PS3 Need help modifying Assassin's Creed II save file

[bucanero]

@bucanero ok took a look a normal saves now, they use different values, AC2_0.SAV uses
poly=0x4c11db7
init=0xbae23cd0
xorout=0xffffffff
and this generates the correct hash for those types of saves, not sure why they use different values for OPTIONS but it appears they do, anyway that should blow AC2 open for anyone wanting to hex edit the game saves.

amazing, thanks for sharing the details. Based on your information, I also reversed the custom CRC32 used on Assassin Creed 1 saves. (PS3)

On AC1 they used the same header structure, 4 bytes for size (big endian) + 4 bytes CRC32, + data.
They also used 2 different crc setups for OPTIONS.DAT and SAVEGAME.DAT

AC1 SAVEGAME.DAT , is exact same crc as AC2_0.SAV:
poly=0x4c11db7
init=0xbae23cd0
xorout=0xffffffff
input + result reflected
range=data size (value on 0x00) starting from 0x08

AC1 OPTIONS.DAT, similar to AC2, but with a different xorOut value, for AC1 is 0x313F7650
poly=0x4c11db7
init=0x0
xorout=0x313F7650
input + result reflected
range=data size (value on 0x00) starting from 0x08

I'll post BSD scripts for AC1 and AC2 checksums next, after I test with Apollo CLI

 

[bucanero]

BSD scripts to fix checksum on Assassins Creed 1 (PS3) and Assassins Creed 2 (PS3):

AC1

; AC1

:OPTIONS.DAT
[Update Custom CRC32 OPTIONS.DAT (Required)]
set crc_bandwidth:32
set crc_polynomial:0x4C11DB7
set crc_initial_value:0
set crc_output_xor:0x313F7650
set crc_reflection_input:1
set crc_reflection_output:1
set [size]:read(0x00,4)
set range:0x0008,[size]+7
set [hash]:crc
write at 0x0004:[hash]

:SAVEGAME.DAT
[Update Custom CRC32 SAVEGAME.DAT (Required)]
set crc_bandwidth:32
set crc_polynomial:0x4C11DB7
set crc_initial_value:0xbae23cd0
set crc_output_xor:0xFFFFFFFF
set crc_reflection_input:1
set crc_reflection_output:1
set [size]:read(0x00,4)
set range:0x0008,[size]+7
set [hash]:crc
write at 0x0004:[hash]

AC2

:AC2_0.SAV
[Update Custom CRC32 AC2_0.SAV (Required)]
set crc_bandwidth:32
set crc_polynomial:0x4C11DB7
set crc_initial_value:0xbae23cd0
set crc_output_xor:0xFFFFFFFF
set crc_reflection_input:1
set crc_reflection_output:1
set [size]:read(0x00,4)
set range:0x0008,[size]+7
set [hash]:crc
write at 0x0004:[hash]

:OPTIONS
[Update Custom CRC32 OPTIONS (Required)]
set crc_bandwidth:32
set crc_polynomial:0x4C11DB7
set crc_initial_value:0
set crc_output_xor:0x1bf3278a
set crc_reflection_input:1
set crc_reflection_output:1
set [size]:read(0x00,4)
set range:0x0008,[size]+7
set [hash]:crc
write at 0x0004:[hash]

 

[ChestnutEnjoyer]

Been working at this all afternoon, kept feeling i was close and also nearly smashed my keyboard, but i think i finally have it, its a CRC32 with a poly=0x4c11db7 xorout=0x1bf3278a and with this i should now be able to hex edit the OPTIONS file, So far i have only checked the files i already knew their CRC's (so i am able to replicate the crc i already know if i remove the first 8 bytes and then use this algo), but now i am going to test it now and i will reply soon hopefully with good results

EDIT- Ok just did a first test, and its working, switched language then saved, then removed the first 8 bytes then hex edited the OPTIONS then turned subtitles back on and recalculate the checksum, and the save loads, so we can now hex edit saves for AC2
Going to take the dog for a walk now then when i get back i will eat and then feed the dog then i will get back to trying to get the uplay map working, i think i can already see the correct byte in the OPTIONS

Oh my god, you did it!!!! I'll apply it to my game this weekend. Thank you so much everyone in this thread.

By the way, @Devildwarf , may I ask how did you figure out the algorithm and the parameters? I'm very curious about it

 

[Devildwarf]

amazing, thanks for sharing the details. Based on your information, I also reversed the custom CRC32 used on Assassin Creed 1 saves. (PS3)

On AC1 they used the same header structure, 4 bytes for size (big endian) + 4 bytes CRC32, + data.
They also used 2 different crc setups for OPTIONS.DAT and SAVEGAME.DAT

AC1 SAVEGAME.DAT , is exact same crc as AC2_0.SAV:
poly=0x4c11db7
init=0xbae23cd0
xorout=0xffffffff
input + result reflected
range=data size (value on 0x00) starting from 0x08

AC1 OPTIONS.DAT, similar to AC2, but with a different xorOut value, for AC1 is 0x313F7650
poly=0x4c11db7
init=0x0
xorout=0x313F7650
input + result reflected
range=data size (value on 0x00) starting from 0x08

I'll post BSD scripts for AC1 and AC2 checksums next, after I test with Apollo CLI

Nice, im glad it was useful for AC1 too, i wonder if AC2 Brotherhood and Revelations are the similar too (i have them too on ps3 but never looked at their saves, maybe at the weekend) and other AC games for PS3, great work on those scripts

Oh my god, you did it!!!! I'll apply it to my game this weekend. Thank you so much everyone in this thread.

By the way, @Devildwarf , may I ask how did you figure out the algorithm and the parameters? I'm very curious about it

Well to start with i just looked at a save for AC2 and the save was fairly similar to PC but had different headers so i then loaded a save and ran to a different map then saved again and looked at the new save to see what had changed, and a lot had changed, so i did it again with something smaller, like just buying some daggers and this time it was much smaller changes in the save file, but i noticed even if the file stayed the same the header changed between bytes 0x4-0x7 but 0x0-0x3 didn't so this made sense it was the checksum, but with files of different sizes i noticed the first 4 bytes changed and it appeared to be nearly the exact same filesize but -8 bytes so it seemed kinda obvious this was the size of the file minus the checks,
Next i moved onto looking into the checksum, its 4 bytes so it was some kind of CRC32 which is great, the longer the checksum the harder it is to figure out, so i then set around trying all normal algorithms but none worked so my next step was to ask ChatGPT for some ideas and gave it the file so it could examine it and also gave it the checksum since we already knew it and asked it if it could work it out to the checksum i had given it, and ChatGPT claimed it had figured out the checksum and how it was calculated and wrote me a script so i thought i was done, BUT the script didnt work at all, it was just a generic CRC32 script so after trying about 200 times with ChatGPT and got nowhere and nearly broke my keyboard and added about £200 to the swear jar i decided to change tactics and asked me dog if she knew, she just looked at me funny and brought me a ball....... so after that didnt work i started looking into reversing or bruteforcing CRC32's there is a few useful tools out there to help with it, i tried Bruteforcing it first but after hours and constantly changing parameters i was getting nowhere fast so i decided to try some reversing tools until i found one that worked but only on linux so i then had to fix my old laptop to get it into a working state (i could have installed a VM but i thought fixing my laptop would be better) and ran it, it gave me lots of different results because i was first thinking the OPTIONS and .SAV would be the same so i was comparing them which was a stupid move and cost me more hours, eventually after just comparing OPTIONS that had small changes then messing with the parameters of the program (delsum) it was able to figure it out and it worked in game after rebuilding the file manually, then i later did the same for .SAV and now im currently trying to port the program to windows for future use.
Anyway thats how it happened and sorry if i waffled on a little there. And Special thanks to bucanero for the scripts and speeding up my CRC checking method.

 

[ChestnutEnjoyer]

Nice, im glad it was useful for AC1 too, i wonder if AC2 Brotherhood and Revelations are the similar too (i have them too on ps3 but never looked at their saves, maybe at the weekend) and other AC games for PS3, great work on those scripts



Well to start with i just looked at a save for AC2 and the save was fairly similar to PC but had different headers so i then loaded a save and ran to a different map then saved again and looked at the new save to see what had changed, and a lot had changed, so i did it again with something smaller, like just buying some daggers and this time it was much smaller changes in the save file, but i noticed even if the file stayed the same the header changed between bytes 0x4-0x7 but 0x0-0x3 didn't so this made sense it was the checksum, but with files of different sizes i noticed the first 4 bytes changed and it appeared to be nearly the exact same filesize but -8 bytes so it seemed kinda obvious this was the size of the file minus the checks,
Next i moved onto looking into the checksum, its 4 bytes so it was some kind of CRC32 which is great, the longer the checksum the harder it is to figure out, so i then set around trying all normal algorithms but none worked so my next step was to ask ChatGPT for some ideas and gave it the file so it could examine it and also gave it the checksum since we already knew it and asked it if it could work it out to the checksum i had given it, and ChatGPT claimed it had figured out the checksum and how it was calculated and wrote me a script so i thought i was done, BUT the script didnt work at all, it was just a generic CRC32 script so after trying about 200 times with ChatGPT and got nowhere and nearly broke my keyboard and added about £200 to the swear jar i decided to change tactics and asked me dog if she knew, she just looked at me funny and brought me a ball....... so after that didnt work i started looking into reversing or bruteforcing CRC32's there is a few useful tools out there to help with it, i tried Bruteforcing it first but after hours and constantly changing parameters i was getting nowhere fast so i decided to try some reversing tools until i found one that worked but only on linux so i then had to fix my old laptop to get it into a working state (i could have installed a VM but i thought fixing my laptop would be better) and ran it, it gave me lots of different results because i was first thinking the OPTIONS and .SAV would be the same so i was comparing them which was a stupid move and cost me more hours, eventually after just comparing OPTIONS that had small changes then messing with the parameters of the program (delsum) it was able to figure it out and it worked in game after rebuilding the file manually, then i later did the same for .SAV and now im currently trying to port the program to windows for future use.
Anyway thats how it happened and sorry if i waffled on a little there. And Special thanks to bucanero for the scripts and speeding up my CRC checking method.

I have really enjoyed reading this lol. Thanks for sharing it! By the way, if you are using Windows 11 I think you can use WSL2 to run Linux stuff on Windows.

I think there is more unlockable stuff in AC brotherhood from a Facebook game that was closed years ago. I think it was an outfit. I will try to unlock it this weekend!

 

[bucanero]

Nice, im glad it was useful for AC1 too, i wonder if AC2 Brotherhood and Revelations are the similar too (i have them too on ps3 but never looked at their saves, maybe at the weekend) and other AC games for PS3, great work on those scripts

oh, actually you're right, probably AC Brotherhood and Revelations could be using the same kind of CRC checks on the saves, since they're using the same engine and are pretty much similar to AC2.

I'd suggest doing a quick check, with a decrypted save and options.dat, see if the header follows the same pattern "4 bytes size + 4 bytes CRC". If that's true, then they are probably similar and the only thing left to figure out is the XorOut value or the init Value. (you can also test the values we have for AC1 and AC2 first just in case, they might work)

 

[bucanero]

@ChestnutEnjoyer i have got into the Uplay map now, just required 5 bytes changing (4 for checksum and 1 for the actual enabling) in the OPTIONS and now we can get in just use the site above with my settings and you can rewrite the checksum easily (or if you need me too i can post a OPTIONS save), posting a screenshot of the door working on the ps3 version.

btw, which byte offset needs to be changed to enable the Uplay map?
If you can share the offset I can make a short BSD code to hack the save with Bruteforce savedata.

 

[Devildwarf]

I have really enjoyed reading this lol. Thanks for sharing it! By the way, if you are using Windows 11 I think you can use WSL2 to run Linux stuff on Windows.

I think there is more unlockable stuff in AC brotherhood from a Facebook game that was closed years ago. I think it was an outfit. I will try to unlock it this weekend!

I use windows 10 and it does have WSL2 but i always had problems with it, i much prefer a actual linux system or a VM i can just drag and drop into.
Also if its only a outfit im not that bothered, i mean sure its good if we can get it working but its not as important as a map or actual decent content.

oh, actually you're right, probably AC Brotherhood and Revelations could be using the same kind of CRC checks on the saves, since they're using the same engine and are pretty much similar to AC2.

I'd suggest doing a quick check, with a decrypted save and options.dat, see if the header follows the same pattern "4 bytes size + 4 bytes CRC". If that's true, then they are probably similar and the only thing left to figure out is the XorOut value or the init Value. (you can also test the values we have for AC1 and AC2 first just in case, they might work)

I might take a look at the weekend but if you check before then let me know

btw, which byte offset needs to be changed to enable the Uplay map?
If you can share the offset I can make a short BSD code to hack the save with Bruteforce savedata.

It's in the OPTIONS at 0x498 (see picture, highlighted in blue, 00 for disabled and 01 for enabled)

 

[bucanero]

It's in the OPTIONS at 0x498 (see picture, highlighted in blue, 00 for disabled and 01 for enabled)

great, here's a code for Bruteforce savedata:

:OPTIONS
[Enable Auditore crypt Uplay map]
00000498 00000001

(note: use this code and the CRC fix code to mod the save)

 

[Devildwarf]

great, here's a code for Bruteforce savedata:

:OPTIONS.DAT
[Enable Auditore crypt Uplay map]
00000498 00000001

(note: use this code and the CRC fix code to mod the save)

Great work, 1 small question though, why OPTIONS.DAT ? the file for AC2 is just OPTIONS without a file extension

 

[bucanero]

Great work, 1 small question though, why OPTIONS.DAT ? the file for AC2 is just OPTIONS without a file extension

oh my bad , I was doing copy paste from the AC1 codes and didn't pay attention to that.

I'll update codes for AC2 and remove the extension

Edit: AC2 code fixed

Edit-2: confirmed that at least v1.02 of AC2 is encrypting save-games. The secure key is:

0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

 

[Devildwarf]

oh my bad , I was doing copy paste from the AC1 codes and didn't pay attention to that.

I'll update codes for AC2 and remove the extension

Edit: AC2 code fixed

Edit-2: confirmed that at least v1.02 of AC2 is encrypting save-games. The secure key is:

0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

Hahahahahaha easy enough to do, i just finished finding my other AC games and i will go through them at the weekend and see if there saves are the same, i never noticed my disc of revelations actually includes AC1 too (i have it on 360 where i originally played that and AC2 but played the rest on PS3), do you happen to know if any of these games already been looked at ? i wont waste my time if people already know how to edit them.

 

[bucanero]

Hahahahahaha easy enough to do, i just finished finding my other AC games and i will go through them at the weekend and see if there saves are the same, i never noticed my disc of revelations actually includes AC1 too (i have it on 360 where i originally played that and AC2 but played the rest on PS3), do you happen to know if any of these games already been looked at ? i wont waste my time if people already know how to edit them.

no, as far as I know the original Bruteforce Savedata tool from Aldos had no codes or hacks for Assassin creed games. I do know that newer games (like Black Flag, Unity, Vallhalla, etc) use a new engine and saves are custom encrypted, so only the official Save Wizard app can do mods on those saves.
So I suggest to start from the oldest titles and go up, at some point saves will change and be custom-crypted.

AC1 is the only one that I had around and used it to compare with your findings, so go ahead and try out those other titles you have around. I suspect that you'll find similar CRC stuff there that could be patched and that would allow save-game hacking.

 

[honhon]

How do I apply the BSD patches on apollo? or do I need to wait for a update?

But perhaps that was only with the original 1.00 version, and some updated game version added save-game encryption

I checked the 1.00 version from the disc (blus 30364) and the saves are still encrypted

 

[Devildwarf]

How do I apply the BSD patches on apollo? or do I need to wait for a update?




I checked the 1.00 version from the disc (blus 30364) and the saves are still encrypted

OK if you are using Apllo the first thing you need to do is to get your games.conf from the
NP0APOLLO\USRDIR\DATA
folder, then edit the secure key for Assassins creed II, its oddly the same for each AC game apperently (from looking at other databases on the matter) so set the key to
0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A
then you will need to make a .savepatch file, find your games ID first then make a new file called something like
BLUS30364.savepatch
or for whatever region you are doing it will be different just make sure it matches your game.
now fill it with

GET THE CODE BELOW IN BUCANERO'S POST THIS WAS BUGGED

then save, then copy this and the newly edited games.conf back to your PS3, now start Apollo then open the SAVES and find the AC2 options save, if you have more then 1 AC2 save its usually the last one but check the folder ID to make sure, the options folder has OPT at the end of the folder name. Then it should just be a case of removing the copy protection, Decrypt and then patching the save, good luck

EDIT:- Also i should mention this works with Apollo 1.8.4 if you are using a older version it might not.

EDIT2: Also on a side im attaching a picture of a games.conf with all AC games in it, seems most are copy protected but with the same key.

 

[bucanero]

just a small correction, file needs to be named TITLEID.savepatch, without dashs or spaces, so in this example:
BLUS30364.savepatch

and one small improvement, it's better to put the Auditore crypt code first, then the CRC code, so in one single change everything gets properly modified. (if not, you need to execute two times, first the crypt code, then apply again the crc fix)

;BLUS30364
; assassin creed 2
; crc fix by devildwarf

:OPTIONS

[Enable Auditore crypt Uplay map]
00000498 00000001

[Update Custom CRC32 OPTIONS (Required)]
set crc_bandwidth:32
set crc_polynomial:0x4C11DB7
set crc_initial_value:0
set crc_output_xor:0x1bf3278a
set crc_reflection_input:1
set crc_reflection_output:1
set [size]:read(0x00,4)
set range:0x0008,[size]+7
set [hash]:crc
write at 0x0004:[hash]

 

[Devildwarf]

just a small correction, file needs to be named TITLEID.savepatch, without dashs or spaces, so in this example:
BLUS30364.savepatch

and one small improvement, it's better to put the Auditore crypt code first, then the CRC code, so in one single change everything gets properly modified. (if not, you need to execute two times, first the crypt code, then apply again the crc fix)

; assassin creed 2
; crc fix by devildwarf

:OPTIONS

[Enable Auditore crypt Uplay map]
00000498 00000001

[Update Custom CRC32 OPTIONS (Required)]
set crc_bandwidth:32
set crc_polynomial:0x4C11DB7
set crc_initial_value:0
set crc_output_xor:0x1bf3278a
set crc_reflection_input:1
set crc_reflection_output:1
set [size]:read(0x00,4)
set range:0x0008,[size]+7
set [hash]:crc
write at 0x0004:[hash]

Thanks for correcting that, yeah that is much better, i will edit my post above to remove the old script so people don't use that by mistake.
Anyway i made a load of saves in ACB and ACR and transfered them to my PC, first thing i noticed is they are all the same size, padded with zero's, but it still has a save length at the start of the file and a CRC following it BUT it doesn't use the same checks as previous games, im currently looking into it but its not going well, i guess they might have changed the way saves work after 2 (possibly due to multiplayer it had to be more secure ?)

 

[Devildwarf]

@bucanero nevermind my Hex editor for some reason selecting 1 extra byte at the end everytime i saved a new file with the first 8 bytes cut off (not sure why, but im sorted now), so i have checked the options and saves for
Assassin's Creed Brotherhood, Revelations, Rogue and Black Flag (ps3 only), i only have AC3 left to check but it seems they all use the same
"poly=0x4c11db7 init=0xbae23cd0 xorout=0xffffffff refin=true refout=true out_endian=big" its just all the files are padded to 300kb, apart from that its the exact same as AC2 main save, the Options appear to be using the same formula as the saves too (so all use the same method now, not a different one for options and game) but padded to 50kb instead of 300kb, anyway its interesting that they all appear to be the same, i guess the PS3 versions all use the same engine maybe ? or they just decided not to change something that was working.

 

[bucanero]

@bucanero nevermind my Hex editor for some reason selecting 1 extra byte at the end everytime i saved a new file with the first 8 bytes cut off (not sure why, but im sorted now), so i have checked the options and saves for
Assassin's Creed Brotherhood, Revelations, Rogue and Black Flag (ps3 only), i only have AC3 left to check but it seems they all use the same
"poly=0x4c11db7 init=0xbae23cd0 xorout=0xffffffff refin=true refout=true out_endian=big" its just all the files are padded to 300kb, apart from that its the exact same as AC2 main save, the Options appear to be using the same formula as the saves too (so all use the same method now, not a different one for options and game) but padded to 50kb instead of 300kb, anyway its interesting that they all appear to be the same, i guess the PS3 versions all use the same engine maybe ? or they just decided not to change something that was working.

can you share saves for those games, so we can create the script codes, or maybe you can try to follow the other ".savepatch" example and just share the crc fix codes for the other games you reviewed.

Let me know and we can add these other AC games to Apollo

 

[Devildwarf]

can you share saves for those games, so we can create the script codes, or maybe you can try to follow the other ".savepatch" example and just share the crc fix codes for the other games you reviewed.

Let me know and we can add these other AC games to Apollo

Sure here are my gamesaves, they are all just 0% saves and Options (like as soon as you start the game and the first Autosave i close it just to make a save fast), i decrypted them already and removed my PSID info but if you need them encrypted let me know, they all use the same encryption key, here is the info from a games.conf i found with them already in, some people say AC2 is unprotected but some say its not, i think "some" releases are not protected but i have no idea which ones (i would guess the 1.0 games, but apperently some discs actually ship with 1.02 patch on them)

; "Assassin's Creed II ™"
[BLKS20167/BLAS50359/NPEB00462/BLAS50159/BLJM60185/NPUB90267/BLES00670/BLES00751/BLUS30364/BLES00897/BLES00898/BLES00669/BLUS30446/NPEJ00046/NPUB30423/BLES00899/BLJM60233]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed III"
[BCUS90817/BLUS30991/BLUS31035/BLUS90817/NPUB30826/BLES01667/BLES01668/BLES01669/NPEB01099/BLJM60516/BLAS50494/BLAS50495/BLAS50583/BLAS50615/BLKS20371/BLJM61171/BLJM61174]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed: Birth of a New World - The American Saga / PS3    Assassin's Creed: The Americas Collection"
[BLUS31483/BLES02085]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed Brotherhood"
[BLUS30637/BLUS30537/NPUB30522/NPUB90466/BLES00909/BLES00900/BLES00911/BLES01772/NPEB00600/BLES00910/BLKS20231/BLAS50278/BLJM60250/BLJM60995/BLAS50358/AC2OPT]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed Trilogy: Ezio Saga"
[BLUS31145/BLJS10180/BLJM67011/BLJM67021/NPJB00230]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed: Heritage Collection"
[BLES01968]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed®: Freedom Cry"
[NPUB31450/NPEB01979/NPJB00586/BLKS20231]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed®: Liberation HD"
[NPUB31244/NPUB31569/NPUB50106/NPEB01386/NPEB02101/NPHB00660]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed Revelations"
[BLUS30808/BLUS30905/NPUB30707/BLES01384/BLES01385/BLES01466/BLES01467/NPEB00880/BLET70017/BLJM60412/BLAS50418/BLAS50499/BLJM60573/BLKS20325]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed® IV Black Flag"
[BLUS31193/BLUS41035/NPUB31246/BLES01882/BLES01883/BLES01884/BLES02204/NPEB01396/NPUB50009/NPEJ00243/NPEJ00246/BLJM61056/NPUB90963/BLAS50643/BLET70040/BLKS20430]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

; "Assassin's Creed® Rogue"
[BLUS31465/NPUB31547/BLES02061/BLES02062/NPEB02065/BLJM61208/BLKS20499]
;disc_hash_key=
secure_file_id:*=0D0E0A0D0B0E0E0F0A0A0A0A0A0A0A0A

and here are my save files, it was 15mb 7z compressed so i couldn't upload it here,
https://drive.google.com/file/d/1j_z1aPI1w9KBv8r8gaKw9v4SZ6z7JT1W/view?usp=sharing
anyway you will see if you get the file length from the start of the file then remove the first 8 bytes and make a new file with the full length and use the crc algo i posted above you will get the correct result, i haven't tried actually editing the data to see if there is any more checks in there yet, im planning to edit my in-game profile name and see if it works soon (on Rogue), i will post back on how that goes.


EDIT:- I tried to make a script to change my name and update the CRC using BSD format patch but it fails for me (new CRC isn't correct and in-game just says damaged data), i guess i screwed up somewhere, but i then manually hex edited the file and updated the CRC and it works, i changed my profilename ingame from Devildwarf to Bevildwarf just to see if it would work or not and it did, so it should be possible with scripts im just not good at doing it that way, but now we know we can hex edit saves this way

EDIT2:- @bucanero ok seems i was sleepy last night and made a mistake in the script, your AC2 script works fine, i just did this last night for a quick test and it works for AC Rogue

; BLES02061
; Assassin's Creed Rogue

:ACRO_0.SAV
[ChangeName]
write at 0x0000009D:"Bevi"

:ACRO_0.SAV
[Update Custom CRC32 ACRO_0.SAV (Required)]
set crc_bandwidth:32
set crc_polynomial:0x4C11DB7
set crc_initial_value:0xbae23cd0
set crc_output_xor:0xFFFFFFFF
set crc_reflection_input:1
set crc_reflection_output:1
set [size]:read(0x00,4)
set range:0x0008,[size]+7
set [hash]:crc
write at 0x0004:[hash]


:OPTIONS
[Update Custom CRC32 OPTIONS (Required)]
set crc_bandwidth:32
set crc_polynomial:0x4C11DB7
set crc_initial_value:0xbae23cd0
set crc_output_xor:0xFFFFFFFF
set crc_reflection_input:1
set crc_reflection_output:1
set [size]:read(0x00,4)
set range:0x0008,[size]+7
set [hash]:crc
write at 0x0004:[hash]

Please note this is a example script just to check it worked (and it does), it just renames the first 4 letters of the profile to Bevi and updates the checksum, just remove the ChangeName part, the same script should work for all other AC games on PS3 with the exception of different filenames per game, but they all appear to use the same CRC check for main game and options (after AC2)