The profile for Burnout Revenge contains all progression information, including event completion, unlocks, and statistics, along with settings.
Headers and protection
At least two layers of protection are present on all platforms. A tool such as RevengeChecksumGen can be used to recalculate the checksums.
All profiles use EA's proprietary MC02 header to protect the data. Following any edits, the profile must be rehashed using a program such as MC02 Package Tool .
The following information is from symbols in Burnout Revenge (Alpha 7 build) . Signature_t is a typedef of uint32_t.
RealmcCore::FileHeader
Offset
Length
Type
Name
Description
Comments
0x0
0x4
uint32_t
mFileHeaderVersion
Magic
Must be 'MC02' MC = Memory Card 02 = version 2
0x4
0x4
uint32_t
mFileSize
Length of the save in bytes
Includes the MC02 header
0x8
0x4
uint32_t
mUserHeaderSize
Save header length in bytes
0xC
0x4
uint32_t
mUserBodySize
Save data length in bytes
0x10
0x4
Signature_t
mUserHeaderSignature
Save header CRC32
0x14
0x4
Signature_t
mUserBodySignature
Save data CRC32
0x18
0x4
Signature_t
mFileHeaderSignature
MC02 header CRC32
Hashes everything prior to this field
The CRC32 algorithm used is nonstandard. See this gist for an example implementation.
Checksum
A proprietary checksum is appended to each profile for validation purposes. This is calculated by summing every 4 bytes (read as unsigned 32-bit integers) in the CB4SaveGameData structure, excluding the checksum itself and any padding after it.
Structures
Data
This defines the de facto structure of the save file. The game does not treat it as a structure, instead reading the names and saves into the memory card manager, which is what the information below is based on.
PlayStation 2
Offset
Length
Type
Name
Description
Comments
0x0
0xC0
GtUTF8[3][64]
maaSaveNames
Save names
0xC0
0x4FE0
CB4SaveGameData [3]
maSaveGameData
Saves
Xbox
Offset
Length
Type
Name
Description
Comments
0x0
0x30
?
?
384-bit key?
Multiplayer-related?
0x30
0xC0
GtUTF8[3][64]
maaSaveNames
Save names
0xF0
0x5010
CB4SaveGameData [3]
maSaveGameData
Saves
Xbox 360
Offset
Length
Type
Name
Description
Comments
0x0
0xC0
GtUTF8[3][64]
maaSaveNames
Save names
0xC0
0x5268
CB4SaveGameData [3]
maSaveGameData
Saves
CB4SaveGameData
PlayStation 2
Offset
Length
Type
Name
Description
Comments
0x0
0x4
RwInt32
mnDataVersion
24
0x4
0x5C
CB4Settings
mSettings
0x60
0x1A38
CB4Profile
mPlayerProfile
0x1A98
0x4
RwUInt32
munCheckSum
0x1A9C
0x4
Padding
Xbox
Offset
Length
Type
Name
Description
Comments
0x0
0x4
RwInt32
mnDataVersion
24
0x4
0x5C
CB4Settings
mSettings
0x60
0x1A38
CB4Profile
mPlayerProfile
0x1A98
0x4
RwUInt32
munCheckSum
0x1A9C
0x4
?
?
Padding?
0x1AA0
0x10
?
?
128-bit key?
Multiplayer-related?
Xbox 360
Offset
Length
Type
Name
Description
Comments
0x0
0x4
RwInt32
mnDataVersion
31
0x4
0x5C
CB4Settings
mSettings
0x60
0x1B10
CB4Profile
mPlayerProfile
0x1B70
0x4
RwUInt32
munCheckSum
0x1B74
0x4
Padding
CB4Settings
Offset
Length
Type
Name
Description
Comments
0x0
0x29
RwUInt8[41]
maun8SongFlags
0x29
0x2
RwInt8[2]
mabRumble
0x2B
0x1
RwInt8
mn8ScreenOffsetX
0x2C
0x1
RwInt8
mn8ScreenOffsetY
0x2D
0x1
RwInt8
mbPad0
0x2E
0x1
RwInt8
mn8SoundConfig
0x2F
0x1
RwInt8
mn8SFXVolume
0x30
0x1
RwInt8
mn8MusicVolume
0x31
0x1
RwInt8
mn8DJVolume
0x32
0x1
RwInt8
mn8SongIndex
0x33
0x1
RwInt8
mn8SoundtrackIndex
0x34
0x1
RwInt8
mn8RadioOn
0x35
0x1
RwInt8
mbPlayModeRandom
0x36
0x1
RwInt8
mn8TakedownCamMode
0x37
0x1
RwInt8
mbCrashAutoSlowMo
0x38
0x2
RwInt8[2]
mabExternalCam
0x3A
0x1
RwInt8
mbAutoSaveIsOn
0x3B
0x1
RwInt8
mbViewedRaceTraining
0x3C
0x1
RwInt8
mbViewedTrafficAttackTraining
0x3D
0x1
RwInt8
mbViewedCrashTraining
0x3E
0x1
RwInt8
mbViewedRoadRageTraining
0x3F
0x1
RwInt8
mbViewedRevengeTraining
0x40
0x4
EOptionServicePartySecurity
mePartySecurity
0x44
0x4
EGtNetworkHeadsetOutputMode
mePartyHeadsetOutputMode
0x48
0x1
bool
mbPartyAppearanceOnline
0x49
0x10
char[16]
macPartyPassword
0x59
0x3
Padding
CB4Profile
In the retail game, this is a structure containing only CB4ProfileStoredData .
CB4ProfileStoredData
PlayStation 2, Xbox
Offset
Length
Type
Name
Description
Comments
0x0
0x4
CGtTimeStamp
mTimeStamp
0x4
0x4
RwReal
mrTotalPlayingTimeInSecs
0x8
0x12
GtUTF16[9]
maNameString
0x1A
0x12
GtUTF16[9]
maMutiPlayer1NameString
0x2C
0x12
GtUTF16[9]
maMutiPlayer2NameString
0x3E
0x2
Padding
0x40
0x4
RwInt32
mnRankID
0x44
0x4
RwInt32
mnNumUnlockedEvents
0x48
0x4
RwInt32
mnNumGoldMedals
0x4C
0x4
RwInt32
mnPercentComplete
0x50
0x4
RwUInt32
?
Possibly RwInt32
0x54
0x4
RwUInt32
?
0x58
0x4
RwUInt32
?
0x5C
0x4
RwUInt32
?
0x60
0x4
RwUInt32
?
0x64
0x4
RwUInt32
?
0x68
0x4
RwUInt32
?
0x6C
0x4
RwUInt32
?
0x70
0x4
RwUInt32
?
0x74
0x4
RwUInt32
?
0x78
0x4
RwUInt32
?
0x7C
0x4
RwUInt32
?
0x80
0x4
RwUInt32
?
0x84
0x4
RwUInt32
?
0x88
0x4
RwUInt32
?
0x8C
0x113
RwInt8[275]
man8ChallengeMedal
0x19F
0x113
RwInt8[275]
man8ChallengeRating
0x2B2
0x2
Padding
0x2B4
0x4
RwUInt32
muTotalChallenges
0x2B8
0x8
RwUInt8[8]
mau8ChallengeSheetsUnlocked
0x2C0
0x40
RwUInt8[8][8]
maau8ChallengesCompleted
0x300
0x18
RwUInt8[3][8]
maau8SignatureTDsCompleted
0x318
0x898
GtID [275]
maChallengeList
0xBB0
0x400
GtID [128]
maVehicleList
0xFB0
0x1A0
GtID [52]
maTrackList
0x1150
0x1
RwUInt8
mu8B3SaveDetected
0x1151
0x1
RwUInt8
mu8MaddenSaveDetected
0x1152
0x1
RwUInt8
?
0x1153
0x1
Padding
0x1154
0x4
RwUInt32
muOnlineRaceEventCount
0x1158
0x4
RwUInt32
muOnlineCrashEventCount
0x115C
0x4
RwUInt32
muOfflineRaceEventCount
0x1160
0x4
RwUInt32
muOfflineCrashEventCount
0x1164
0xD0
RwReal[52]
marFastestLaps
0x1234
0x34
bool[52]
mabFastestLapNeedsUploading
0x1268
0xD0
RwUInt32[52]
mauHighestTrafficAttackScore
0x1338
0x34
bool[52]
mabTAScoreNeedsUploading
0x136C
0x1B0
RwUInt32[108]
mauHighestCrashModeScore
0x151C
0x6C
bool[108]
mabHighestCrashScoreNeedsUploading
0x1588
0x44C
RwReal[275]
?
Records
0x19D4
0x4
RwUInt32
muStandardTakedowns
0x19D8
0x4
RwUInt32
muSignatureTakedowns
0x19DC
0x4
RwUInt32
muAftertouchTakedowns
0x19E0
0x4
RwUInt32
muCrashbreakerTakedowns
0x19E4
0x4
RwUInt32
muPsycheOutTakedowns
0x19E8
0x4
RwUInt32
muTrafficCheckTakedowns
0x19EC
0x4
RwUInt32
muVerticalTakedowns
0x19F0
0x4
RwUInt32
muTBoneTakedowns
0x19F4
0x4
RwUInt32
muRevengeTakedowns
0x19F8
0x4
RwUInt32
muTotalSlams
0x19FC
0x4
RwUInt32
muTotalShunts
0x1A00
0x4
RwUInt32
muTotalRevengeSlams
0x1A04
0x4
RwUInt32
muTotalRevengeShunts
0x1A08
0x4
RwUInt32
muTotalPerfectLaps
0x1A0C
0x4
RwUInt32
muTotalBurnoutLaps
0x1A10
0x4
RwUInt32
muTotalCrashEscapes
0x1A14
0x4
RwUInt32
muTotalVehiclesChecked
0x1A18
0x4
RwReal
mrTotalBurnTime
0x1A1C
0x4
RwReal
mrTotalDrift
0x1A20
0x4
RwReal
mrTotalOncoming
0x1A24
0x4
RwReal
mrTotalAir
0x1A28
0x4
RwUInt32
muTotalCrashDamage
0x1A2C
0x4
RwUInt32
muLargestNumCrashModeExplosions
0x1A30
0x1
bool
mbRumble
0x1A31
0x1
bool
mbIsEmpty
0x1A32
0x6
Padding
Xbox 360
Offset
Length
Type
Name
Description
Comments
0x0
0x4
CGtTimeStamp
mTimeStamp
0x4
0x4
RwReal
mrTotalPlayingTimeInSecs
0x8
0x12
GtUTF16[9]
maNameString
0x1A
0x12
GtUTF16[9]
maMutiPlayer1NameString
0x2C
0x12
GtUTF16[9]
maMutiPlayer2NameString
0x3E
0x2
Padding
0x40
0x4
RwInt32
mnRankID
0x44
0x4
RwInt32
mnNumUnlockedEvents
0x48
0x4
RwInt32
mnNumGoldMedals
0x4C
0x4
RwInt32
mnPercentComplete
0x50
0x4
RwUInt32
?
Possibly RwInt32
0x54
0x4
RwUInt32
?
0x58
0x4
RwUInt32
?
0x5C
0x4
RwUInt32
?
0x60
0x4
RwUInt32
?
0x64
0x4
RwUInt32
?
0x68
0x4
RwUInt32
?
0x6C
0x4
RwUInt32
?
0x70
0x4
RwUInt32
?
0x74
0x4
RwUInt32
?
0x78
0x4
RwUInt32
?
0x7C
0x4
RwUInt32
?
0x80
0x4
RwUInt32
?
0x84
0x4
RwUInt32
?
0x88
0x4
RwUInt32
?
0x8C
0x113
RwInt8[275]
man8ChallengeMedal
0x19F
0x113
RwInt8[275]
man8ChallengeRating
0x2B2
0x2
Padding
0x2B4
0x4
RwUInt32
muTotalChallenges
0x2B8
0x8
RwUInt8[8]
mau8ChallengeSheetsUnlocked
0x2C0
0x40
RwUInt8[8][8]
maau8ChallengesCompleted
0x300
0x18
RwUInt8[3][8]
maau8SignatureTDsCompleted
0x318
0x898
GtID [275]
maChallengeList
0xBB0
0x4B0
GtID [150]
maVehicleList
0x1060
0x1A0
GtID [52]
maTrackList
0x1200
0x1
RwUInt8
?
Gamestop entitlement
0x1201
0x1
RwUInt8
?
Game Crazy entitlement
0x1202
0x1
RwUInt8
?
Alienware entitlement
0x1203
0x1
RwUInt8
?
Xbox 360 entitlement
0x1204
0x1
RwUInt8
?
Plantronics entitlement
0x1205
0x1
RwUInt8
?
Best Buy entitlement
0x1206
0x1
RwUInt8
?
Dolby entitlement
0x1207
0x1
RwUInt8
?
Monster entitlement
0x1208
0x1
RwUInt8
?
Yellowcard entitlement
0x1209
0x1
RwUInt8
?
Circuit City entitlement
0x120A
0x1
RwUInt8
?
Spike TV entitlement
0x120B
0x1
RwUInt8
?
0x120C
0x1
RwUInt8
?
0x120D
0x1
RwUInt8
?
0x120E
0x1
RwUInt8
?
0x120F
0x1
RwUInt8
?
Madden entitlement
0x1210
0x4
?
?
0x1214
0x4
RwUInt32
muOnlineRaceEventCount
0x1218
0x4
RwUInt32
muOnlineCrashEventCount
0x121C
0x4
RwUInt32
muOfflineRaceEventCount
0x1220
0x4
RwUInt32
muOfflineCrashEventCount
0x1224
0xD0
RwReal[52]
marFastestLaps
0x12F4
0x34
bool[52]
mabFastestLapNeedsUploading
0x1328
0xD0
RwUInt32[52]
mauHighestTrafficAttackScore
0x13F8
0x34
bool[52]
mabTAScoreNeedsUploading
0x142C
0x1B0
RwUInt32[108]
mauHighestCrashModeScore
0x15DC
0x6C
bool[108]
mabHighestCrashScoreNeedsUploading
0x1648
0x44C
RwReal[275]
?
Records
0x1A94
0x4
RwUInt32
muStandardTakedowns
0x1A98
0x4
RwUInt32
muSignatureTakedowns
0x1A9C
0x4
RwUInt32
muAftertouchTakedowns
0x1AA0
0x4
RwUInt32
muCrashbreakerTakedowns
0x1AA4
0x4
RwUInt32
muPsycheOutTakedowns
0x1AA8
0x4
RwUInt32
muTrafficCheckTakedowns
0x1AAC
0x4
RwUInt32
muVerticalTakedowns
0x1AB0
0x4
RwUInt32
muTBoneTakedowns
0x1AB4
0x4
RwUInt32
muRevengeTakedowns
0x1AB8
0x4
RwUInt32
?
0x1ABC
0x4
RwUInt32
muTotalSlams
0x1AC0
0x4
RwUInt32
muTotalShunts
0x1AC4
0x4
RwUInt32
muTotalRevengeSlams
0x1AC8
0x4
RwUInt32
muTotalRevengeShunts
0x1ACC
0x4
RwUInt32
muTotalPerfectLaps
0x1AD0
0x4
RwUInt32
muTotalBurnoutLaps
0x1AD4
0x4
RwUInt32
muTotalCrashEscapes
0x1AD8
0x4
RwUInt32
?
0x1ADC
0x4
RwUInt32
muTotalVehiclesChecked
0x1AE0
0x4
RwUInt32
?
0x1AE4
0x4
RwUInt32
?
0x1AE8
0x4
RwReal
mrTotalBurnTime
0x1AEC
0x4
RwReal
mrTotalDrift
0x1AF0
0x4
RwReal
mrTotalOncoming
0x1AF4
0x4
RwReal
mrTotalAir
0x1AF8
0x4
RwUInt32
muTotalCrashDamage
0x1AFC
0x4
RwUInt32
muLargestNumCrashModeExplosions
0x1B00
0x1
bool
mbRumble
0x1B01
0x1
bool
mbIsEmpty
0x1B02
0xE
Padding
Enumerations
EOptionServicePartySecurity
Name
Value
Comments
ePartySecurityPublic
0
ePartySecurityPrivate
1
ePartySecurityClosed
2
ePartySecurityMax
3
EGtNetworkHeadsetOutputMode
Name
Value
Comments
eGtNetworkHeadsetOutputMode_Headset
0
eGtNetworkHeadsetOutputMode_TVSpeakers
1
eGtNetworkHeadsetOutputMode_Muted
2
eGtNetworkHeadsetOutputMode_Max
3