A save editor for the 3DS game Luigi's Mansion 2 (also known as Luigi's Mansion: Dark Moon in North American releases).

Note: If you're using a physical 3DS system, you must have custom firmware and/or homebrew installed, as well as a save manager such as Checkpoint. Saves copied from the "Nintendo 3DS" folder on the SD card will not work.

ALWAYS keep a backup of your save files before using a save editor. In the unlikely event that this editor causes you to lose your save data, I cannot be held responsible.

• Luigi's Mansion 2 Save Editor
  • Table of Contents
  • Save File Documentation
    • General Information
    • Save File Format
    • Mission Indices
      • Gloomy Manor
      • Haunted Towers
      • Old Clockworks
      • Secret Mine
      • Treacherous Mansion
      • King Boo's Illusion
    • Ghost Indices
      • Basic (Evershade Valley) Ghosts
      • (Tower) Ghosts
    • Gem Indices
      • Gem Indices for Each Mansion
    • Tower Mode Indices
    • CRC Checksums

This section of the README documents all of my findings related to how the game's save file works. You do not need to read this section to utilise the save editor, it is only for those curious as to the inner workings of the save file format. At some points I reference address offsets in the game's executable in case you wish to find relevant code/data yourself. These addresses require an ELF dump of the European version's executable to utilise. ctr-elf is a good tool to get one of these (you will need an original ROM file). Reverse engineering tools compatible with ARM (such as Ghidra and IDA Pro) are recommended, along with the Citra emulator to allow for easy GDB debugging and save file access.

As with many games, Luigi's Mansion 2 save files use a proprietary binary format designed specifically for the game.

Each profile is stored in a separate file with the slot number being determined solely by the filename. This means that renaming a file is all you need to do to move a profile to another slot, the file contents itself does not differ at all. The files are called profile1.sav, profile2.sav, and profile3.sav in the order you would expect.

As far as I can tell, the save file format does not differ at all between regions. This means, for example, you could copy a save file from the European version to the North American version and it would work identically, no modifications required. Even the so-called "Version CRC" does not change.

The save file is split into two sections which are loaded separately by the game. The first section is 0x1A (26) bytes long and stores the information that is shown when hovering over the profile on the title screen. Changing it does not affect anything in-game. The second section is 0xF1D (3869) bytes long and stores all the information needed once loaded into a save profile. With the sole exception of total playtime, there is no data in the title screen section that cannot be determined using data already present in the in-game section.

If the title screen section of the save file is modified without changing the relevant parameters in the in-game section of the save file, it will be overwritten with the correct values according to the in-game section when the game is next saved.

All numeric values in the save file are stored using the little endian byte format, therefore in memory the single number 0xAABBCCDD would be represented with the bytes 0xDD, 0xCC, 0xBB, 0xAA in that order.

The following is a table of the locations of all the fields within the save file, as well as any additional notes I may have on each field. The in-game section byte offsets have both the overall file offset, as well as the offset relative to the start of the in-game section in brackets.

The names and locations of these fields (though not their type or purpose) is fairly easy to locate due to two functions within the game's executable that list them.

The first one, used for the title screen data, is as follows (decompiled C code generated by Ghidra):

// .text:0027fa94h (file offset: 0x0028fa94)
void FUN_0037fa94(int param_1,undefined *param_2,undefined4 param_3,int param_4)
{
  (*(code *)param_2)("mDataCRC",param_1,0,4,param_3);
  (*(code *)param_2)("mVersionCRC",param_1 + 4,4,4,param_3);
  (*(code *)param_2)("mFurthestClearedMansionIndex",param_1 + 8,8,1,param_3);
  (*(code *)param_2)("mFurthestClearedMissionIndex",param_1 + 9,9,1,param_3);
  (*(code *)param_2)("mTowerHighestFloorClimbed",param_1 + 10,10,1,param_3);
  (*(code *)param_2)("mTotalTreasureAcquired",param_1 + 0xc,0xb,4,param_3);
  (*(code *)param_2)("mTotalBoosCaptured",param_1 + 0x10,0xf,1,param_3);
  (*(code *)param_2)("mTotalDarkmoonPiecesAcquired",param_1 + 0x11,0x10,1,param_3);
  (*(code *)param_2)("mStars",param_1 + 0x12,0x11,1,param_3);
  (*(code *)param_2)("mTimePlayedInSeconds",param_1 + 0x18,0x12,8,param_3);
  if ((0 < param_4) && (param_4 < 0x1a)) {
    software_bkpt(0xa6);
    return;
  }
  return;
}

The second one, used for in-game save data, is as follows:

// .text:0027fe78h (file offset: 0x0028fe78)
void FUN_0037fe78(int param_1,undefined *param_2,undefined4 param_3,int param_4)
{
  bool bVar1;
  bool bVar2;
  
  (*(code *)param_2)("mDataCRC",param_1,0,4,param_3);
  (*(code *)param_2)("mVersionCRC",param_1 + 4,4,4,param_3);
  (*(code *)param_2)("mDiscoveredNIS",param_1 + 8,8,0x800,param_3);
  (*(code *)param_2)("mMansionMissionCompletion",param_1 + 0x808,0x808,0x3c,param_3);
  (*(code *)param_2)("mMansionMissionLocked",param_1 + 0x844,0x844,0x3c,param_3);
  (*(code *)param_2)("mMansionMissionGrade",param_1 + 0x880,0x880,0x3c,param_3);
  (*(code *)param_2)("mMansionMissionPrevGrade",param_1 + 0x8bc,0x8bc,0x3c,param_3);
  (*(code *)param_2)("mMansionMissionBooCaptured",param_1 + 0x8f8,0x8f8,0x3c,param_3);
  (*(code *)param_2)("mMansionMissionBooNotifyState",param_1 + 0x934,0x934,0x3c,param_3);
  (*(code *)param_2)("mMansionMissionNotifyState",param_1 + 0x970,0x970,0x3c,param_3);
  (*(code *)param_2)("mMansionMissionClearTime",param_1 + 0x9ac,0x9ac,0xf0,param_3);
  (*(code *)param_2)("mMansionMissionGhostsCaptured",param_1 + 0xa9c,0xa9c,0x78,param_3);
  (*(code *)param_2)("mMansionMissionDamageTaken",param_1 + 0xb14,0xb14,0x78,param_3);
  (*(code *)param_2)("mMansionMissionTreasureCollected",param_1 + 0xb8c,0xb8c,0x78,param_3);
  (*(code *)param_2)("mNumBasicGhostCollected",param_1 + 0xc04,0xc04,0x1d,param_3);
  (*(code *)param_2)("mMaxBasicGhostWeight",param_1 + 0xc22,0xc21,0x3a,param_3);
  (*(code *)param_2)("mBasicGhostNotifyState",param_1 + 0xc5c,0xc5b,0x1d,param_3);
  (*(code *)param_2)("mBasicGhostNotifyBecauseHigherWeight",param_1 + 0xc79,0xc78,0x1d,param_3);
  (*(code *)param_2)("mAnyOptionalBooCaptured",param_1 + 0xc96,0xc95,1,param_3);
  (*(code *)param_2)("mJustCollectedChaser",param_1 + 0xc97,0xc96,1,param_3);
  (*(code *)param_2)("mGhostWeightRequirement",param_1 + 0xc98,0xc97,0x5a,param_3);
  (*(code *)param_2)("mGhostCollectableState",param_1 + 0xcf2,0xcf1,0x2d,param_3);
  (*(code *)param_2)("mNumGhostCollected",param_1 + 0xd1f,0xd1e,0x2d,param_3);
  (*(code *)param_2)("mMaxGhostWeight",param_1 + 0xd4c,0xd4b,0x5a,param_3);
  (*(code *)param_2)("mGhostNotifyState",param_1 + 0xda6,0xda5,0x2d,param_3);
  (*(code *)param_2)("mGhostNotifyBecauseHigherWeight",param_1 + 0xdd3,0xdd2,0x2d,param_3);
  (*(code *)param_2)("mGemCollected",param_1 + 0xe00,0xdff,0x4e,param_3);
  (*(code *)param_2)("mGemNotifyState",param_1 + 0xe4e,0xe4d,0x4e,param_3);
  (*(code *)param_2)("mHasPoltergust",param_1 + 0xe9c,0xe9b,1,param_3);
  (*(code *)param_2)("mSeenInitialDSHorrorAnim",param_1 + 0xe9d,0xe9c,1,param_3);
  (*(code *)param_2)("mHasMarioBeenRevealedInTheStory",param_1 + 0xe9e,0xe9d,1,param_3);
  (*(code *)param_2)("mLastMansionPlayed",param_1 + 0xe9f,0xe9e,1,param_3);
  (*(code *)param_2)("mTotalTreasureAcquired",param_1 + 0xea0,0xe9f,4,param_3);
  (*(code *)param_2)("mTreasureToNotifyDuringUnloading",param_1 + 0xea4,0xea3,4,param_3);
  (*(code *)param_2)("mTotalGhostWeightAcquired",param_1 + 0xea8,0xea7,4,param_3);
  (*(code *)param_2)("mDarklightUpgradeLevel",param_1 + 0xeac,0xeab,1,param_3);
  (*(code *)param_2)("mDarklightUpgradeNotifyState",param_1 + 0xead,0xeac,1,param_3);
  (*(code *)param_2)("mPoltergustUpgradeLevel",param_1 + 0xeae,0xead,1,param_3);
  (*(code *)param_2)("mPoltergustUpgradeNotifyState",param_1 + 0xeaf,0xeae,1,param_3);
  (*(code *)param_2)("mHasSuperPoltergust",param_1 + 0xeb0,0xeaf,1,param_3);
  (*(code *)param_2)("mSuperPoltergustNotifyState",param_1 + 0xeb1,0xeb0,1,param_3);
  (*(code *)param_2)("mHasSeenReviveBonePIP",param_1 + 0xeb2,0xeb1,1,param_3);
  (*(code *)param_2)("mBestTerrorTowerClearTime",param_1 + 0xeb4,0xeb2,0x60,param_3);
  (*(code *)param_2)("mEndlessModeHighestFloorReached",param_1 + 0xf14,0xf12,4,param_3);
  (*(code *)param_2)("mAnyModeHighestFloorReached",param_1 + 0xf18,0xf16,1,param_3);
  (*(code *)param_2)("mEndlessFloorsUnlocked",param_1 + 0xf19,0xf17,4,param_3);
  (*(code *)param_2)("mRandomTowerUnlocked",param_1 + 0xf1d,0xf1b,1,param_3);
  (*(code *)param_2)("mTerrorTowerNotifyState",param_1 + 0xf1e,0xf1c,1,param_3);
  bVar1 = param_4 < 0;
  bVar2 = param_4 == 0;
  if (0 < param_4) {
    bVar1 = 0xf1d - param_4 < 0;
    bVar2 = param_4 == 0xf1d;
  }
  if (!bVar2 && bVar1 == (0 < param_4 && SBORROW4(0xf1d,param_4))) {
    software_bkpt(0xa6);
    return;
  }
  return;
}

I'm not 100% sure on what these functions are actually for, though they appear to be a part of invoking many things related to save data, from clearing and copying to allocated memory, to calculating checksums. I'm also not sure why the names of the fields themselves were included, though I am glad they were as it saved a lot of work figuring out the boundaries of data in the save file.

The following is a list of every mission in the game along with it's associated index in the mission related save file arrays. Each of these arrays is 60 elements long (10 elements for each mansion, including King Boo's Illusion), despite there only being 34 missions in the game and each mansion having at most 7 missions. Modifying the values of unused missions in any of the fields doesn't do anything.

• A-1: 0
• A-2: 1
• A-3: 2
• A-4: 3
• A-5: 4
• A-Boss: 5
• A-Bonus: 7

• B-1: 10
• B-2: 11
• B-3: 12
• B-4: 13
• B-5: 14
• B-Boss: 15
• B-Bonus: 18

• C-1: 20
• C-2: 21
• C-3: 22
• C-4: 23
• C-5: 24
• C-Boss: 25
• C-Bonus: 27

• D-1: 30
• D-2: 31
• D-3: 32
• D-Boss: 35
• D-Bonus: 38

• E-1: 40
• E-2: 41
• E-3: 42
• E-4: 43
• E-5: 44
• E-Boss: 46
• E-Bonus: 49

• King Boo: 50

The following are lists of every ghost in the game along with their associated index in the ghost save file arrays. In the save file field names, "basic ghosts" refer to the Evershade Valley ghosts, and "ghosts" (with no adjective) refer to the tower ghosts. A few indices are left unused, however changing the values in these locations doesn't do anything. These values are still 0-indexed, the 0 index is just left unused.

• Greenie: 12
• Slammer: 1
• Hider: 9
• Sneaker: 24
• Creeper: 6

• Sister Melinda: 26
• Sister Belinda: 27
• Sister Herlinda: 28
• Gobber: 7
• Boffin: 15

• Strong Greenie: 13
• Strong Slammer: 2
• Strong Hider: 10
• Strong Sneaker: 25
• Strong Gobber: 8

• Grouchy Possessor: 19
• Harsh Possessor: 20
• Overset Possessor: 21
• Scornful Possessor: 22
• Tough Possessor: 23

• Boffin Elder: 16
• Strong Boffin: 17
• Gold Greenie: 14

• Polterpup (story): 3

The following ghosts only appear in the tower and are in the tower section of the vault's ghost container, however information pertaining to them is stored in the Evershade Valley ghost arrays

• Polterpups (tower): 4
• Big Polterpups: 5
• The Brain: 18

• Bomb Brothers: 40
• Scarab Nabber: 41
• Terrible Teleporter: 42
• Primordial Goo: 43
• Creeper Creator: 44

• Fright Knight: 0
• Snug Thug: 1
• Sleek Sneaker: 2
• Tether Jacket: 3
• Spectral Sloth: 4

• Blue Pimpernel: 5
• Sunflower: 6
• Pink Zinnia: 7
• Violet: 8
• Daisy: 9

• Melon-choly: 10
• Aweberry: 11
• Scorn: 12
• Fright Egg: 13
• Terrorange: 14

• Spooky Spook: 15
• Scars: 16
• Skoul: 17
• Jack-goo'-lantern: 18
• Blimp Reaper: 19

• Dreadonfly: 20
• Shadybird: 21
• Terrorfly: 22
• Blobberfly: 23
• Grumble Bee: 24

• Horrorca: 25
• Clown Fishy: 26
• Shriek Shark: 27
• Pondguin: 28
• Snapper: 29

• Bad-minton: 30
• American Footbrawl: 31
• Tennis Menace: 32
• Goolf: 33
• Ball Hog: 34

• Maligator: 35
• Banegal: 36
• Zebrawl: 37
• Leoprank: 38
• Full Moo: 39

The gem related save file arrays store every mansions' 13 gems in the same order that the mansions appear in-game. Within each mansion, however, the gems are stored in a different order to how they appear in the vault.

In the order that they appear in the vault, left-to-right, top-to-bottom, the indices of each gem is in the following, consistent order: 7, 11, 0, 3, 2, 6, 10, 8, 4, 1, 9, 12, 5.

Here is an image showing this order:

As each mansion's gems are stored one after the other with no space in-between, simply add 13 for each mansion you wish to go ahead in the array, for example +0 for Gloomy Manor, +13 for Haunted Towers, +26 for Old Clockworks, etc.

Note that King Boo's Illusion is also given 13 spaces (the same as the other mansions) in the arrays despite not having any gems. Modifying any of these values does nothing.

This is a list of each mansions gem indices with the relevant offset already added should you need it:

• Gloomy Manor: 7, 11, 0, 3, 2, 6, 10, 8, 4, 1, 9, 12, 5
• Haunted Towers: 20, 24, 13, 16, 15, 19, 23, 21, 17, 14, 22, 25, 18
• Old Clockworks: 33, 37, 26, 29, 28, 32, 36, 34, 30, 27, 35, 38, 31
• Secret Mine: 46, 50, 39, 42, 41, 45, 49, 47, 43, 40, 48, 51, 44
• Treacherous Mansion: 59, 63, 52, 55, 54, 58, 62, 60, 56, 53, 61, 64, 57
• King Boo's Illusion (Unused): 72, 76, 65, 68, 67, 71, 75, 73, 69, 66, 74, 77, 70

This is a list of all the possible tower configurations and their respective index in the best tower clear time array.

• Hunter/5/Normal: 0
• Hunter/5/Hard: 1
• Hunter/5/Expert: 2

• Hunter/10/Normal: 3
• Hunter/10/Hard: 4
• Hunter/10/Expert: 5

• Hunter/25/Normal: 6
• Hunter/25/Hard: 7
• Hunter/25/Expert: 8

• Hunter/Endless/Normal (Unused): 9
• Hunter/Endless/Hard (Unused): 10
• Hunter/Endless/Expert (Unused): 11

• Rush/5/Normal: 12
• Rush/5/Hard: 13
• Rush/5/Expert: 14

• Rush/10/Normal: 15
• Rush/10/Hard: 16
• Rush/10/Expert: 17

• Rush/25/Normal: 18
• Rush/25/Hard: 19
• Rush/25/Expert: 20

• Rush/Endless/Normal (Unused): 21
• Rush/Endless/Hard (Unused): 22
• Rush/Endless/Expert (Unused): 23

• Polterpup/5/Normal: 24
• Polterpup/5/Hard: 25
• Polterpup/5/Expert: 26

• Polterpup/10/Normal: 27
• Polterpup/10/Hard: 28
• Polterpup/10/Expert: 29

• Polterpup/25/Normal: 30
• Polterpup/25/Hard: 31
• Polterpup/25/Expert: 32

• Polterpup/Endless/Normal (Unused): 33
• Polterpup/Endless/Hard (Unused): 34
• Polterpup/Endless/Expert (Unused): 35

• Surprise/5/Normal: 36
• Surprise/5/Hard: 37
• Surprise/5/Expert: 38

• Surprise/10/Normal: 39
• Surprise/10/Hard: 40
• Surprise/10/Expert: 41

• Surprise/25/Normal: 42
• Surprise/25/Hard: 43
• Surprise/25/Expert: 44

• Surprise/Endless/Normal (Unused): 45
• Surprise/Endless/Hard (Unused): 46
• Surprise/Endless/Expert (Unused): 47

The save file contains four checksums, two for each section. Each checksum is 32-bits (4 bytes), and like every other numerical value, is stored in little endian order.

Each section has one "Data CRC" and one "Version CRC". The Version CRC is constant across all save files: 0x7B, 0x0C, 0x27, 0x49 for the title screen section and 0xAD, 0x03, 0x32, 0xD4 for the in-game section. The Data CRC is more interesting and is the part of the reverse engineering that by far took the longest to figure out. It is computed using all of the data stored within the relevant section of the save file (including the Version CRCs) and is used to detect corruption/modification.

If any of these four checksums fail to match the expected values, the game will refuse to load the save file. If it is the title screen section that is corrupt, then the profile will be labelled "Corrupted" on the title screen before even selecting it. If it is the in-game section that is corrupted, the message saying as such will not be displayed until you attempt to load the corrupted save file.

The game does not fully compute the Data CRC on-the-fly, instead it utilises a 1024-byte long lookup table stored within the game executable in order to calculate the checksum of the save file.

The game's CRC generation algorithm looks something like this (decompiled C code generated by Ghidra, generic names replaced with more descriptive ones by myself):

// .text:002b4b98h (file offset: 0x002c4b98)
void GenerateCRC(uint *destination, uint *source, uint byteCount)
{
  uint toProcess;
  uint crcPart;
  
  for (; ((uint)source & 3) != 0; source = (uint *)((int)source + 1)) {
    if (byteCount == 0) goto no_more_bytes;
    byteCount = byteCount - 1;
    *destination = *(uint *)(&CRCTable + ((uint)*(byte *)source ^ *destination & 0xff) * 4) ^
                   *destination >> 8;
  }
  for (; 3 < byteCount; byteCount = byteCount - 4) {
    toProcess = *source;
    crcPart = *(uint *)(&CRCTable + (toProcess & 0xff ^ *destination & 0xff) * 4) ^
              *destination >> 8;
    *destination = crcPart;
    crcPart = *(uint *)(&CRCTable + (toProcess >> 8 & 0xff ^ crcPart & 0xff) * 4) ^ crcPart >> 8;
    *destination = crcPart;
    crcPart = *(uint *)(&CRCTable + (toProcess >> 0x10 & 0xff ^ crcPart & 0xff) * 4) ^ crcPart >> 8;
    *destination = crcPart;
    *destination = *(uint *)(&CRCTable + (toProcess >> 0x18 ^ crcPart & 0xff) * 4) ^ crcPart >> 8;
    source = source + 1;
  }
no_more_bytes:
  for (; byteCount != 0; byteCount = byteCount - 1) {
    *destination = *(uint *)(&CRCTable + ((uint)*(byte *)source ^ *destination & 0xff) * 4) ^
                   *destination >> 8;
    source = (uint *)((int)source + 1);
  }
  return;
}

However this algorithm is longer than it needs to be, and the entire algorithm can be shortened whilst retaining identical behaviour. This is my re-implementation in C#:

public static uint CalculateChecksum(Span<byte> source, uint initial = 0)
{
    uint crc = initial;
    foreach (byte toProcess in source)
    {
        int lookupIndex = (int)((toProcess ^ (crc & 0xff)) * 4);
        crc = LookupCRCTable(lookupIndex) ^ (crc >> 8);
    }
    return crc;
}

private static uint LookupCRCTable(int lookupIndex)
{
    return BinaryPrimitives.ReadUInt32LittleEndian(crcTable.AsSpan()[lookupIndex..(lookupIndex + 4)]);
}

(The first two for loops have been completely omitted, as simply running the final one alone will produce the same result).

The full lookup table can be found in SaveTools/CRC.cs if you're curious, though it is just one long list of bytes. If you want to find it in an original dumped binary, it can be found at .data:00022904h (file offset 0x0082b904).