Profile/Burnout Revenge

The profile for Burnout Revenge contains all progression information, including event completion, unlocks, and statistics, along with settings.

Headers and protection

At least two layers of protection are present on all platforms. A tool such as RevengeChecksumGen can be used to recalculate the checksums.

Header

All profiles use EA's proprietary MC02 header to protect the data. Following any edits, the profile must be rehashed using a program such as MC02 Package Tool.

The following information is from symbols in Burnout Revenge (Alpha 7 build), Dead Space 2 (2010-11-19 build), and The Godfather (2006-04-10 build).

PlayStation 2, Xbox 360

Signature_t is a typedef of uint32_t. It is used to hold CRC32 checksums. The algorithm used is nonstandard. See this gist for an example implementation.

RealmcCore::FileHeader
Offset Length Type Name Description Comments
0x0 0x4 uint32_t mFileHeaderVersion Magic Must be 'MC02'
MC = Memory Card
02 = version 2
0x4 0x4 uint32_t mFileSize Length of the save in bytes Includes the MC02 header
0x8 0x4 uint32_t mUserHeaderSize Save header length in bytes
0xC 0x4 uint32_t mUserBodySize Save data length in bytes
0x10 0x4 Signature_t mUserHeaderSignature Save header signature
0x14 0x4 Signature_t mUserBodySignature Save data signature
0x18 0x4 Signature_t mFileHeaderSignature MC02 header signature Hashes everything prior to this field

Xbox

Identical to normal MC02 but with HMAC-SHA1 signatures (denoted by the XCALC_SIGNATURE type) instead of CRC32.

RealmcCore::FileHeader
Offset Length Type Name Description Comments
0x0 0x4 uint32_t mFileHeaderVersion Magic Must be 'MC02'
MC = Memory Card
02 = version 2
0x4 0x4 uint32_t mFileSize Length of the save in bytes Includes the MC02 header
0x8 0x4 uint32_t mUserHeaderSize Save header length in bytes
0xC 0x4 uint32_t mUserBodySize Save data length in bytes
0x10 0x14 XCALC_SIGNATURE mUserHeaderSignature Save header signature
0x24 0x14 XCALC_SIGNATURE mUserBodySignature Save data signature
0x38 0x14 XCALC_SIGNATURE mFileHeaderSignature MC02 header signature Hashes everything prior to this field

Checksum

A proprietary checksum is appended to each profile for validation purposes. This is calculated by summing every 4 bytes (read as unsigned 32-bit integers) in the CB4SaveGameData structure, excluding the checksum itself and any padding after it.

Xbox has an additional checksum after the aforementioned checksum. It uses the same algorithm as the MC02 signatures.

Structures

Data

The following table defines the de facto structure of the save file. The game does not treat it as a structure, instead separately reading the names and saves into the memory card manager.

Offset Length Type Name Description Comments
0x0 0xC0 GtUTF8[3][64] maaSaveNames Save names
0xC0 Platform dependent CB4SaveGameData[3] maSaveGameData Saves

CB4SaveGameData

PlayStation 2

Offset Length Type Name Description Comments
0x0 0x4 RwInt32 mnDataVersion 24
0x4 0x5C CB4Settings mSettings
0x60 0x1A38 CB4Profile mPlayerProfile
0x1A98 0x4 RwUInt32 munCheckSum
0x1A9C 0x4 Padding

Xbox

Offset Length Type Name Description Comments
0x0 0x4 RwInt32 mnDataVersion 24
0x4 0x5C CB4Settings mSettings
0x60 0x1A38 CB4Profile mPlayerProfile
0x1A98 0x4 RwUInt32 munCheckSum
0x1A9C 0x14 ? ? HMAC-SHA1 checksum

Xbox 360

Offset Length Type Name Description Comments
0x0 0x4 RwInt32 mnDataVersion 31
0x4 0x5C CB4Settings mSettings
0x60 0x1B10 CB4Profile mPlayerProfile
0x1B70 0x4 RwUInt32 munCheckSum
0x1B74 0x4 Padding

CB4Settings

Offset Length Type Name Description Comments
0x0 0x29 RwUInt8[41] maun8SongFlags
0x29 0x2 RwInt8[2] mabRumble
0x2B 0x1 RwInt8 mn8ScreenOffsetX
0x2C 0x1 RwInt8 mn8ScreenOffsetY
0x2D 0x1 RwInt8 mbPad0
0x2E 0x1 RwInt8 mn8SoundConfig
0x2F 0x1 RwInt8 mn8SFXVolume
0x30 0x1 RwInt8 mn8MusicVolume
0x31 0x1 RwInt8 mn8DJVolume
0x32 0x1 RwInt8 mn8SongIndex
0x33 0x1 RwInt8 mn8SoundtrackIndex
0x34 0x1 RwInt8 mn8RadioOn
0x35 0x1 RwInt8 mbPlayModeRandom
0x36 0x1 RwInt8 mn8TakedownCamMode
0x37 0x1 RwInt8 mbCrashAutoSlowMo
0x38 0x2 RwInt8[2] mabExternalCam
0x3A 0x1 RwInt8 mbAutoSaveIsOn
0x3B 0x1 RwInt8 mbViewedRaceTraining
0x3C 0x1 RwInt8 mbViewedTrafficAttackTraining
0x3D 0x1 RwInt8 mbViewedCrashTraining
0x3E 0x1 RwInt8 mbViewedRoadRageTraining
0x3F 0x1 RwInt8 mbViewedRevengeTraining
0x40 0x4 EOptionServicePartySecurity mePartySecurity
0x44 0x4 EGtNetworkHeadsetOutputMode mePartyHeadsetOutputMode
0x48 0x1 bool mbPartyAppearanceOnline
0x49 0x10 char[16] macPartyPassword
0x59 0x3 Padding

CB4Profile

In the retail game, this is a structure containing only CB4ProfileStoredData.

CB4ProfileStoredData

PlayStation 2, Xbox

Offset Length Type Name Description Comments
0x0 0x4 CGtTimeStamp mTimeStamp
0x4 0x4 RwReal mrTotalPlayingTimeInSecs
0x8 0x12 GtUTF16[9] maNameString
0x1A 0x12 GtUTF16[9] maMutiPlayer1NameString
0x2C 0x12 GtUTF16[9] maMutiPlayer2NameString
0x3E 0x2 Padding
0x40 0x4 RwInt32 mnRankID
0x44 0x4 RwInt32 mnNumUnlockedEvents
0x48 0x4 RwInt32 mnNumGoldMedals
0x4C 0x4 RwInt32 mnPercentComplete
0x50 0x4 RwUInt32 ? Possibly RwInt32
0x54 0x4 RwUInt32 ?
0x58 0x4 RwUInt32 ?
0x5C 0x4 RwUInt32 ?
0x60 0x4 RwUInt32 ?
0x64 0x4 RwUInt32 ?
0x68 0x4 RwUInt32 ?
0x6C 0x4 RwUInt32 ?
0x70 0x4 RwUInt32 ?
0x74 0x4 RwUInt32 ?
0x78 0x4 RwUInt32 ?
0x7C 0x4 RwUInt32 ?
0x80 0x4 RwUInt32 ?
0x84 0x4 RwUInt32 ?
0x88 0x4 RwUInt32 ?
0x8C 0x113 RwInt8[275] man8ChallengeMedal
0x19F 0x113 RwInt8[275] man8ChallengeRating
0x2B2 0x2 Padding
0x2B4 0x4 RwUInt32 muTotalChallenges
0x2B8 0x8 RwUInt8[8] mau8ChallengeSheetsUnlocked
0x2C0 0x40 RwUInt8[8][8] maau8ChallengesCompleted
0x300 0x18 RwUInt8[3][8] maau8SignatureTDsCompleted
0x318 0x898 GtID[275] maChallengeList
0xBB0 0x400 GtID[128] maVehicleList
0xFB0 0x1A0 GtID[52] maTrackList
0x1150 0x1 RwUInt8 mu8B3SaveDetected
0x1151 0x1 RwUInt8 mu8MaddenSaveDetected
0x1152 0x1 RwUInt8 ?
0x1153 0x1 Padding
0x1154 0x4 RwUInt32 muOnlineRaceEventCount
0x1158 0x4 RwUInt32 muOnlineCrashEventCount
0x115C 0x4 RwUInt32 muOfflineRaceEventCount
0x1160 0x4 RwUInt32 muOfflineCrashEventCount
0x1164 0xD0 RwReal[52] marFastestLaps
0x1234 0x34 bool[52] mabFastestLapNeedsUploading
0x1268 0xD0 RwUInt32[52] mauHighestTrafficAttackScore
0x1338 0x34 bool[52] mabTAScoreNeedsUploading
0x136C 0x1B0 RwUInt32[108] mauHighestCrashModeScore
0x151C 0x6C bool[108] mabHighestCrashScoreNeedsUploading
0x1588 0x44C RwReal[275] ? Records
0x19D4 0x4 RwUInt32 muStandardTakedowns
0x19D8 0x4 RwUInt32 muSignatureTakedowns
0x19DC 0x4 RwUInt32 muAftertouchTakedowns
0x19E0 0x4 RwUInt32 muCrashbreakerTakedowns
0x19E4 0x4 RwUInt32 muPsycheOutTakedowns
0x19E8 0x4 RwUInt32 muTrafficCheckTakedowns
0x19EC 0x4 RwUInt32 muVerticalTakedowns
0x19F0 0x4 RwUInt32 muTBoneTakedowns
0x19F4 0x4 RwUInt32 muRevengeTakedowns
0x19F8 0x4 RwUInt32 muTotalSlams
0x19FC 0x4 RwUInt32 muTotalShunts
0x1A00 0x4 RwUInt32 muTotalRevengeSlams
0x1A04 0x4 RwUInt32 muTotalRevengeShunts
0x1A08 0x4 RwUInt32 muTotalPerfectLaps
0x1A0C 0x4 RwUInt32 muTotalBurnoutLaps
0x1A10 0x4 RwUInt32 muTotalCrashEscapes
0x1A14 0x4 RwUInt32 muTotalVehiclesChecked
0x1A18 0x4 RwReal mrTotalBurnTime
0x1A1C 0x4 RwReal mrTotalDrift
0x1A20 0x4 RwReal mrTotalOncoming
0x1A24 0x4 RwReal mrTotalAir
0x1A28 0x4 RwUInt32 muTotalCrashDamage
0x1A2C 0x4 RwUInt32 muLargestNumCrashModeExplosions
0x1A30 0x1 bool mbRumble
0x1A31 0x1 bool mbIsEmpty
0x1A32 0x6 Padding

Xbox 360

Offset Length Type Name Description Comments
0x0 0x4 CGtTimeStamp mTimeStamp
0x4 0x4 RwReal mrTotalPlayingTimeInSecs
0x8 0x12 GtUTF16[9] maNameString
0x1A 0x12 GtUTF16[9] maMutiPlayer1NameString
0x2C 0x12 GtUTF16[9] maMutiPlayer2NameString
0x3E 0x2 Padding
0x40 0x4 RwInt32 mnRankID
0x44 0x4 RwInt32 mnNumUnlockedEvents
0x48 0x4 RwInt32 mnNumGoldMedals
0x4C 0x4 RwInt32 mnPercentComplete
0x50 0x4 RwUInt32 ? Possibly RwInt32
0x54 0x4 RwUInt32 ?
0x58 0x4 RwUInt32 ?
0x5C 0x4 RwUInt32 ?
0x60 0x4 RwUInt32 ?
0x64 0x4 RwUInt32 ?
0x68 0x4 RwUInt32 ?
0x6C 0x4 RwUInt32 ?
0x70 0x4 RwUInt32 ?
0x74 0x4 RwUInt32 ?
0x78 0x4 RwUInt32 ?
0x7C 0x4 RwUInt32 ?
0x80 0x4 RwUInt32 ?
0x84 0x4 RwUInt32 ?
0x88 0x4 RwUInt32 ?
0x8C 0x113 RwInt8[275] man8ChallengeMedal
0x19F 0x113 RwInt8[275] man8ChallengeRating
0x2B2 0x2 Padding
0x2B4 0x4 RwUInt32 muTotalChallenges
0x2B8 0x8 RwUInt8[8] mau8ChallengeSheetsUnlocked
0x2C0 0x40 RwUInt8[8][8] maau8ChallengesCompleted
0x300 0x18 RwUInt8[3][8] maau8SignatureTDsCompleted
0x318 0x898 GtID[275] maChallengeList
0xBB0 0x4B0 GtID[150] maVehicleList
0x1060 0x1A0 GtID[52] maTrackList
0x1200 0x1 RwUInt8 ? Gamestop entitlement
0x1201 0x1 RwUInt8 ? Game Crazy entitlement
0x1202 0x1 RwUInt8 ? Alienware entitlement
0x1203 0x1 RwUInt8 ? Xbox 360 entitlement
0x1204 0x1 RwUInt8 ? Plantronics entitlement
0x1205 0x1 RwUInt8 ? Best Buy entitlement
0x1206 0x1 RwUInt8 ? Dolby entitlement
0x1207 0x1 RwUInt8 ? Monster entitlement
0x1208 0x1 RwUInt8 ? Yellowcard entitlement
0x1209 0x1 RwUInt8 ? Circuit City entitlement
0x120A 0x1 RwUInt8 ? Spike TV entitlement
0x120B 0x1 RwUInt8 ?
0x120C 0x1 RwUInt8 ?
0x120D 0x1 RwUInt8 ?
0x120E 0x1 RwUInt8 ?
0x120F 0x1 RwUInt8 ? Madden entitlement
0x1210 0x4 ? ?
0x1214 0x4 RwUInt32 muOnlineRaceEventCount
0x1218 0x4 RwUInt32 muOnlineCrashEventCount
0x121C 0x4 RwUInt32 muOfflineRaceEventCount
0x1220 0x4 RwUInt32 muOfflineCrashEventCount
0x1224 0xD0 RwReal[52] marFastestLaps
0x12F4 0x34 bool[52] mabFastestLapNeedsUploading
0x1328 0xD0 RwUInt32[52] mauHighestTrafficAttackScore
0x13F8 0x34 bool[52] mabTAScoreNeedsUploading
0x142C 0x1B0 RwUInt32[108] mauHighestCrashModeScore
0x15DC 0x6C bool[108] mabHighestCrashScoreNeedsUploading
0x1648 0x44C RwReal[275] ? Records
0x1A94 0x4 RwUInt32 muStandardTakedowns
0x1A98 0x4 RwUInt32 muSignatureTakedowns
0x1A9C 0x4 RwUInt32 muAftertouchTakedowns
0x1AA0 0x4 RwUInt32 muCrashbreakerTakedowns
0x1AA4 0x4 RwUInt32 muPsycheOutTakedowns
0x1AA8 0x4 RwUInt32 muTrafficCheckTakedowns
0x1AAC 0x4 RwUInt32 muVerticalTakedowns
0x1AB0 0x4 RwUInt32 muTBoneTakedowns
0x1AB4 0x4 RwUInt32 muRevengeTakedowns
0x1AB8 0x4 RwUInt32 ?
0x1ABC 0x4 RwUInt32 muTotalSlams
0x1AC0 0x4 RwUInt32 muTotalShunts
0x1AC4 0x4 RwUInt32 muTotalRevengeSlams
0x1AC8 0x4 RwUInt32 muTotalRevengeShunts
0x1ACC 0x4 RwUInt32 muTotalPerfectLaps
0x1AD0 0x4 RwUInt32 muTotalBurnoutLaps
0x1AD4 0x4 RwUInt32 muTotalCrashEscapes
0x1AD8 0x4 RwUInt32 ?
0x1ADC 0x4 RwUInt32 muTotalVehiclesChecked
0x1AE0 0x4 RwUInt32 ?
0x1AE4 0x4 RwUInt32 ?
0x1AE8 0x4 RwReal mrTotalBurnTime
0x1AEC 0x4 RwReal mrTotalDrift
0x1AF0 0x4 RwReal mrTotalOncoming
0x1AF4 0x4 RwReal mrTotalAir
0x1AF8 0x4 RwUInt32 muTotalCrashDamage
0x1AFC 0x4 RwUInt32 muLargestNumCrashModeExplosions
0x1B00 0x1 bool mbRumble
0x1B01 0x1 bool mbIsEmpty
0x1B02 0xE Padding

Enumerations

EOptionServicePartySecurity

Name Value Comments
ePartySecurityPublic 0
ePartySecurityPrivate 1
ePartySecurityClosed 2
ePartySecurityMax 3

EGtNetworkHeadsetOutputMode

Name Value Comments
eGtNetworkHeadsetOutputMode_Headset 0
eGtNetworkHeadsetOutputMode_TVSpeakers 1
eGtNetworkHeadsetOutputMode_Muted 2
eGtNetworkHeadsetOutputMode_Max 3