Save editor for Shenmue I

B

BtEtta

Joined
Aug 10, 2020
I made a save editor for Shenmue I. (Hosted on Google Drive for now, you will have to save the file locally and open it in your browser from there)

Currently you can edit:
  • Money/Tokens
  • Date/Time
  • Available moves/skill level
  • Story Items
  • Gacha Items
  • Cassettes
  • High scores
Everything seems to work fine in my testing but I offer no guarantees. MAKE BACKUPS (I recommend backing up the whole folder each time as I don't know the significance of the files other than the SHENMUE1_xxx files.)
If you want as well you can save the HTML file locally, everything it needs to work is contained in that one file.

Thanks to LemonHaze for giving me the checksum routine.
Important Note
Shenmue I uses a checksum to test the validity of save files. I currently do not know how to calculate that checksum. You need to modify your Shenmue.exe file in a hex editor to remove the check.
You should find the bytes 0F 85 94 00 00 00 at offset 1D1F64 (v 1.07)
Replace that with 90 90 90 90 90 90
Thanks to ner0 in this thread for pointing out how to disable the checksum check.

And yes, I will no doubt do the same for Shenmue II once I complete my run of Shenmue I. Absolutely no time frame is offered for that though.
 
Last edited:
Nope, should work fine with a completely unmodified .exe
I just forgot the remove the note that shows before you load a file.
 
BtEtta said:
Nope, should work fine with a completely unmodified .exe
I just forgot the remove the note that shows before you load a file.
Click to expand...

Thank you for responding. 🙂
This is really great! Looking forward to a Shenmue II one.

Would you say it's difficult to mod your save? I tried to do it myself using Cheat Engine before I found your awesome editor and I had no luck. I could mod the money but that's it.
 
I terms of editing a save file this is one of the easier examples. Everything has an exact place in the file. This almost never happens in more modern games. Obviously there's the problem in this case of the checksum which requires either debugging skills, or someone else with debugging skills.

Figuring out what to edit is part experimentation: i.e. save, do a small thing, save again, compare. I did try doing this to see if it was possible to fill out the notebook easily, but found with one test that about 20 different things changed in the file for one entry so wasn't too interested in pursuing further.

Past experience with save files/memory editing (I've been dabbling in such things for around 20 years now) was also helpful e.g. getting to know how games tend to store this data. This was especially important for the moves.

I also had some other references to help, there was a cheat engine table that allowed me to skip having to individually test which item values corresponded to which items in game. And way back on the Dreamcast itself I had (still have in fact) and Xploder cheat device which included examples for maxing out moves, so I knew that for a given move skill values ranged from 0-100; I maxed out the basic punch, found what seemed to be a probable location within the save, and then copied what I'd assumed were the training levels of those moves into a spreadsheet so I could create a bar chart and compare the relative sizes of the bars vs. what was displayed in game.

Obviously this just being HTML/JavaScript all the source of what I'm editing is easily viewable, and browser dev tools are very good for debugging even by novices. I've actually used this simple framework for 4 different editors now so as much of the logic as possible is non game-specific and just needs to be told what kind of data to load/save from what spot in the file. This also minimises errors — in most cases if I'm loading a value successfully I can already guarantee it will be saved successfully.
 
BtEtta said:
I terms of editing a save file this is one of the easier examples. Everything has an exact place in the file. This almost never happens in more modern games. Obviously there's the problem in this case of the checksum which requires either debugging skills, or someone else with debugging skills.

Figuring out what to edit is part experimentation: i.e. save, do a small thing, save again, compare. I did try doing this to see if it was possible to fill out the notebook easily, but found with one test that about 20 different things changed in the file for one entry so wasn't too interested in pursuing further.

Past experience with save files/memory editing (I've been dabbling in such things for around 20 years now) was also helpful e.g. getting to know how games tend to store this data. This was especially important for the moves.

I also had some other references to help, there was a cheat engine table that allowed me to skip having to individually test which item values corresponded to which items in game. And way back on the Dreamcast itself I had (still have in fact) and Xploder cheat device which included examples for maxing out moves, so I knew that for a given move skill values ranged from 0-100; I maxed out the basic punch, found what seemed to be a probable location within the save, and then copied what I'd assumed were the training levels of those moves into a spreadsheet so I could create a bar chart and compare the relative sizes of the bars vs. what was displayed in game.

Obviously this just being HTML/JavaScript all the source of what I'm editing is easily viewable, and browser dev tools are very good for debugging even by novices. I've actually used this simple framework for 4 different editors now so as much of the logic as possible is non game-specific and just needs to be told what kind of data to load/save from what spot in the file. This also minimises errors — in most cases if I'm loading a value successfully I can already guarantee it will be saved successfully.
Click to expand...

Thanks for the tips!

I've been trying to mod the raffle at the Tomato Convenience Store to get the Radio guaranteed. No luck, so far. 🙁
 
There's already a cheat engine table out there that has that: https://fearlessrevolution.com/viewtopic.php?t=9469

Ordinarily that would probably be a fairly difficult thing to do. Shenmue makes it kinda easy because you can see the result of your draw (and pause at that point) and still have time to search memory for the value before the game plays the scene of whatever you've won.

If you want something to try for starters: that table only includes entries for Abe Store and the Dobuita Tomato Mart (and you should probably only enable them while inside those respective stores if you don't want crashes). Look at how they're setup and see if you can make one for the Harbor Lounge Tomato Mart.
 
BtEtta said:
There's already a cheat engine table out there that has that: https://fearlessrevolution.com/viewtopic.php?t=9469

Ordinarily that would probably be a fairly difficult thing to do. Shenmue makes it kinda easy because you can see the result of your draw (and pause at that point) and still have time to search memory for the value before the game plays the scene of whatever you've won.

If you want something to try for starters: that table only includes entries for Abe Store and the Dobuita Tomato Mart (and you should probably only enable them while inside those respective stores if you don't want crashes). Look at how they're setup and see if you can make one for the Harbor Lounge Tomato Mart.
Click to expand...

I used this but it doesn't seem to be working for me, odd. It did on my old save, but not anymore.
 
Billy Sastard said:
I tried to do it myself using Cheat Engine before I found your awesome editor and I had no luck. I could mod the money but that's it.
Click to expand...

Just FYI, the Shenmue Reverse Engineers' Discord is full of research and documentation, plus my site Wulinshu.com has a lot of that research setup in wiki format.

BtEtta said:
Ordinarily that would probably be a fairly difficult thing to do. Shenmue makes it kinda easy because you can see the result of your draw (and pause at that point) and still have time to search memory for the value before the game plays the scene of whatever you've won.
Click to expand...

Why would it be difficult? While I can understand some aspects of what you're saying with regard to runtime analysis, static analysis for this exact thing is way better.
 
LemonHaze said:
Just FYI, the Shenmue Reverse Engineers' Discord is full of research and documentation, plus my site Wulinshu.com has a lot of that research setup in wiki format.



Why would it be difficult? While I can understand some aspects of what you're saying with regard to runtime analysis, static analysis for this exact thing is way better.
Click to expand...

Thanks! I'll check that out. 🙂
 
BtEtta said:
There's already a cheat engine table out there that has that: https://fearlessrevolution.com/viewtopic.php?t=9469

Ordinarily that would probably be a fairly difficult thing to do. Shenmue makes it kinda easy because you can see the result of your draw (and pause at that point) and still have time to search memory for the value before the game plays the scene of whatever you've won.

If you want something to try for starters: that table only includes entries for Abe Store and the Dobuita Tomato Mart (and you should probably only enable them while inside those respective stores if you don't want crashes). Look at how they're setup and see if you can make one for the Harbor Lounge Tomato Mart.
Click to expand...

Do you think the reason the Tomato Convenience Store mod on the Cheat Engine table isn't working could be because the save has been modded?
 
Shouldn't be. It continued to work for me after editing my save.

I've also updated the editor. Separated stuff out into multiple pages, fixed a bunch of minor typos, added high score editing for no useful reason that I can see.

LemonHaze said:
Why would it be difficult? While I can understand some aspects of what you're saying with regard to runtime analysis, static analysis for this exact thing is way better.
Click to expand...
I'd assume most games would pick the random roll, then run the relevant cutscenes. You'd need to control what value was drawn before it happens or get lucky with timing to update the value between the drawing and the check to decide what cutscenes to play. Probably pretty doable in many cases once you know what memory to change, but yeah harder to find at runtime vs. static analysis.
Shenmue checks that value multiple times (and also allows pausing pretty much anywhere), so you can draw, see what value you got, and still have time to change it to confirm if you got the right memory location. You could get Ryo reacting to a '5' draw, modify that to a '1' before the cashier's reaction is loaded, and know right away if you found the right spot or not.
No decompiling/disassembly to trawl though, easier for novices.
 
Last edited:
BtEtta said:
I'd assume most games would pick the random roll, then run the relevant cutscenes. You'd need to control what value was drawn before it happens or get lucky with timing to update the value between the drawing and the check to decide what cutscenes to play. Probably pretty doable in many cases once you know what memory to change, but yeah harder to find at runtime vs. static analysis.
Shenmue checks that value multiple times (and also allows pausing pretty much anywhere), so you can draw, see what value you got, and still have time to change it to confirm if you got the right memory location. You could get Ryo reacting to a '5' draw, modify that to a '1' before the cashier's reaction is loaded, and know right away if you found the right spot or not.
No decompiling/disassembly to trawl though, easier for novices.
Click to expand...

Shenmue uses LCPRNG for pretty much everything random related, so a search for 0x41C64E6D would be very useful.
 
BtEtta said:
Shouldn't be. It continued to work for me after editing my save.

I've also updated the editor. Separated stuff out into multiple pages, fixed a bunch of minor typos, added high score editing for no useful reason that I can see.

I'd assume most games would pick the random roll, then run the relevant cutscenes. You'd need to control what value was drawn before it happens or get lucky with timing to update the value between the drawing and the check to decide what cutscenes to play. Probably pretty doable in many cases once you know what memory to change, but yeah harder to find at runtime vs. static analysis.
Shenmue checks that value multiple times (and also allows pausing pretty much anywhere), so you can draw, see what value you got, and still have time to change it to confirm if you got the right memory location. You could get Ryo reacting to a '5' draw, modify that to a '1' before the cashier's reaction is loaded, and know right away if you found the right spot or not.
No decompiling/disassembly to trawl though, easier for novices.
Click to expand...

Hmm... that is odd. I can't think why it wouldn't work for me then. I have the X ticked on the Cheat Engine table next to the cheat which I think makes it unchangeable and all the other cheats work fine like weather, time, etc.

Any chance of an addition to your awesome save editor? 🙂
 
Billy Sastard said:
What does that search do?
Click to expand...

LCPRNG is one of the oldest methods for generating "randomness", it's used something like this:
C++: 
int seed = 0x41C64E6D;

// ...

seed = 0x41C64E6D * seed + 0x3039; // 0x3039 == 12345

This same constant seed value (0x41C64E6D) is the same across all versions of the game AFAIK, which should give you enough starting points for looking at this sorta stuff.
 
BtEtta said:
I made a save editor for Shenmue I.
shenmue.png

Currently you can edit:
  • Money/Tokens
  • Date/Time
  • Available moves/skill level
  • Story Items
  • Gacha Items
  • Cassettes
  • High scores
Everything seems to work fine in my testing but I offer no guarantees. MAKE BACKUPS (I recommend backing up the whole folder each time as I don't know the significance of the files other than the SHENMUE1_xxx files.)
If you want as well you can save the HTML file locally, everything it needs to work is contained in that one file.

Thanks to LemonHaze for giving me the checksum routine.
Important Note
Shenmue I uses a checksum to test the validity of save files. I currently do not know how to calculate that checksum. You need to modify your Shenmue.exe file in a hex editor to remove the check.
You should find the bytes 0F 85 94 00 00 00 at offset 1D1F64 (v 1.07)
Replace that with 90 90 90 90 90 90
Thanks to ner0 in this thread for pointing out how to disable the checksum check.

And yes, I will no doubt do the same for Shenmue II once I complete my run of Shenmue I. Absolutely no time frame is offered for that though.
Click to expand...
The page displays a 404 error. why?
 
Because I lost my previous hosting and haven't gotten around to setting up new hosting yet. Shared via Google Drive for now.
 
You must log in or register to reply here.
Back
Top