Gears of War Gears Of War 3 Save Research

[ozzycow54 17]

One day I got bored and decided to mod a Gears of War 3 save. I found out that Horizon was the only public way to mod GOW3 saves, so I fired up HxD and this is what I found:

I opened the CON in HxD and searched for my current save (sp_wreckage) which was in the second save slot. I found a few strings, such as weapons, current character, and objectives.

Modified Save

What I looked into was weapons. Four bytes after each weapon string looks like a value. When I looked at the original, clean save, the numbers were either VERY close to the amount of ammo I had in that weapon, or exactly the amount. I changed each of them to FF and saved. After injecting and rehash/resigning in Modio, I loaded up Gears of War 3 and looked at the slot my save had been in. It was gone. It simply didn't appear. After testing seven times with different saves, the save doesn't appear. I don't really have an idea of how to fix this, it's be great if someone could help me out. Thanks!

[AMD 885]

Sounds to me like the save file is hash-protected. Can you send me a couple of different save files to take a look at?

[ozzycow54 17]

Sounds to me like the save file is hash-protected. Can you send me a couple of different save files to take a look at?

Sure, I'll have them up soon.

[Thunder 468]

If I recall, gow3 does have a some sort of checksum check.

[ozzycow54 17]

If I recall, gow3 does have a some sort of checksum check.

It's a custom check by the developers, so I think we'll have to start searching in the .XEX and trying to find out how this works.

I found the checkpoint strings:

And this looks interesting:

[AMD 885]

It's a custom check by the developers, so I think we'll have to start searching in the .XEX and trying to find out how this works.

I found the checkpoint strings:

And this looks interesting:

You're looking at the STFS package there; you're not going to find anything useful unless you extract it.

At a first glance, it looks like there might be some sort of MD5 hash following the map name at the beginning of each checkpoint file (16 bytes of random-looking data there, MD5 hashes are 16 bytes large, and I know Gears uses MD5 for some other stuff), but I can't find what's being hashed or whether or not it's salted.

[ozzycow54 17]

At a first glance, it looks like there might be some sort of MD5 hash following the map name at the beginning of each checkpoint file (16 bytes of random-looking data there, MD5 hashes are 16 bytes large, and I know Gears uses MD5 for some other stuff), but I can't find what's being hashed or whether or not it's salted.

I noticed that, it seems pretty weird how this is working though...

Edited December 20, 2011 by ozzycow54

[ozzycow54 17]

You're looking at the STFS package there; you're not going to find anything useful unless you extract it.

At a first glance, it looks like there might be some sort of MD5 hash following the map name at the beginning of each checkpoint file (16 bytes of random-looking data there, MD5 hashes are 16 bytes large, and I know Gears uses MD5 for some other stuff), but I can't find what's being hashed or whether or not it's salted.

It's been a long time since I've been working on this. I'm stumped. AMD, have you looked at it recently?

[AMD 885]

It's been a long time since I've been working on this. I'm stumped. AMD, have you looked at it recently?

Not really, but I may sometime soon. I'm stumped too, Reach was actually fairly easy to figure out.

[Thunder 468]

Not really, but I may sometime soon. I'm stumped too, Reach was actually fairly easy to figure out.

It's more of an issue with the fact that this is a different game. We all really only halo's engine setup. Epic's is something new.

[ozzycow54 17]

It's more of an issue with the fact that this is a different game. We all really only halo's engine setup. Epic's is something new.

Yeah, I know. I really suck at hashing, so me failing to find the method of it isn't saying much :/ I was hoping someone would help me figure it out so I could write a program to mod GoW 3 saves so people don't have to pay for Horizon (not sure if a lot of people still play GoW 3 though ).

[deadcanadian 271]

Yeah, I know. I really suck at hashing, so me failing to find the method of it isn't saying much :/ I was hoping someone would help me figure it out so I could write a program to mod GoW 3 saves so people don't have to pay for Horizon (not sure if a lot of people still play GoW 3 though ).

i play gears all the time, mostly horde though.

although a gamesave editor may be abit of fun time from time for some things like RAMM dlc