Load a .sav file, edit puzzle completion, hint coins,
play time, and player info, then download it back. Everything runs
in the browser. Nothing is uploaded anywhere.
Reverse-engineered from the ARM9 binary. Covers the EEPROM layout, checksum algorithm, header and slot data structures, and puzzle flag encoding.
64 Kbit EEPROM, 8,192 bytes total. In DeSmuME set save type to “EEPROM 64 Kbit”.
| Offset | Size | Contents |
|---|---|---|
0x0000 |
336 B | Save header |
0x0150 |
664 B | Unused (0xFF) |
0x03E8 |
2,000 B | Slot 0 data |
0x0BB8 |
2,000 B | Slot 1 data |
0x1380 |
2,000 B | Slot 2 data |
0x1B58 |
116 B | Wi-Fi / secret data |
0x1BCC |
1,076 B | Unused (0xFF) |
Slot n offset = 0x03E8 + n * 0x7D0 (decimal: 1000 + n * 2000).
Fletcher-32 variant seeded at 0xFFFF. Used for the header block and the Wi-Fi block.
function checksum(bytes, length):
s1 = 0xFFFF
s2 = 0xFFFF
n = length >> 1 // process 16-bit halfwords LE
while n > 0:
chunk = min(n, 360)
n -= chunk
for each halfword hw in next chunk:
s1 += hw
s2 += s1
s1 = (s1 >> 16) + (s1 & 0xFFFF) // fold carry
s2 = (s2 >> 16) + (s2 & 0xFFFF)
s1 = (s1 >> 16) + (s1 & 0xFFFF) // final fold
s2 = (s2 >> 16) + (s2 & 0xFFFF)
return s1 | (s2 << 16)
0xFFFFFFFF means the block was never written (blank EEPROM).
A mismatch between stored and computed value means corruption; the game reinitialises the block.
Header checksum covers bytes 4-335 and is stored at bytes 0-3.
Written atomically to EEPROM whenever any slot is saved.
| Bytes | Size | Field | Notes |
|---|---|---|---|
| 0-3 | 4 | Checksum | Fletcher-32 of bytes 4-335 |
| 4-19 | 16 | Magic string | ATAMFIREBELLNY\x00\x00 |
| 20 | 1 | Validity flag | 0xFF = valid, 0x00 = blank |
| 21 | 1 | Slot 0 active | 0 = empty, non-zero = has save |
| 22 | 1 | Slot 1 active | |
| 23 | 1 | Slot 2 active | |
| 24-87 | 64 | Slot 0 display name | Null-terminated Shift-JIS |
| 88-151 | 64 | Slot 1 display name | |
| 152-215 | 64 | Slot 2 display name | |
| 216-219 | 4 | Slot 0 play-time seconds | u32 LE |
| 220-223 | 4 | Slot 1 play-time seconds | |
| 224-227 | 4 | Slot 2 play-time seconds | |
| 228-231 | 4 | Slot 0 play-time hours | u32 LE |
| 232-235 | 4 | Slot 1 play-time hours | |
| 236-239 | 4 | Slot 2 play-time hours | |
| 240-243 | 4 | Slot 0 puzzles encountered | u32 LE, computed on save |
| 244-247 | 4 | Slot 1 puzzles encountered | |
| 248-251 | 4 | Slot 2 puzzles encountered | |
| 252-255 | 4 | Slot 0 puzzles solved | u32 LE, computed on save |
| 256-259 | 4 | Slot 1 puzzles solved | |
| 260-263 | 4 | Slot 2 puzzles solved | |
| 264-283 | 20 | Slot 0 scene name | Null-terminated Shift-JIS, max 10 double-byte chars |
| 284-303 | 20 | Slot 1 scene name | |
| 304-323 | 20 | Slot 2 scene name | |
| 324 | 1 | Slot 0 Wi-Fi flag | 1 = Wi-Fi puzzle data present |
| 325 | 1 | Slot 1 Wi-Fi flag | |
| 326 | 1 | Slot 2 Wi-Fi flag | |
| 327-335 | 9 | Padding |
The scene name is the short text shown under the slot name on the save selection screen. Header bytes 216-263 overlay gameState[1000..1047] in RAM directly.
The slot is a packed snapshot of the relevant in-RAM game state, compressed from the 327,680-byte in-RAM structure on save and expanded back on load.
| Bytes | Size | Field | Notes |
|---|---|---|---|
| 0-11 | 12 | Misc single-byte game state fields | |
| 12-267 | 256 | Puzzle flag table | 1 byte per puzzle ID 0-255 |
| 268-299 | 32 | Special puzzle / item flags | |
| 300-779 | 480 | Event and story progress flags | |
| 780-1339 | 560 | Further game data (minigames, rooms, inventory) | Partially mapped |
| 1340-1347 | 8 | RTC timestamp at last checkpoint | 64-bit LE |
| 1348-1843 | 496 | Remaining game fields | |
| 1844-1847 | 4 | Slot checksum | Fletcher-32 over a subsection of slot data |
| 1848-1999 | 152 | Padding / unused |
Main story puzzles are IDs 1-135. IDs 136-199 are Wi-Fi / weekly download slots. ID 0 and 200-255 are unused.
| Bit | Meaning |
|---|---|
| 0 | Encountered |
| 1 | Solved |
| 2-3 | Picarat decay stage (0 = no decay, 3 = max) |
| 4-5 | Hint level purchased (0 = none, 1-3 = hints used) |
| 6 | Nazoba extra hint unlocked |
| 7 | Attempted |
Total picarats are not stored in the save file. They are computed at save time from the puzzle table using base values stored in ROM.
| Bytes | Size | Field |
|---|---|---|
| 0-3 | 4 | Checksum (covers bytes 4-115) |
| 4-115 | 112 | Wi-Fi puzzle state data |
A checksum of 0xFFFFFFFF means this block has never been written. The Wi-Fi state is shared across all three save slots.
ATAMFIREBELLNY is ASCII (14 bytes + 2 null bytes = 16 bytes total).