Before You Start​

Please make sure you have some hands-on abilities. Based on the assumption that you can open a server, the following text will assume that readers will use Python3 and be familiar with using the terminal.

Prerequisites​

• Python3
• MuelNova/Palworld-Save-Patcher
• Prepare the save to be converted, referred to as %SAVE% in this guide, it should be similar to the structure below

%SAVE%
├── LevelMeta.sav
├── Level.sav
├── LocalData.sav
├── Players
│   ├── 00000000000000000000000000000001.sav
│   ├── PLAYER_B_GUID.sav
│   └── PLAYER_C_GUID.sav
└── WorldOption.sav

Version Information (Current as of)​

• Palworld v0.1.2.0
• Server deployment using https://github.com/thijsvanloef/palworld-server-docker

Modification Process​

Extracting Server Saves​

Ensure that your server is up and running and copy the entire %SAVE% to the server saves location.

The original homeowner logs into the game, which should prompt the creation of a new user. Proceed to create a new user and perform some actions before exiting the game.

At this point, a new file should appear in the %SAVE%/Players folder, representing the GUID of each STEAM user, identified as 0D000721000000000000000000000001.sav.

%SAVE%
├── LevelMeta.sav
├── Level.sav
├── LocalData.sav
├── Players
│   ├── 00000000000000000000000000000001.sav
│   ├── PLAYER_B_GUID.sav
│   ├── 0D000721000000000000000000000001.sav
│   └── PLAYER_C_GUID.sav
└── WorldOption.sav

In this case, 0D000721000000000000000000000001 is the GUID of the original homeowner.

Shutdown the server, and make sure you have backed up the %SAVE% folder.

Running the Script​

git clone https://github.com/MuelNova/Palworld-Save-Patcher.git
cd Palworld-Save-Patcher
python script.py fix-host %SAVE% %GUID%
# Replace with your own values
# python script.py fix-host /home/nova/test_pal 0D000721000000000000000000000001

Restart the Server​

The original homeowner should now have progress in the game; however, the name and guild no longer exist. You need to join a friend's server to see them. This is a small flaw (due to these details being stored in BYTE, making it inconvenient to modify).

Principles​

This part can be skipped if not interested.

Analysis of Save Files​

Located in %applocaldadta%\Pal\Saved\SavedGame\<STEAM_ID>\<WORLD_ID>

LocalData.sav​

Contains map data, unrelated to users. Can be directly copied to other saves to skip the map opening process.

Level.sav​

Critical file that stores all resources, their owners, and map events.

Player/xxxxxx.sav​

Player files

.sav Files​

Currently, only the modification method is known, without the actual principle. Refer to Converting Palworld saves to JSON and back (github.com) for more information.

For a .sav file, it is not a standard UE .sav file header but a file compressed using zlib (or double compressed).

• [0:4] is the uncompressed size
• [4:8] is the compressed size
• [8:11] is a fixed magic number "PlZ"
• [11] represents a type, with possible values: 0x30, 0x31, 0x32. 0x30 is unused, 0x31 is for single zlib compression, and 0x32 for double zlib compression
• [12:] is the compressed data

After decompression, a GVAS file is obtained, which can be converted to a JSON file using tools like trumank/uesave-rs: Rust library to read and write Unreal Engine save files (github.com).

uesave to-json --input <GUID>.sav.gvas --output <GUID>.sav.json

After much thought, I decided to share some small and not-so-interesting things from my life here rather than in the clown section or the blog section.

Buying a cost-effective non-mainstream laptop comes with consequences, as there is no hardware adaptation for Linux, and no plans to support it. After using it for a week, I managed to solve about three issues: keyboard malfunction, inactive Bluetooth module, inability to install graphics card drivers, and immediate wake-up from sleep. Here is a brief overview of how I tackled them.

不知不觉，2024 年又过去一半。今年半年有很多值得记录的事情。

流量预警。

出于各种因素的考虑，我将 《2023 中期总结》、《2023 中期总结——续》两篇文章进行了隐藏。

尽管现在只是 2023 年 12 月中旬，但是由于接下来的时间要着手于进行期末的预习，因此不太可能腾出空来，提前半个月这种事情就原谅我吧 haha

我原本的计划是写一个 fancy sharing 插件，让我能很优雅地进行长截图分享，但是显然它被搁置了。

I've been using a computer for so many years, I have also collected a number of software applications that enhance usability and improve efficiency (and got a cluttered taskbar). Seizing this opportunity to share, with periodic updates.

我应该像旁边坐的女生一样，在观影过程中拍摄不少照片作为留念，以及作为分析的依据，这些图片也会为文章增色不少。

然而，为了首次观影的沉浸感和代入感（真的有用吗？），这或许可以留到下次。

如你所见，我的昵称叫做 Nova Noir(或者 Nova No1R、Nova No1r 等各种变体)，但是这个昵称后面有些什么故事呢？我的网名的前世今生以及未来又会是什么样子的呢

文章缘起于洗澡时想到的 Lantern 的网名以及他的真实姓名，并从中联想发散（尽管我并没有见过 Lantern 爷，不过机缘巧合下听到了他给我舍友讲的逆向基础课（，然后就去观摩学习了一哈注意到了）。

Attachment to the topic: http://121.40.89.206/20230311/kheap_9010ffcba2dfbfd58c7ab541015b24ec.zip

Although I've studied the kernel a bit, this is the first attempt at a kernel PWN challenge.

This is actually the very first time I dig into Kernel PWN LOL

Since Kernel Version 6.1, Rust support has been merged into Linux.