process seems to work fine, as I can extract a file from SYS-DATA, decompress it, recompress it, and get the same CRC as the compressed file. The problem seems to be the security of 'SYS-DATA'.
There is at least one checksum in SYS-DATA, at 0x10. This is a CRC32 of 0x1c - EOF. It looks like there's another checksum immediately before the list of XML files, at 0x60-0x63 ("D9B6E58F"). I bet this is just for the first payload, but I haven't found anything yet that matches this. I can't find a range with CRC32 or BZIP2 CRC that equals this. Other than these checksums, I don't see anywhere else where the file could be protected.
It would be great if someone could help with getting past the security of this roster update save file. Once this can be edited, I have a few projects lined up. But I've already put many hours into this, and I'd be lying if I didn't say that I'm burning out and might quit soon. If you have any experience with checksums, please take a look and reach out to me if you have any questions.
Here are the save files: https://mega.nz/#!zUk0WSQI!rfW6whpIKkNt ... RaylrcgJAc