"Hacking" games in Fossapup, part 2. SteamWorld Quest: Hand of Gilgamech

Moderators: 666philb, Forum moderators

Post Reply
User avatar
Grey
Posts: 2078
Joined: Wed Jul 22, 2020 12:33 am
Location: Russia
Has thanked: 78 times
Been thanked: 399 times

"Hacking" games in Fossapup, part 2. SteamWorld Quest: Hand of Gilgamech

Post by Grey »

Recently, the games of the SteamWorld series(Dig, Dig 2, Heist and Quest) have been pleasing. I don't like to cheat, but Gilgamech is such a bastard, and I got to it with an empty wallet... But it's fixable. I sat in the evening and found where the necessary data is stored. Don't forget to make a backup copy of the save file. We will forcibly change the checksum of the file.

What will be required: hex editor(for example, Bless and it is in PPM), galculator(already in Fossapup), Geany (for a tricky Python script) and a save file for the game SteamWorld Quest(GOG version). Note: characters in save file are not identified by name, but by color: red, blue, green, yellow, and purple. Armilly is red, Copernica is blue, and so on.

Let's see how much money we have in the game. I have 1993.
Image
Run galculator in scientific mode and enter 1993 in DEC mode. Now switch to HEX and see 7C9. Open the game save file in Bless and search for C907 with the find command. Search in Bless in reverse order, so C907, not 7C9. It is important. We find it five bytes to the left of the word 'Hero'.
Image
Carefully change C907 to 40420F, and this is a whole million coins.
Image
Using the same method, we find where the lives are stored - just behind the color of the hero. We change it to 0F27, which is 9999 health.

2_SWQ_hp.png
2_SWQ_hp.png (69.27 KiB) Viewed 398 times

The level of our hero is stored in four bytes to the left of the word 'Equp'. We change it to 63 (this is the 99th level).

3_SWQ_level.png
3_SWQ_level.png (70.25 KiB) Viewed 398 times

Save the file when exiting Bless. Start the game and... And the game says that the save file is corrupted and won't open. Ah, yes. The checksum. When we saved the file when exiting Bless, its checksum changed and now it does not match the one stored in the save file. Okay. We'll still fool the game.

We put this Python script next to the save file:

Code: Select all

#!/usr/bin/env python
# Исправлялка контрольной суммы для файлов сохранения SteamWorld Quest: Hand of Gilgamech

import sys
import struct
import binascii

if len(sys.argv) != 2:
    print('Pass in a savegame as the first argument')
    sys.exit(1)

savefile = sys.argv[1]
print('Operating on savefile {}'.format(savefile))

# Читаем контрольную сумму из файла сохранения и выводим на экран,
# вычисляем новую правильную и выводим на экран,
# затем пишем новую в файл.

with open(savefile, 'r+b') as df:
    data = df.read()
    (on_disk_checksum,) = struct.unpack_from('I', data[1:9], 4)
    print('Checksum in the file itself: {}'.format(hex(on_disk_checksum)))
    new_checksum = binascii.crc32(data[9:])
    if new_checksum == on_disk_checksum:
        print('Checksum is correct, exiting.')
        sys.exit(0)
    print('Correct checksum: {}'.format(hex(new_checksum)))

    df.seek(5)
    df.write(struct.pack('I', new_checksum))
    print('Wrote corrected checksum')

We call terminal in this folder and run the script with the command ./fix_checksum_SWQ.py savegame_000.dat Script performs five important functions: reads the checksum stored inside the file, displays it on the screen, then calculates a new one for the modified file and displays it on the screen, and finally writes the new correct checksum to the save file.

Launch the game and it loads the save file. We have a million coins, a lot of lives, and a high hero level. The rest of the characters can be "pumped" in the same way - it's easy to navigate by the color of the character.

b_SWQ_rich.jpg
b_SWQ_rich.jpg (138.05 KiB) Viewed 398 times

Different devices. Different approach.

User avatar
Grey
Posts: 2078
Joined: Wed Jul 22, 2020 12:33 am
Location: Russia
Has thanked: 78 times
Been thanked: 399 times

Native executable checksum fixator for SteamWorld Quest

Post by Grey »

Checksum fixator as a native Fossapup executable file. Written in PureBasic. You can run it from any location, it will prompt you to select a file(by default it is /root/.local/share/SteamWorld Quest/savegame_000.dat). It is advisable to run it with a right mouse click+Run in Terminal(in this case you will be able to see all the actions in terminal).

SWQ_checksum_fixator.tar.gz
(21.41 KiB) Downloaded 32 times

Code: Select all

;Checksum fixator for SteamWorld Quest: Hand of Gilgamech by Grey/GSB
;Use it after editing savegame in HEX editor
savefile$ = OpenFileRequester("Please choose savegame file to load", "/root/.local/share/SteamWorld Quest/", "SWQ savegame (*.dat)|*.dat|", 0)
  OpenConsole()
If ReadFile(0, savefile$)
  FileSeek(0, 5)
  chks.l = ReadLong(0)
  chks$ = Hex(chks.l, #PB_Long)
  chkslc$ = LCase(chks$)
  PrintN("Operating on savefile " + savefile$)
  Print("Checksum in the file itself: 0x")
  PrintN(chkslc$)
  CloseFile(0)
Else
    MessageRequester("Information","Couldn't open the file!")
End    
EndIf
  UseCRC32Fingerprint()
chksum$ = FileFingerprint(savefile$, #PB_Cipher_CRC32, 256, 9)
If chksum$ = chkslc$
  PrintN("Checksum is correct, exiting.")
End
  Else
  Print("Correct checksum: 0x") 
  PrintN(chksum$)
  OpenFile(0, savefile$)
  FileSeek(0, 5)
  newchks.q = Val("$" + chksum$)
  WriteLong(0, newchks.q)
  PrintN("Wrote corrected checksum")
EndIf

Different devices. Different approach.

Post Reply

Return to “Fossapup64”