Need help reverse engineering Toxic OS's cheats.db file

[Ghaleon]

Not exactly sure where to post this request of mine, well anyway here goes:

Toxic OS v0.41 has a cheat device.

But there is no tool which can create/decrypt the cheat file Toxic OS stores on memory card.

Up until now i was quite happy to have such a tool for xploder 2/codebreaker
http://www.psx-scene.com/forums/showthread.php?t=25635
with the cheat device built into toxic os i can no longer use this, unfortunately.

I was hoping that somebody capable were to create a tool just like this for toxic OS's cheat device.
all i can offer to aid in this is supplying cheats.bin files toxic os creates to help reverse engineer that format. With exact information what the file is storing according to toxic os.

well anyway i really hope someone is willing to lend a hand, thanks go out to whoever volunteers doing this ^^

[Breath of Fire]

I have Toxic OS .41 what do you need me to do I would be happy to help.

[misfire]

Wow, good to see someone actually using my code compiler XP2CC.

I don't know if I can be any help to you. I've got my own stuff to do, and not much spare time. But I can give you some hints:

First, determine if the cheats.db file is encrypted and/or compressed. This is something you can do without reverse engineering the Toxic OS.

- back up your current cheats.db file to your PC's HDD
- use Toxic OS to make minor changes to the current cheats.db file (e.g. change one cheat code digit), save the changes
- copy the updated cheats.db file to your HDD
- compare both files

If you supply both files here, I'll see what I can do. But don't expect too much. It's pretty unlikely that someone could crack those files without actually reverse engineering the Toxic OS. And it's even more unlikely that I'm going to do it.

[Breath of Fire]

How can I get the Cheats.db off my memory card?

[Ghaleon]

Wow, good to see someone actually using my code compiler XP2CC.

First, determine if the cheats.db file is encrypted and/or compressed. This is something you can do without reverse engineering the Toxic OS.

Thank you for your kind offer misfire, I'm sorry for taking this much time, didn't think i would get a reply anytime soon ^^.

I've uploaded the two cheats.bin files and hope for the best.
I'm rather grateful for you to make the effort of just taking a short look into it.
helps me cling on to hope for something as useful and nice as your xp2cc.
I've been using your tool for the last two years and since then it was helping me tremendously, saving me from insanity and making my gaming experience much more fun.

In any case, i've been happy with it, so even in the worst case, i have no qualms and still am quite grateful for the time your effort saved me in the past.


here my notes on the two files in the rar.


Mastercodes are entered directly after setting the game title.
the format the files are in:
----------------------
Gametitle
Mastercode

firstcheatcodetitle
firstcheatcode
----------------------
Contents of cheat1.bin
----------------------
Testcode123
91234567 89ABCDEF

Test1
20FEDCBA 98765430
----------------------
Contents of cheat2.bin
----------------------
Testcode123
91234567 89ABCDEF

Test1
20FEDCBA 98765431
----------------------

there is supposedly a bug in toxicos which prevents you from just editing cheat codes, instead one needs to add a new one, new codes keep the data of the previously selected codes, and make any changes in that one, and then delete the former code.
thus i had to delete the original first cheatcode line after i added the new line with the "1" at the end.

there are quite a few differences in these two files despite the minor change.
but i hope that doesn't imply that these files are encrypted with some mean non-standard code.

How can I get the Cheats.db off my memory card?

i used launchelf and a usbstick (mp3player) for the task, the file is stored in ToxicCheats/cheats.bin
and uhm i made a mistake, it is named "cheats.bin" not ".db" sorry for that, strange error i keep making >_<

[Breath of Fire]

So if this works out we will be able to transfer these files to my memory card and I will not have to manually type in each code? THAT WOULD BE AWESOME!

[Breath of Fire]

Any progress? Please answer my question above also ^^^^^

[Ghaleon]

ideally it would mean that there will not be any need to type in codes manually.
but as misfire pointed out, it is not very likely for him to do more than take a passing glance at it (which is more than i hoped for in the first place), for once, and also if the file is being encrypted, the effort needed to reverse the whole format would make a useable tool pretty much unlikely as there is seemingly not a whole lot of demand for it.
Seeing that we're the only two people showing interest for this particular tool to be created here (while i'm rather sure there'll be lots of txOs users out there who want something like this), this means there isn't much of an incentive to work on it.

well anyway, i will still hope for misfire telling us "it was easy, made it in ten minutes ..." well as much as i hope for this to happen, i'm realistic.

edit:
seeing him obliterating that obnoxious cb7+ encryption, i'm much more optimistic =)
regarding a progress report, i'm sure he'll reply if he has something to tell.

on that note, if i can help by supplying larger/different savegames, with more codes in them, please tell, i'll gladly do that ^^

[misfire]

It's not easy; it can't be done in ten minutes.

You've changed a single byte, and the 2nd file looks very different; not only the file's contents, but also its size. This indicates that the file is most likely compressed. To make things worse, there seems to be a hash (digital signature?) in the file header...

It's like I said. You have to reverse engineer the ToxicOS (is itself compressed) to make any sense of the data.

Nowadays it seems to be "cool" for a company to use cryptography in their products, even though it serves no real purpose.

[GMO]

it usually in there to hide something thats NOT supposed to be in there e.e a code that not theres or borrowed without licensing...