PS1 Save Checksum on PSP

[Gamesoul Master]

As many of you may know, a .vmp save on the PSP is a memory card file for a PS1 game. There are two created, one for each slot. The format is exactly the same as the standard memory card file format used in just about all current PS1 emulators on the computer (usually .mcr, .mcd, or .bin), except it contains a header file.

The header file contains a bunch of zeroes (constant), a 32-bit string (constant), and two 160-bit strings. Obviously the constants aren't relevant, as they never change and thus are reused for every memory card image. The 160-bit strings are what are of interest here.

One of those 160-bit strings contains a sequence of numbers. When the two memory card files are created, the first file's number sequence counts from 00-13, and the second file's number sequence counts from 14-27. I consider these sequences to be sets, because they always seem to be 00-13, 14-27, 28-3B, etc. Upon modification of the memory card file (saving to it), the sequence of numbers seems to be changed to the next sequential set not in use (in this case, 28-3B would be the next set used if either of the freshly made memory cards were saved to). The reason for this sequence to exist is unknown to me, but the setup seems logical enough that it could be recreated without any problems of the PSP not accepting it.

The other 160-bit string is the one where almost all the action is. I would have to say that this 160-bit is a checksum of some sort. The only problem is, there seems to be no information on what is used to calculate it, or what type of checksum it is. First thought would be SHA1 (or possibly RIPEMD160), since those are the main two checksum types that are 160-bit checksums.

An interesting note about the calculated value though. Given two memory card files for the same game (slot 1 and slot 2)... the only difference between the two files is the title and the number sequence in the first 160-bit string (as described earlier, since they are freshly initialized). The 160-bit string theorized as the checksum here is also completely different. That being said, wouldn't at least part of it have to be based on that first 160-bit string, which bears the only in-file difference between the two files?

I guess the main point of starting this thread is... Is there anybody here who has any information at all about how the checksum for the save file works?

The ultimate goal of figuring all this out is to create a utility that can convert a standard PS1 memory card file into a .vmp memory card file usable on the PSP. I do understand there is already a plugin which accomplishes the task by basically side-stepping any conversion whatsoever, but that is by no means a desirable solution. Without knowing how the checksum is calculated, there is no feasable way to do this... not even inserting updated memory card data into the file will work, it seems, so I'd imagine at least part of the data is used in the checksum, or possibly the modified date/time information. Does anybody know anything more about this? Or if nothing else, can anybody confirm or refute what I've presented thus far?

[Gamesoul Master]

Nobody has any information or leads on this? Any help at all would be greatly appreciated.

[Jim]

It's either a hash or a signed hash. We don't know the hashing algorithm, the key for the signature or the signature algorithm, though we can take a stab at the first and last of those.
I doubt they're as simple as the ones on the Datel .xpo .xps files.

Jim