The profile for Burnout Revenge contains all progression information, including event completion, unlocks, and statistics, along with settings.
Headers and protection
At least two layers of protection are present on all platforms. A tool such as RevengeChecksumGen can be used to recalculate the checksums.
All profiles use EA's proprietary MC02 header to protect the data. Following any edits, the profile must be rehashed using a program such as MC02 Package Tool.
The following information is from symbols in Burnout Revenge (Alpha 7 build). Signature_t is a typedef of uint32_t.
RealmcCore::FileHeader
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0x4 |
uint32_t |
mFileHeaderVersion |
Magic |
Must be 'MC02' MC = Memory Card 02 = version 2
|
0x4 |
0x4 |
uint32_t |
mFileSize |
Length of the save in bytes |
Includes the MC02 header
|
0x8 |
0x4 |
uint32_t |
mUserHeaderSize |
Save header length in bytes |
|
0xC |
0x4 |
uint32_t |
mUserBodySize |
Save data length in bytes |
|
0x10 |
0x4 |
Signature_t |
mUserHeaderSignature |
Save header CRC32 |
|
0x14 |
0x4 |
Signature_t |
mUserBodySignature |
Save data CRC32 |
|
0x18 |
0x4 |
Signature_t |
mFileHeaderSignature |
MC02 header CRC32 |
Hashes everything prior to this field
|
The CRC32 algorithm used is nonstandard. See this gist for an example implementation.
Checksum
A proprietary checksum is appended to each profile for validation purposes. This is calculated by summing every 4 bytes (read as unsigned 32-bit integers) in the CB4SaveGameData structure, excluding the checksum itself and any padding after it.
Structures
Data
This defines the de facto structure of the save file. The game does not treat it as a structure, instead reading the names and saves into the memory card manager, which is what the information below is based on.
PlayStation 2
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0xC0 |
GtUTF8[3][64] |
maaSaveNames |
Save names |
|
0xC0 |
0x4FE0 |
CB4SaveGameData[3] |
maSaveGameData |
Saves |
|
Xbox
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0x30 |
? |
? |
384-bit key? |
Multiplayer-related?
|
0x30 |
0xC0 |
GtUTF8[3][64] |
maaSaveNames |
Save names |
|
0xF0 |
0x5010 |
CB4SaveGameData[3] |
maSaveGameData |
Saves |
|
Xbox 360
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0xC0 |
GtUTF8[3][64] |
maaSaveNames |
Save names |
|
0xC0 |
0x5268 |
CB4SaveGameData[3] |
maSaveGameData |
Saves |
|
CB4SaveGameData
PlayStation 2
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0x4 |
RwInt32 |
mnDataVersion |
|
24
|
0x4 |
0x5C |
CB4Settings |
mSettings |
|
|
0x60 |
0x1A38 |
CB4Profile |
mPlayerProfile |
|
|
0x1A98 |
0x4 |
RwUInt32 |
munCheckSum |
|
|
0x1A9C |
0x4 |
|
|
Padding |
|
Xbox
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0x4 |
RwInt32 |
mnDataVersion |
|
24
|
0x4 |
0x5C |
CB4Settings |
mSettings |
|
|
0x60 |
0x1A38 |
CB4Profile |
mPlayerProfile |
|
|
0x1A98 |
0x4 |
RwUInt32 |
munCheckSum |
|
|
0x1A9C |
0x4 |
? |
? |
Padding? |
|
0x1AA0 |
0x10 |
? |
? |
128-bit key? |
Multiplayer-related?
|
Xbox 360
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0x4 |
RwInt32 |
mnDataVersion |
|
31
|
0x4 |
0x5C |
CB4Settings |
mSettings |
|
|
0x60 |
0x1B10 |
CB4Profile |
mPlayerProfile |
|
|
0x1B70 |
0x4 |
RwUInt32 |
munCheckSum |
|
|
0x1B74 |
0x4 |
|
|
Padding |
|
CB4Settings
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0x29 |
RwUInt8[41] |
maun8SongFlags |
|
|
0x29 |
0x2 |
RwInt8[2] |
mabRumble |
|
|
0x2B |
0x1 |
RwInt8 |
mn8ScreenOffsetX |
|
|
0x2C |
0x1 |
RwInt8 |
mn8ScreenOffsetY |
|
|
0x2D |
0x1 |
RwInt8 |
mbPad0 |
|
|
0x2E |
0x1 |
RwInt8 |
mn8SoundConfig |
|
|
0x2F |
0x1 |
RwInt8 |
mn8SFXVolume |
|
|
0x30 |
0x1 |
RwInt8 |
mn8MusicVolume |
|
|
0x31 |
0x1 |
RwInt8 |
mn8DJVolume |
|
|
0x32 |
0x1 |
RwInt8 |
mn8SongIndex |
|
|
0x33 |
0x1 |
RwInt8 |
mn8SoundtrackIndex |
|
|
0x34 |
0x1 |
RwInt8 |
mn8RadioOn |
|
|
0x35 |
0x1 |
RwInt8 |
mbPlayModeRandom |
|
|
0x36 |
0x1 |
RwInt8 |
mn8TakedownCamMode |
|
|
0x37 |
0x1 |
RwInt8 |
mbCrashAutoSlowMo |
|
|
0x38 |
0x2 |
RwInt8[2] |
mabExternalCam |
|
|
0x3A |
0x1 |
RwInt8 |
mbAutoSaveIsOn |
|
|
0x3B |
0x1 |
RwInt8 |
mbViewedRaceTraining |
|
|
0x3C |
0x1 |
RwInt8 |
mbViewedTrafficAttackTraining |
|
|
0x3D |
0x1 |
RwInt8 |
mbViewedCrashTraining |
|
|
0x3E |
0x1 |
RwInt8 |
mbViewedRoadRageTraining |
|
|
0x3F |
0x1 |
RwInt8 |
mbViewedRevengeTraining |
|
|
0x40 |
0x4 |
EOptionServicePartySecurity |
mePartySecurity |
|
|
0x44 |
0x4 |
EGtNetworkHeadsetOutputMode |
mePartyHeadsetOutputMode |
|
|
0x48 |
0x1 |
bool |
mbPartyAppearanceOnline |
|
|
0x49 |
0x10 |
char[16] |
macPartyPassword |
|
|
0x59 |
0x3 |
|
|
Padding |
|
CB4Profile
In the retail game, this is a structure containing only CB4ProfileStoredData.
CB4ProfileStoredData
PlayStation 2, Xbox
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0x4 |
CGtTimeStamp |
mTimeStamp |
|
|
0x4 |
0x4 |
RwReal |
mrTotalPlayingTimeInSecs |
|
|
0x8 |
0x12 |
GtUTF16[9] |
maNameString |
|
|
0x1A |
0x12 |
GtUTF16[9] |
maMutiPlayer1NameString |
|
|
0x2C |
0x12 |
GtUTF16[9] |
maMutiPlayer2NameString |
|
|
0x3E |
0x2 |
|
|
Padding |
|
0x40 |
0x4 |
RwInt32 |
mnRankID |
|
|
0x44 |
0x4 |
RwInt32 |
mnNumUnlockedEvents |
|
|
0x48 |
0x4 |
RwInt32 |
mnNumGoldMedals |
|
|
0x4C |
0x4 |
RwInt32 |
mnPercentComplete |
|
|
0x50 |
0x4 |
RwUInt32 |
? |
|
Possibly RwInt32
|
0x54 |
0x4 |
RwUInt32 |
? |
|
|
0x58 |
0x4 |
RwUInt32 |
? |
|
|
0x5C |
0x4 |
RwUInt32 |
? |
|
|
0x60 |
0x4 |
RwUInt32 |
? |
|
|
0x64 |
0x4 |
RwUInt32 |
? |
|
|
0x68 |
0x4 |
RwUInt32 |
? |
|
|
0x6C |
0x4 |
RwUInt32 |
? |
|
|
0x70 |
0x4 |
RwUInt32 |
? |
|
|
0x74 |
0x4 |
RwUInt32 |
? |
|
|
0x78 |
0x4 |
RwUInt32 |
? |
|
|
0x7C |
0x4 |
RwUInt32 |
? |
|
|
0x80 |
0x4 |
RwUInt32 |
? |
|
|
0x84 |
0x4 |
RwUInt32 |
? |
|
|
0x88 |
0x4 |
RwUInt32 |
? |
|
|
0x8C |
0x113 |
RwInt8[275] |
man8ChallengeMedal |
|
|
0x19F |
0x113 |
RwInt8[275] |
man8ChallengeRating |
|
|
0x2B2 |
0x2 |
|
|
Padding |
|
0x2B4 |
0x4 |
RwUInt32 |
muTotalChallenges |
|
|
0x2B8 |
0x8 |
RwUInt8[8] |
mau8ChallengeSheetsUnlocked |
|
|
0x2C0 |
0x40 |
RwUInt8[8][8] |
maau8ChallengesCompleted |
|
|
0x300 |
0x18 |
RwUInt8[3][8] |
maau8SignatureTDsCompleted |
|
|
0x318 |
0x898 |
GtID[275] |
maChallengeList |
|
|
0xBB0 |
0x400 |
GtID[128] |
maVehicleList |
|
|
0xFB0 |
0x1A0 |
GtID[52] |
maTrackList |
|
|
0x1150 |
0x1 |
RwUInt8 |
mu8B3SaveDetected |
|
|
0x1151 |
0x1 |
RwUInt8 |
mu8MaddenSaveDetected |
|
|
0x1152 |
0x1 |
RwUInt8 |
? |
|
|
0x1153 |
0x1 |
|
|
Padding |
|
0x1154 |
0x4 |
RwUInt32 |
muOnlineRaceEventCount |
|
|
0x1158 |
0x4 |
RwUInt32 |
muOnlineCrashEventCount |
|
|
0x115C |
0x4 |
RwUInt32 |
muOfflineRaceEventCount |
|
|
0x1160 |
0x4 |
RwUInt32 |
muOfflineCrashEventCount |
|
|
0x1164 |
0xD0 |
RwReal[52] |
marFastestLaps |
|
|
0x1234 |
0x34 |
bool[52] |
mabFastestLapNeedsUploading |
|
|
0x1268 |
0xD0 |
RwUInt32[52] |
mauHighestTrafficAttackScore |
|
|
0x1338 |
0x34 |
bool[52] |
mabTAScoreNeedsUploading |
|
|
0x136C |
0x1B0 |
RwUInt32[108] |
mauHighestCrashModeScore |
|
|
0x151C |
0x6C |
bool[108] |
mabHighestCrashScoreNeedsUploading |
|
|
0x1588 |
0x44C |
RwReal[275] |
? |
Records |
|
0x19D4 |
0x4 |
RwUInt32 |
muStandardTakedowns |
|
|
0x19D8 |
0x4 |
RwUInt32 |
muSignatureTakedowns |
|
|
0x19DC |
0x4 |
RwUInt32 |
muAftertouchTakedowns |
|
|
0x19E0 |
0x4 |
RwUInt32 |
muCrashbreakerTakedowns |
|
|
0x19E4 |
0x4 |
RwUInt32 |
muPsycheOutTakedowns |
|
|
0x19E8 |
0x4 |
RwUInt32 |
muTrafficCheckTakedowns |
|
|
0x19EC |
0x4 |
RwUInt32 |
muVerticalTakedowns |
|
|
0x19F0 |
0x4 |
RwUInt32 |
muTBoneTakedowns |
|
|
0x19F4 |
0x4 |
RwUInt32 |
muRevengeTakedowns |
|
|
0x19F8 |
0x4 |
RwUInt32 |
muTotalSlams |
|
|
0x19FC |
0x4 |
RwUInt32 |
muTotalShunts |
|
|
0x1A00 |
0x4 |
RwUInt32 |
muTotalRevengeSlams |
|
|
0x1A04 |
0x4 |
RwUInt32 |
muTotalRevengeShunts |
|
|
0x1A08 |
0x4 |
RwUInt32 |
muTotalPerfectLaps |
|
|
0x1A0C |
0x4 |
RwUInt32 |
muTotalBurnoutLaps |
|
|
0x1A10 |
0x4 |
RwUInt32 |
muTotalCrashEscapes |
|
|
0x1A14 |
0x4 |
RwUInt32 |
muTotalVehiclesChecked |
|
|
0x1A18 |
0x4 |
RwReal |
mrTotalBurnTime |
|
|
0x1A1C |
0x4 |
RwReal |
mrTotalDrift |
|
|
0x1A20 |
0x4 |
RwReal |
mrTotalOncoming |
|
|
0x1A24 |
0x4 |
RwReal |
mrTotalAir |
|
|
0x1A28 |
0x4 |
RwUInt32 |
muTotalCrashDamage |
|
|
0x1A2C |
0x4 |
RwUInt32 |
muLargestNumCrashModeExplosions |
|
|
0x1A30 |
0x1 |
bool |
mbRumble |
|
|
0x1A31 |
0x1 |
bool |
mbIsEmpty |
|
|
0x1A32 |
0x6 |
|
|
Padding |
|
Xbox 360
Offset |
Length |
Type |
Name |
Description |
Comments
|
0x0 |
0x4 |
CGtTimeStamp |
mTimeStamp |
|
|
0x4 |
0x4 |
RwReal |
mrTotalPlayingTimeInSecs |
|
|
0x8 |
0x12 |
GtUTF16[9] |
maNameString |
|
|
0x1A |
0x12 |
GtUTF16[9] |
maMutiPlayer1NameString |
|
|
0x2C |
0x12 |
GtUTF16[9] |
maMutiPlayer2NameString |
|
|
0x3E |
0x2 |
|
|
Padding |
|
0x40 |
0x4 |
RwInt32 |
mnRankID |
|
|
0x44 |
0x4 |
RwInt32 |
mnNumUnlockedEvents |
|
|
0x48 |
0x4 |
RwInt32 |
mnNumGoldMedals |
|
|
0x4C |
0x4 |
RwInt32 |
mnPercentComplete |
|
|
0x50 |
0x4 |
RwUInt32 |
? |
|
Possibly RwInt32
|
0x54 |
0x4 |
RwUInt32 |
? |
|
|
0x58 |
0x4 |
RwUInt32 |
? |
|
|
0x5C |
0x4 |
RwUInt32 |
? |
|
|
0x60 |
0x4 |
RwUInt32 |
? |
|
|
0x64 |
0x4 |
RwUInt32 |
? |
|
|
0x68 |
0x4 |
RwUInt32 |
? |
|
|
0x6C |
0x4 |
RwUInt32 |
? |
|
|
0x70 |
0x4 |
RwUInt32 |
? |
|
|
0x74 |
0x4 |
RwUInt32 |
? |
|
|
0x78 |
0x4 |
RwUInt32 |
? |
|
|
0x7C |
0x4 |
RwUInt32 |
? |
|
|
0x80 |
0x4 |
RwUInt32 |
? |
|
|
0x84 |
0x4 |
RwUInt32 |
? |
|
|
0x88 |
0x4 |
RwUInt32 |
? |
|
|
0x8C |
0x113 |
RwInt8[275] |
man8ChallengeMedal |
|
|
0x19F |
0x113 |
RwInt8[275] |
man8ChallengeRating |
|
|
0x2B2 |
0x2 |
|
|
Padding |
|
0x2B4 |
0x4 |
RwUInt32 |
muTotalChallenges |
|
|
0x2B8 |
0x8 |
RwUInt8[8] |
mau8ChallengeSheetsUnlocked |
|
|
0x2C0 |
0x40 |
RwUInt8[8][8] |
maau8ChallengesCompleted |
|
|
0x300 |
0x18 |
RwUInt8[3][8] |
maau8SignatureTDsCompleted |
|
|
0x318 |
0x898 |
GtID[275] |
maChallengeList |
|
|
0xBB0 |
0x4B0 |
GtID[150] |
maVehicleList |
|
|
0x1060 |
0x1A0 |
GtID[52] |
maTrackList |
|
|
0x1200 |
0x1 |
RwUInt8 |
? |
Gamestop entitlement |
|
0x1201 |
0x1 |
RwUInt8 |
? |
Game Crazy entitlement |
|
0x1202 |
0x1 |
RwUInt8 |
? |
Alienware entitlement |
|
0x1203 |
0x1 |
RwUInt8 |
? |
Xbox 360 entitlement |
|
0x1204 |
0x1 |
RwUInt8 |
? |
Plantronics entitlement |
|
0x1205 |
0x1 |
RwUInt8 |
? |
Best Buy entitlement |
|
0x1206 |
0x1 |
RwUInt8 |
? |
Dolby entitlement |
|
0x1207 |
0x1 |
RwUInt8 |
? |
Monster entitlement |
|
0x1208 |
0x1 |
RwUInt8 |
? |
Yellowcard entitlement |
|
0x1209 |
0x1 |
RwUInt8 |
? |
Circuit City entitlement |
|
0x120A |
0x1 |
RwUInt8 |
? |
Spike TV entitlement |
|
0x120B |
0x1 |
RwUInt8 |
? |
|
|
0x120C |
0x1 |
RwUInt8 |
? |
|
|
0x120D |
0x1 |
RwUInt8 |
? |
|
|
0x120E |
0x1 |
RwUInt8 |
? |
|
|
0x120F |
0x1 |
RwUInt8 |
? |
Madden entitlement |
|
0x1210 |
0x4 |
? |
? |
|
|
0x1214 |
0x4 |
RwUInt32 |
muOnlineRaceEventCount |
|
|
0x1218 |
0x4 |
RwUInt32 |
muOnlineCrashEventCount |
|
|
0x121C |
0x4 |
RwUInt32 |
muOfflineRaceEventCount |
|
|
0x1220 |
0x4 |
RwUInt32 |
muOfflineCrashEventCount |
|
|
0x1224 |
0xD0 |
RwReal[52] |
marFastestLaps |
|
|
0x12F4 |
0x34 |
bool[52] |
mabFastestLapNeedsUploading |
|
|
0x1328 |
0xD0 |
RwUInt32[52] |
mauHighestTrafficAttackScore |
|
|
0x13F8 |
0x34 |
bool[52] |
mabTAScoreNeedsUploading |
|
|
0x142C |
0x1B0 |
RwUInt32[108] |
mauHighestCrashModeScore |
|
|
0x15DC |
0x6C |
bool[108] |
mabHighestCrashScoreNeedsUploading |
|
|
0x1648 |
0x44C |
RwReal[275] |
? |
Records |
|
0x1A94 |
0x4 |
RwUInt32 |
muStandardTakedowns |
|
|
0x1A98 |
0x4 |
RwUInt32 |
muSignatureTakedowns |
|
|
0x1A9C |
0x4 |
RwUInt32 |
muAftertouchTakedowns |
|
|
0x1AA0 |
0x4 |
RwUInt32 |
muCrashbreakerTakedowns |
|
|
0x1AA4 |
0x4 |
RwUInt32 |
muPsycheOutTakedowns |
|
|
0x1AA8 |
0x4 |
RwUInt32 |
muTrafficCheckTakedowns |
|
|
0x1AAC |
0x4 |
RwUInt32 |
muVerticalTakedowns |
|
|
0x1AB0 |
0x4 |
RwUInt32 |
muTBoneTakedowns |
|
|
0x1AB4 |
0x4 |
RwUInt32 |
muRevengeTakedowns |
|
|
0x1AB8 |
0x4 |
RwUInt32 |
? |
|
|
0x1ABC |
0x4 |
RwUInt32 |
muTotalSlams |
|
|
0x1AC0 |
0x4 |
RwUInt32 |
muTotalShunts |
|
|
0x1AC4 |
0x4 |
RwUInt32 |
muTotalRevengeSlams |
|
|
0x1AC8 |
0x4 |
RwUInt32 |
muTotalRevengeShunts |
|
|
0x1ACC |
0x4 |
RwUInt32 |
muTotalPerfectLaps |
|
|
0x1AD0 |
0x4 |
RwUInt32 |
muTotalBurnoutLaps |
|
|
0x1AD4 |
0x4 |
RwUInt32 |
muTotalCrashEscapes |
|
|
0x1AD8 |
0x4 |
RwUInt32 |
? |
|
|
0x1ADC |
0x4 |
RwUInt32 |
muTotalVehiclesChecked |
|
|
0x1AE0 |
0x4 |
RwUInt32 |
? |
|
|
0x1AE4 |
0x4 |
RwUInt32 |
? |
|
|
0x1AE8 |
0x4 |
RwReal |
mrTotalBurnTime |
|
|
0x1AEC |
0x4 |
RwReal |
mrTotalDrift |
|
|
0x1AF0 |
0x4 |
RwReal |
mrTotalOncoming |
|
|
0x1AF4 |
0x4 |
RwReal |
mrTotalAir |
|
|
0x1AF8 |
0x4 |
RwUInt32 |
muTotalCrashDamage |
|
|
0x1AFC |
0x4 |
RwUInt32 |
muLargestNumCrashModeExplosions |
|
|
0x1B00 |
0x1 |
bool |
mbRumble |
|
|
0x1B01 |
0x1 |
bool |
mbIsEmpty |
|
|
0x1B02 |
0xE |
|
|
Padding |
|
Enumerations
EOptionServicePartySecurity
Name |
Value |
Comments
|
ePartySecurityPublic |
0 |
|
ePartySecurityPrivate |
1 |
|
ePartySecurityClosed |
2 |
|
ePartySecurityMax |
3 |
|
EGtNetworkHeadsetOutputMode
Name |
Value |
Comments
|
eGtNetworkHeadsetOutputMode_Headset |
0 |
|
eGtNetworkHeadsetOutputMode_TVSpeakers |
1 |
|
eGtNetworkHeadsetOutputMode_Muted |
2 |
|
eGtNetworkHeadsetOutputMode_Max |
3 |
|