Profile/Burnout Revenge
< Profile
The profile for Burnout Revenge contains all progression information, including event completion, unlocks, and statistics, along with settings.
Headers and protection
At least two layers of protection are present on all platforms. A tool such as RevengeChecksumGen can be used to recalculate the checksums.
Header
All profiles use EA's proprietary MC02 header to protect the data. Following any edits, the profile must be rehashed using a program such as MC02 Package Tool.
The following information is from symbols in Burnout Revenge (Alpha 7 build), Dead Space 2 (2010-11-19 build), and The Godfather (2006-04-10 build).
PlayStation 2, Xbox 360
Signature_t is a typedef of uint32_t. It is used to hold CRC32 checksums. The algorithm used is nonstandard. See this gist for an example implementation.
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0x4 | uint32_t | mFileHeaderVersion | Magic | Must be 'MC02' MC = Memory Card 02 = version 2 |
| 0x4 | 0x4 | uint32_t | mFileSize | Length of the save in bytes | Includes the MC02 header |
| 0x8 | 0x4 | uint32_t | mUserHeaderSize | Save header length in bytes | |
| 0xC | 0x4 | uint32_t | mUserBodySize | Save data length in bytes | |
| 0x10 | 0x4 | Signature_t | mUserHeaderSignature | Save header signature | |
| 0x14 | 0x4 | Signature_t | mUserBodySignature | Save data signature | |
| 0x18 | 0x4 | Signature_t | mFileHeaderSignature | MC02 header signature | Hashes everything prior to this field |
Xbox
Identical to normal MC02 but with HMAC-SHA1 signatures (denoted by the XCALC_SIGNATURE type) instead of CRC32.
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0x4 | uint32_t | mFileHeaderVersion | Magic | Must be 'MC02' MC = Memory Card 02 = version 2 |
| 0x4 | 0x4 | uint32_t | mFileSize | Length of the save in bytes | Includes the MC02 header |
| 0x8 | 0x4 | uint32_t | mUserHeaderSize | Save header length in bytes | |
| 0xC | 0x4 | uint32_t | mUserBodySize | Save data length in bytes | |
| 0x10 | 0x14 | XCALC_SIGNATURE | mUserHeaderSignature | Save header signature | |
| 0x24 | 0x14 | XCALC_SIGNATURE | mUserBodySignature | Save data signature | |
| 0x38 | 0x14 | XCALC_SIGNATURE | mFileHeaderSignature | MC02 header signature | Hashes everything prior to this field |
Checksum
A proprietary checksum is appended to each profile for validation purposes. This is calculated by summing every 4 bytes (read as unsigned 32-bit integers) in the CB4SaveGameData structure, excluding the checksum itself and any padding after it.
Xbox has an additional checksum after the aforementioned checksum. It uses the same algorithm as the MC02 signatures.
Structures
Data
The following table defines the de facto structure of the save file. The game does not treat it as a structure, instead separately reading the names and saves into the memory card manager.
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0xC0 | GtUTF8[3][64] | maaSaveNames | Save names | |
| 0xC0 | Platform dependent | CB4SaveGameData[3] | maSaveGameData | Saves |
CB4SaveGameData
PlayStation 2
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0x4 | RwInt32 | mnDataVersion | 24 | |
| 0x4 | 0x5C | CB4Settings | mSettings | ||
| 0x60 | 0x1A38 | CB4Profile | mPlayerProfile | ||
| 0x1A98 | 0x4 | RwUInt32 | munCheckSum | ||
| 0x1A9C | 0x4 | Padding |
Xbox
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0x4 | RwInt32 | mnDataVersion | 24 | |
| 0x4 | 0x5C | CB4Settings | mSettings | ||
| 0x60 | 0x1A38 | CB4Profile | mPlayerProfile | ||
| 0x1A98 | 0x4 | RwUInt32 | munCheckSum | ||
| 0x1A9C | 0x14 | ? | ? | HMAC-SHA1 checksum |
Xbox 360
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0x4 | RwInt32 | mnDataVersion | 31 | |
| 0x4 | 0x5C | CB4Settings | mSettings | ||
| 0x60 | 0x1B10 | CB4Profile | mPlayerProfile | ||
| 0x1B70 | 0x4 | RwUInt32 | munCheckSum | ||
| 0x1B74 | 0x4 | Padding |
CB4Settings
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0x29 | RwUInt8[41] | maun8SongFlags | ||
| 0x29 | 0x2 | RwInt8[2] | mabRumble | ||
| 0x2B | 0x1 | RwInt8 | mn8ScreenOffsetX | ||
| 0x2C | 0x1 | RwInt8 | mn8ScreenOffsetY | ||
| 0x2D | 0x1 | RwInt8 | mbPad0 | ||
| 0x2E | 0x1 | RwInt8 | mn8SoundConfig | ||
| 0x2F | 0x1 | RwInt8 | mn8SFXVolume | ||
| 0x30 | 0x1 | RwInt8 | mn8MusicVolume | ||
| 0x31 | 0x1 | RwInt8 | mn8DJVolume | ||
| 0x32 | 0x1 | RwInt8 | mn8SongIndex | ||
| 0x33 | 0x1 | RwInt8 | mn8SoundtrackIndex | ||
| 0x34 | 0x1 | RwInt8 | mn8RadioOn | ||
| 0x35 | 0x1 | RwInt8 | mbPlayModeRandom | ||
| 0x36 | 0x1 | RwInt8 | mn8TakedownCamMode | ||
| 0x37 | 0x1 | RwInt8 | mbCrashAutoSlowMo | ||
| 0x38 | 0x2 | RwInt8[2] | mabExternalCam | ||
| 0x3A | 0x1 | RwInt8 | mbAutoSaveIsOn | ||
| 0x3B | 0x1 | RwInt8 | mbViewedRaceTraining | ||
| 0x3C | 0x1 | RwInt8 | mbViewedTrafficAttackTraining | ||
| 0x3D | 0x1 | RwInt8 | mbViewedCrashTraining | ||
| 0x3E | 0x1 | RwInt8 | mbViewedRoadRageTraining | ||
| 0x3F | 0x1 | RwInt8 | mbViewedRevengeTraining | ||
| 0x40 | 0x4 | EOptionServicePartySecurity | mePartySecurity | ||
| 0x44 | 0x4 | EGtNetworkHeadsetOutputMode | mePartyHeadsetOutputMode | ||
| 0x48 | 0x1 | bool | mbPartyAppearanceOnline | ||
| 0x49 | 0x10 | char[16] | macPartyPassword | ||
| 0x59 | 0x3 | Padding |
CB4Profile
In the retail game, this is a structure containing only CB4ProfileStoredData.
CB4ProfileStoredData
PlayStation 2, Xbox
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0x4 | CGtTimeStamp | mTimeStamp | ||
| 0x4 | 0x4 | RwReal | mrTotalPlayingTimeInSecs | ||
| 0x8 | 0x12 | GtUTF16[9] | maNameString | ||
| 0x1A | 0x12 | GtUTF16[9] | maMutiPlayer1NameString | ||
| 0x2C | 0x12 | GtUTF16[9] | maMutiPlayer2NameString | ||
| 0x3E | 0x2 | Padding | |||
| 0x40 | 0x4 | RwInt32 | mnRankID | ||
| 0x44 | 0x4 | RwInt32 | mnNumUnlockedEvents | ||
| 0x48 | 0x4 | RwInt32 | mnNumGoldMedals | ||
| 0x4C | 0x4 | RwInt32 | mnPercentComplete | ||
| 0x50 | 0x4 | RwUInt32 | ? | Possibly RwInt32 | |
| 0x54 | 0x4 | RwUInt32 | ? | ||
| 0x58 | 0x4 | RwUInt32 | ? | ||
| 0x5C | 0x4 | RwUInt32 | ? | ||
| 0x60 | 0x4 | RwUInt32 | ? | ||
| 0x64 | 0x4 | RwUInt32 | ? | ||
| 0x68 | 0x4 | RwUInt32 | ? | ||
| 0x6C | 0x4 | RwUInt32 | ? | ||
| 0x70 | 0x4 | RwUInt32 | ? | ||
| 0x74 | 0x4 | RwUInt32 | ? | ||
| 0x78 | 0x4 | RwUInt32 | ? | ||
| 0x7C | 0x4 | RwUInt32 | ? | ||
| 0x80 | 0x4 | RwUInt32 | ? | ||
| 0x84 | 0x4 | RwUInt32 | ? | ||
| 0x88 | 0x4 | RwUInt32 | ? | ||
| 0x8C | 0x113 | RwInt8[275] | man8ChallengeMedal | ||
| 0x19F | 0x113 | RwInt8[275] | man8ChallengeRating | ||
| 0x2B2 | 0x2 | Padding | |||
| 0x2B4 | 0x4 | RwUInt32 | muTotalChallenges | ||
| 0x2B8 | 0x8 | RwUInt8[8] | mau8ChallengeSheetsUnlocked | ||
| 0x2C0 | 0x40 | RwUInt8[8][8] | maau8ChallengesCompleted | ||
| 0x300 | 0x18 | RwUInt8[3][8] | maau8SignatureTDsCompleted | ||
| 0x318 | 0x898 | GtID[275] | maChallengeList | ||
| 0xBB0 | 0x400 | GtID[128] | maVehicleList | ||
| 0xFB0 | 0x1A0 | GtID[52] | maTrackList | ||
| 0x1150 | 0x1 | RwUInt8 | mu8B3SaveDetected | ||
| 0x1151 | 0x1 | RwUInt8 | mu8MaddenSaveDetected | ||
| 0x1152 | 0x1 | RwUInt8 | ? | ||
| 0x1153 | 0x1 | Padding | |||
| 0x1154 | 0x4 | RwUInt32 | muOnlineRaceEventCount | ||
| 0x1158 | 0x4 | RwUInt32 | muOnlineCrashEventCount | ||
| 0x115C | 0x4 | RwUInt32 | muOfflineRaceEventCount | ||
| 0x1160 | 0x4 | RwUInt32 | muOfflineCrashEventCount | ||
| 0x1164 | 0xD0 | RwReal[52] | marFastestLaps | ||
| 0x1234 | 0x34 | bool[52] | mabFastestLapNeedsUploading | ||
| 0x1268 | 0xD0 | RwUInt32[52] | mauHighestTrafficAttackScore | ||
| 0x1338 | 0x34 | bool[52] | mabTAScoreNeedsUploading | ||
| 0x136C | 0x1B0 | RwUInt32[108] | mauHighestCrashModeScore | ||
| 0x151C | 0x6C | bool[108] | mabHighestCrashScoreNeedsUploading | ||
| 0x1588 | 0x44C | RwReal[275] | ? | Records | |
| 0x19D4 | 0x4 | RwUInt32 | muStandardTakedowns | ||
| 0x19D8 | 0x4 | RwUInt32 | muSignatureTakedowns | ||
| 0x19DC | 0x4 | RwUInt32 | muAftertouchTakedowns | ||
| 0x19E0 | 0x4 | RwUInt32 | muCrashbreakerTakedowns | ||
| 0x19E4 | 0x4 | RwUInt32 | muPsycheOutTakedowns | ||
| 0x19E8 | 0x4 | RwUInt32 | muTrafficCheckTakedowns | ||
| 0x19EC | 0x4 | RwUInt32 | muVerticalTakedowns | ||
| 0x19F0 | 0x4 | RwUInt32 | muTBoneTakedowns | ||
| 0x19F4 | 0x4 | RwUInt32 | muRevengeTakedowns | ||
| 0x19F8 | 0x4 | RwUInt32 | muTotalSlams | ||
| 0x19FC | 0x4 | RwUInt32 | muTotalShunts | ||
| 0x1A00 | 0x4 | RwUInt32 | muTotalRevengeSlams | ||
| 0x1A04 | 0x4 | RwUInt32 | muTotalRevengeShunts | ||
| 0x1A08 | 0x4 | RwUInt32 | muTotalPerfectLaps | ||
| 0x1A0C | 0x4 | RwUInt32 | muTotalBurnoutLaps | ||
| 0x1A10 | 0x4 | RwUInt32 | muTotalCrashEscapes | ||
| 0x1A14 | 0x4 | RwUInt32 | muTotalVehiclesChecked | ||
| 0x1A18 | 0x4 | RwReal | mrTotalBurnTime | ||
| 0x1A1C | 0x4 | RwReal | mrTotalDrift | ||
| 0x1A20 | 0x4 | RwReal | mrTotalOncoming | ||
| 0x1A24 | 0x4 | RwReal | mrTotalAir | ||
| 0x1A28 | 0x4 | RwUInt32 | muTotalCrashDamage | ||
| 0x1A2C | 0x4 | RwUInt32 | muLargestNumCrashModeExplosions | ||
| 0x1A30 | 0x1 | bool | mbRumble | ||
| 0x1A31 | 0x1 | bool | mbIsEmpty | ||
| 0x1A32 | 0x6 | Padding |
Xbox 360
| Offset | Length | Type | Name | Description | Comments |
|---|---|---|---|---|---|
| 0x0 | 0x4 | CGtTimeStamp | mTimeStamp | ||
| 0x4 | 0x4 | RwReal | mrTotalPlayingTimeInSecs | ||
| 0x8 | 0x12 | GtUTF16[9] | maNameString | ||
| 0x1A | 0x12 | GtUTF16[9] | maMutiPlayer1NameString | ||
| 0x2C | 0x12 | GtUTF16[9] | maMutiPlayer2NameString | ||
| 0x3E | 0x2 | Padding | |||
| 0x40 | 0x4 | RwInt32 | mnRankID | ||
| 0x44 | 0x4 | RwInt32 | mnNumUnlockedEvents | ||
| 0x48 | 0x4 | RwInt32 | mnNumGoldMedals | ||
| 0x4C | 0x4 | RwInt32 | mnPercentComplete | ||
| 0x50 | 0x4 | RwUInt32 | ? | Possibly RwInt32 | |
| 0x54 | 0x4 | RwUInt32 | ? | ||
| 0x58 | 0x4 | RwUInt32 | ? | ||
| 0x5C | 0x4 | RwUInt32 | ? | ||
| 0x60 | 0x4 | RwUInt32 | ? | ||
| 0x64 | 0x4 | RwUInt32 | ? | ||
| 0x68 | 0x4 | RwUInt32 | ? | ||
| 0x6C | 0x4 | RwUInt32 | ? | ||
| 0x70 | 0x4 | RwUInt32 | ? | ||
| 0x74 | 0x4 | RwUInt32 | ? | ||
| 0x78 | 0x4 | RwUInt32 | ? | ||
| 0x7C | 0x4 | RwUInt32 | ? | ||
| 0x80 | 0x4 | RwUInt32 | ? | ||
| 0x84 | 0x4 | RwUInt32 | ? | ||
| 0x88 | 0x4 | RwUInt32 | ? | ||
| 0x8C | 0x113 | RwInt8[275] | man8ChallengeMedal | ||
| 0x19F | 0x113 | RwInt8[275] | man8ChallengeRating | ||
| 0x2B2 | 0x2 | Padding | |||
| 0x2B4 | 0x4 | RwUInt32 | muTotalChallenges | ||
| 0x2B8 | 0x8 | RwUInt8[8] | mau8ChallengeSheetsUnlocked | ||
| 0x2C0 | 0x40 | RwUInt8[8][8] | maau8ChallengesCompleted | ||
| 0x300 | 0x18 | RwUInt8[3][8] | maau8SignatureTDsCompleted | ||
| 0x318 | 0x898 | GtID[275] | maChallengeList | ||
| 0xBB0 | 0x4B0 | GtID[150] | maVehicleList | ||
| 0x1060 | 0x1A0 | GtID[52] | maTrackList | ||
| 0x1200 | 0x1 | RwUInt8 | ? | Gamestop entitlement | |
| 0x1201 | 0x1 | RwUInt8 | ? | Game Crazy entitlement | |
| 0x1202 | 0x1 | RwUInt8 | ? | Alienware entitlement | |
| 0x1203 | 0x1 | RwUInt8 | ? | Xbox 360 entitlement | |
| 0x1204 | 0x1 | RwUInt8 | ? | Plantronics entitlement | |
| 0x1205 | 0x1 | RwUInt8 | ? | Best Buy entitlement | |
| 0x1206 | 0x1 | RwUInt8 | ? | Dolby entitlement | |
| 0x1207 | 0x1 | RwUInt8 | ? | Monster entitlement | |
| 0x1208 | 0x1 | RwUInt8 | ? | Yellowcard entitlement | |
| 0x1209 | 0x1 | RwUInt8 | ? | Circuit City entitlement | |
| 0x120A | 0x1 | RwUInt8 | ? | Spike TV entitlement | |
| 0x120B | 0x1 | RwUInt8 | ? | ||
| 0x120C | 0x1 | RwUInt8 | ? | ||
| 0x120D | 0x1 | RwUInt8 | ? | ||
| 0x120E | 0x1 | RwUInt8 | ? | ||
| 0x120F | 0x1 | RwUInt8 | ? | Madden entitlement | |
| 0x1210 | 0x4 | ? | ? | ||
| 0x1214 | 0x4 | RwUInt32 | muOnlineRaceEventCount | ||
| 0x1218 | 0x4 | RwUInt32 | muOnlineCrashEventCount | ||
| 0x121C | 0x4 | RwUInt32 | muOfflineRaceEventCount | ||
| 0x1220 | 0x4 | RwUInt32 | muOfflineCrashEventCount | ||
| 0x1224 | 0xD0 | RwReal[52] | marFastestLaps | ||
| 0x12F4 | 0x34 | bool[52] | mabFastestLapNeedsUploading | ||
| 0x1328 | 0xD0 | RwUInt32[52] | mauHighestTrafficAttackScore | ||
| 0x13F8 | 0x34 | bool[52] | mabTAScoreNeedsUploading | ||
| 0x142C | 0x1B0 | RwUInt32[108] | mauHighestCrashModeScore | ||
| 0x15DC | 0x6C | bool[108] | mabHighestCrashScoreNeedsUploading | ||
| 0x1648 | 0x44C | RwReal[275] | ? | Records | |
| 0x1A94 | 0x4 | RwUInt32 | muStandardTakedowns | ||
| 0x1A98 | 0x4 | RwUInt32 | muSignatureTakedowns | ||
| 0x1A9C | 0x4 | RwUInt32 | muAftertouchTakedowns | ||
| 0x1AA0 | 0x4 | RwUInt32 | muCrashbreakerTakedowns | ||
| 0x1AA4 | 0x4 | RwUInt32 | muPsycheOutTakedowns | ||
| 0x1AA8 | 0x4 | RwUInt32 | muTrafficCheckTakedowns | ||
| 0x1AAC | 0x4 | RwUInt32 | muVerticalTakedowns | ||
| 0x1AB0 | 0x4 | RwUInt32 | muTBoneTakedowns | ||
| 0x1AB4 | 0x4 | RwUInt32 | muRevengeTakedowns | ||
| 0x1AB8 | 0x4 | RwUInt32 | ? | ||
| 0x1ABC | 0x4 | RwUInt32 | muTotalSlams | ||
| 0x1AC0 | 0x4 | RwUInt32 | muTotalShunts | ||
| 0x1AC4 | 0x4 | RwUInt32 | muTotalRevengeSlams | ||
| 0x1AC8 | 0x4 | RwUInt32 | muTotalRevengeShunts | ||
| 0x1ACC | 0x4 | RwUInt32 | muTotalPerfectLaps | ||
| 0x1AD0 | 0x4 | RwUInt32 | muTotalBurnoutLaps | ||
| 0x1AD4 | 0x4 | RwUInt32 | muTotalCrashEscapes | ||
| 0x1AD8 | 0x4 | RwUInt32 | ? | ||
| 0x1ADC | 0x4 | RwUInt32 | muTotalVehiclesChecked | ||
| 0x1AE0 | 0x4 | RwUInt32 | ? | ||
| 0x1AE4 | 0x4 | RwUInt32 | ? | ||
| 0x1AE8 | 0x4 | RwReal | mrTotalBurnTime | ||
| 0x1AEC | 0x4 | RwReal | mrTotalDrift | ||
| 0x1AF0 | 0x4 | RwReal | mrTotalOncoming | ||
| 0x1AF4 | 0x4 | RwReal | mrTotalAir | ||
| 0x1AF8 | 0x4 | RwUInt32 | muTotalCrashDamage | ||
| 0x1AFC | 0x4 | RwUInt32 | muLargestNumCrashModeExplosions | ||
| 0x1B00 | 0x1 | bool | mbRumble | ||
| 0x1B01 | 0x1 | bool | mbIsEmpty | ||
| 0x1B02 | 0xE | Padding |
Enumerations
EOptionServicePartySecurity
| Name | Value | Comments |
|---|---|---|
| ePartySecurityPublic | 0 | |
| ePartySecurityPrivate | 1 | |
| ePartySecurityClosed | 2 | |
| ePartySecurityMax | 3 |
EGtNetworkHeadsetOutputMode
| Name | Value | Comments |
|---|---|---|
| eGtNetworkHeadsetOutputMode_Headset | 0 | |
| eGtNetworkHeadsetOutputMode_TVSpeakers | 1 | |
| eGtNetworkHeadsetOutputMode_Muted | 2 | |
| eGtNetworkHeadsetOutputMode_Max | 3 |