A journey recovering my genuine play-through of Parasite Eve on PS1

February 07, 2024

I'm writing this immediately after finishing this, to record it for others, in case they need some ideas for methodologies on recovering their own saves. These days I have stopped writing mostly due to time and focusing my energy further on either leisure or hacking. The best I can do these days is grab a quick picture and give context.

Context: I brought my modified Playstation 1 to my brother-in-law's to play with him. We had a lot of fun that night but I wanted to chill and continue my playthrough of Parasite Eve, a JRPG that my babysitter played when I was 8 years old and ever since have wanted to play.

Alas, I got this (copy from an emulator since it is now days since the weekend, but this is what I saw on the TV screen):

Fricking great. No, I wasn't 58 hours in (I had left it on overnight by accident), but I was around 6 hours in a genuine play that I didn't want to lose. Being a person of iron will and ambition, and experienced with all things computers, I knew I could solve this in a reasonable amount of time rather than play back to that point.

First step is to research what tools already exist to read PS1 memory cards. One of the first results is https://github.com/ShendoXT/memcardrex which is no good for my Linux using self but https://github.com/ShendoXT/memcarduino by the same author is perfect. And what you know, I have an ESP8266 (NodeMCU) that's been sitting in my drawer for like 5+ years. Time to get busy.

Second step is order some new PS1 cards for when the process is done and I want to use some more reliable storage.

Great, thanks Amazon. 2 days delivery time.

Third step is to wire up the contraption. I had another card I had brought from a retro game store that was completely dead. This will be my "base" for my wires. I scratched off the traces to the chip for good measure, just in case.

Me brainstorming to see if it'd fit as nice. I had to actually trim the board a little (as you see in the last pic, which was actually taken after this moment). The transparent blue card holds my corrupt save.

Behold my beautiful solder job where I reuse old security system wire and create a springy-fold so it fits snug when plugging things in. Also, I had ripped a couple pads right off the PCB so I had to super glue them back on and put some on top for good measure:

And a nice zoom out to show the ESP8266, which simply acts as a serial device reader. The PS1 memory card is a really dumb device. It really is just a simple memory chip where you set the baudrate and read things with some simple commands.

As you see, one pin is completed disconnected. This is the 7.6V pin.

Fun fact, the PS1 memory card slots AND controller ports are ALL CONNECTED, as implied by the pinout above. This can lead to scenarios where a controller in port 1 can corrupt a memory card in port 2. Wait a minute...

While at my brother-in-law's, I had brought two wireless controllers. For some reason, we couldn't both of them to work at the same time. My concluding thought was, there's too much current being drawn, because other controllers with one wireless controller would work.

Well guess what, I'm pretty sure plugging those two receivers in and out corrupted my file in the first place. Cool, note to future self!

Here's a pic of the jerry-rigged connector fitting nicely.

I was about to head outside, hence the glove

Aaaand the moment of truth:

SUCCESS

Of course, let's sanity check that by doing another read and comparing the two via file hashes:

Awwww yeeaaaa!

Next I spent a good couple hours reading NO$PSX's (emulator) documentation on the memory card format, and find a decent hex editor. I normally use bless, but I wanted to see what was new these days regarding open source hex editors. I landed on ImHex, which I gotta say is fantastic, and allows you to define patterns to easily read binary.

Before that though I played the game in the emulator up to the first save point, and created a save. NO$PSX uses the same format as regular PS1 memory cards (I learned later: NOT TRUE), so I could compare the two sections of data that are related to Parasite Eve and repair the corrupted data!

Alas, another obstacle. Turns out Parasite Eve makes use of checksums also. Whatever I changed, it always caused a "data is unreadable" error as we saw at the beginning, which is what hinted at that for me. I'm going to have to begin reversing the assembly routine that does this check now.

My method here was simple: as soon as I hit X on the file to load, I immediate put my mouse over the debugger and it'd pause execution. Then, I stepped until I got to the point where I noticed bytes from the memory card data section I cared about were being read.

The assembly shown there is literally in the middle of the checksum process. I'm not going to bother explaining it. What matters here is not to replicate it, but to skip it completely!

That's done by changing this instruction highlighted below to a "nop", aka no-operation. Why do I want to skip the check? Because I want to generate a brand new checksum using the game's own code ;) And the only way to do that is to be able to force load this file and save immediately again.

And with that, I thought I was good to go. All I had to do was write back to my card. But hold on, I wanted to use the new cards I got! So I plugged one into my contraption and ... what? Why is it reading back FFs? What is going on here? I tried the old card and the old card was working fine. I plugged a secondary new card I didnt touch yet into the PS1 and loaded it up, and it didn't "see" it at all. What in the f is going on. Well, it turns out, THESE WERE PS2 MEMORY CARDS. Aaauugghh.

Oh well, at least the old card still works, and I'm confident the old card only "failed" because of the earlier port-memory-card stuff mentioned. I wrote my fixed up save file to it and ... still, nothing. Ok, maybe NO$PSX memory card format isn't EXACTLY what the PS1 writes to memory cards? I need a game that lets me save immediately. In my list of games I have, 3D Lemmings is one I know that should let me save quickly.

3D Lemmings is by Psygnosis, which was "oddly" acquired by Sony and became their first party developer. I did *not* realize this at first, but it completely explains why the memory card functions in this game are "extensive" compared to other games!

With this, I formatted the card and made a save. Then I re-read the save off the card back onto my laptop and did another transplant, but this time only my fixed data section portion of Parasite Eve onto this. Then I wrote it back to the memory card.

It was time for the final test.