Recovering a save corrupted by a Super UFO Pro 8?

[mrmxy]

At this point I don't think this save is recoverable, but I'm posting this here anyway mostly as a cautionary tale about dumping saves with the Super UFO Pro 8, since I haven't found any other mention of this specific issue.

I've dumped saves from two RPG Tsukuru 2 carts with the Super UFO, one of which was very interesting because it had a full Evangelion-themed user game in it (I was thinking of making a Satellaview-style Evangelion character pack for it since that's easy enough).

Cart 1: Dumped the save and at first it didn't work on emulator, plus the cart itself now appeared to have no saves. I looked at it with a hex editor and noticed the first characters were "UFO¥" while all other Tsukuru 2 saves I have start with "SHVC." Changed it to "SHVC" and the save now works. Flashed it back to the cart with the Super UFO and the cart is back to normal.

Cart 2 (the one with the Evangelion save): I followed the exact same procedure: dumped the save, it didn't work, so I changed "UFO¥" to "SHVC." However, it still doesn't work. Here's where I think I screwed up: I booted the cart to check if it still had the save (it didn't) and I think in doing so, I caused it delete anything that might have remained of it. So now I'm stuck with this non-working save.

Looking at the save more closely, I noticed that after a certain point, it's identical to the first cart's fixed save, the one I flashed back to the cart. So I think the UFO for some reason dumped only the beginning of the second cart's save, and the rest is just what was already in the UFO's memory. That's why I'm assuming there's no way to recover the save now. I've tried dumping it again with different settings and it didn't seem to produce anything useful, but if anyone familiar with the UFO has any suggestions I'm all ears.

I'm attaching the first cart's save in fixed form (the only difference is changing "UFO¥" to "SHVC"), the second cart's non-working Franken-save, and some screenshots I took of the Evangelion game before I ruined it.

[Dwedit]

It's really easy to look back and say that you shouldn't have attempted the second save dump after the first save got corrupted, but you had managed to recover the first, and had a way to attempt the second that seemed safe enough. But yeah, stick with safe dumping tools that aren't writing to save memory at all.

[Pokun]

I see, the game formatted the memory when noticing it had a corrupt signature.
So this Super UFO Pro 8 is sticking its own header into save files it dumps, ruining the signature? Yeah sounds like it's better avoided regardless.

Good to know, I happen to have this game and may want to dump such memory packs in the future.

[mrmxy]

I've dumped saves for other games before and it never seemed to change the header (the carts continued working normally and the saves worked on emus), but yeah, probably best to avoid it. I can't find any previous mention of this issue, let alone which specific carts it might affect. I feel dumb for being overconfident and assuming I could fix the corrupted save every time, but I'm hoping at least this thread prevents it from happening to others.

[Joe]

I've tried dumping it again with different settings and it didn't seem to produce anything useful

Did it produce anything different? If you're really lucky, some of the save data might still be intact.

[mrmxy]

Setting SRAM to 1MB while dumping produces a save that looks exactly like an empty one made in an emu up to offset 4C00, where it starts showing different data. I compared it to the data in various other Tsukuru 2 saves (I have about 60 I've found online) and they all have parts that look the same, but this one looks completely different. That's why I'm assuming this isn't data from the missing save (maybe it's from some other game's save I'd dumped or flashed before, somehow?). I pasted the different data at 4C00 in the corrupted save just in case, but it still didn't work. I'm attaching this save here in case anyone wants to take a look.

[Joe]

At least some of that data belongs to the Evangelion save. For example, the script for Shinji joining your party is around A1A0:

Code: Select all

？？？：あ、あれ？
　　　　ぼくはなにを……。

クラウド：おまえのなは？

？？？：…，シ…ンジ。
　　　　シンジです。

マサキ：どうやら、魔王城を
　　　　けしたのは、こいつの
　　　　ようだな。

シンジ：え！！ぼくは
　　　　いったいなにを…

クラウド：きおくがないようだ
　　　　　な。どうだ、
　　　　　おれたちといっしょ
　　　　　にこないか？

シンジ：………，…はい…。

シンジがなかまになった！

...But I have no idea how to make a working save out of it.

[mrmxy]

Oh wow! The broken save is unique until 2000, so maybe 2000-4C00 is "all" that is lost? Incidentally, by playing around with some saves, I noticed that 20B0-2460 seems to be where characters are stored (there's a bit at 20B0 that changes if any character is edited or modified, so I guess that's a checksum?).

I remember there were four characters in the party. Based on the screenshot I took and that text you pasted, it looks like they were レイ, クラウド, マサキ, and シンジ. What do you use to look at the Japanese text? I'd like to see what other info is there to try to reconstruct as much as possible.

[Joe]

I used a hex editor and a translation table. I made the table based on the game's font, but my table is incomplete, so some characters won't appear correctly. (Are there any good hex editors that support translation tables?)

[Pokun]

Is it some kind of cross-over game? It was admittedly a long time ago the last time I saw the Evangelion anime, but I don't remember it having Masaki, Cloud or any demonlords.

[mrmxy]

The creator was working with the very limited Tsukuru 2 sprites (none of which are very Evangelion-ish), so yeah, I guess he had to get creative with it.

I used a hex editor and a translation table. I made the table based on the game's font, but my table is incomplete, so some characters won't appear correctly. (Are there any good hex editors that support translation tables?)

I found this one just trying to find something to look at the Japanese the text, but I don't have enough experience with hex editors to know if it qualifies as "good."

[Pokun]

I've used Windhex a long time ago and I think it was quite good. It's a pretty normal hex editor except that it can take tables and display Japanese.

[JLukas]

Here's some findings after taking a look at the .srm files posted above and investigating the save file structure. As was already determined, for some reason the UFO only dumped the first 8192 bytes of the Evangelion RPG2.zip save. Then when you booted the cart it immediately saw the first bytes didn't match the expected SHVC signature, and reset everything up to offset $4C07 back to a default blank save (the same effect as selecting the option Wipe All Data in the menu). Everything up to that point is fixed length blocks of data as detailed below. Offset $4C08-FFFF contains all the user created Event data which fortunately is not included in the erasing process and is why it's recoverable from the RPG2_1MB.zip save. In fact, the only way to wipe that space is to use the option to load the developer's sample built-in game, which copies the entire last 0.5 megabit of ROM over to SRAM.

The save file structure

Code: Select all

Start   End     Length Description
70:0000 70:0017 0x0018 SRAM header
70:0018 70:0019 0x0002 main CRC
70:001A 70:001A 0x0001 increments by 1 when exiting a menu
70:001B 70:0062 0x0048 TITLE
70:0063 70:0099 0x0037 ???
70:009A 70:009E 0x0005 PREFS 70:009C CURSOR 02-0A, 70:009D BGM 00-1E, 70:009E FE STEREO FF MONO
70:009F 70:02BE 0x0220 SAVE SLOT 1
70:02BF 70:04DE 0x0220 SAVE SLOT 2
70:04DF 70:06FE 0x0220 SAVE SLOT 3
70:06FF 70:0E71 0x0773 ITEMS
70:0E72 70:11B3 0x0342 MAGIC
70:11B4 70:20BD 0x0F0A ENEMY 70:11B6-70:11BD unknown, 70:11BE-70:20BD 0x28 bytes per enemy 0x60 total
70:20BE 70:24B2 0x03F5 CHARACTER
70:24B3 70:2EEB 0x0A39 ENEMYMAP
70:2EEC 70:4AF7 0x1C0C MAP
70:4AF8 70:4C07 0x0110 EVENTS - used space values, ???
70:4C08 70:FFFF 0xB3F8 EVENT data

The data in range $70:2000-70:4C07 is lost. That means all characters, maps, and the enemy encounter map. The enemies are almost all still present but since that data block includes $70:2000-70:20BD, the enemy EVENT 28 is incomplete/corrupt, and enemies EVENT 29, EVENT 30, EVENT 31, EVENT 32 are lost.

At boot up have Pro Action Replay codes 889A6F80 and 889ACB00 active to bypass the CRC checks to allow the Evangelion save to boot. The Character, EnemyMap, Map and last 5 entries of the Enemy block will all need to be erased to remove the unrelated data.

The last remaining issue is the data in the 70:4AF8-70:4C07 range. This includes the amount of space each event uses, and appears to use that to calculate the pointer to it. The game didn't bother to wipe all the data up to $70:FFFF because erasing just this block has the same effect. Similar to using the Quick Format option on a PC. It should be possible to reconstruct this table but more research will be required.

[mrmxy]

Thank you for all that information, that's incredible. My hope at this point is being to at least recover the game text, so this is hugely useful.

I've tried enabling the Action Replay codes on bsnes, snes9x, Mesen, and SNES on a combined save with the first 8192 bytes of the RPG2 save and the stuff after 4C08 in the 1MB save, but the game still "blanks" the save. Did it work for you with a save like that or a different one?