RE4SaveIdFinder

Moves a Resident Evil 4 Remake save to another Steam account — even when you have no idea which account it came from.

One file. No installer, no .NET runtime, no setup. Double-click it and you get a window; run it from a terminal and you get the command-line scanner.

---

What problem does this solve?

RE4R saves are locked to the Steam account that created them. To play a save on a different account it has to be re-signed, and re-signing needs the original account's ID as input.

Normally you just read that ID off the folder name:

Steam\userdata\<this number is the ID>\2050650\remote\win64_save\data001Slot.bin

But if all you have is a loose .bin — a backup off a dead hard drive, a save a friend sent you, a cracked install whose folders are long gone — that number is gone for good. It is not written anywhere inside the file.

So this tool simply tries every account number there is. All 4,294,967,295 of them, in about 7 minutes.

Get it

1. Download the latest release (RE4SaveIdFinder-win-x64.zip) and unzip it anywhere.
2. Double-click RE4SaveIdFinder.exe.

Windows may warn about an unrecognised app the first time — that is SmartScreen reacting to a new, unsigned executable, not a virus report. Choose More info → Run anyway if you trust the download.

---

Quick start

Goal: take a save that belongs to some unknown account and make it yours.

1. Find out who owns the save. On the Find the Steam ID screen, choose your .bin file (or drag it onto the window) and press Start. Go make coffee — it takes a few minutes and tells you when it is done.
2. Re-sign it. Press the button that jumps you to the Re-sign saves screen with the found ID already filled in. Pick the folder your saves are in, put your own Steam ID in the second box, tick the files you want, press Re-sign the ticked files.
3. Put them back. Copy the re-signed files into your own save folder: Steam\userdata\<your number>\2050650\remote\win64_save
4. Play.

Your originals are always backed up first, so step 2 cannot lose anything.

Don't know your own Steam ID? It is the folder name under Steam\userdata\. If there is more than one folder there, the one containing a 2050650 subfolder is your RE4R account. The app also accepts the long 17-digit SteamID64 form and converts it for you.

You only need to search once. Every save written by the same account shares the same ID — find it on one file, then re-sign the whole folder in one go.

---

The app, screen by screen

1. Find the Steam ID

Point it at one save file. It shows the file name, size, and confirms the file really is a Resident Evil save before it starts. While it runs you get a progress bar, percentage, speed in IDs per second, elapsed time, an estimate of the time remaining, and a running log.

• Pause, Resume and Stop any time. They take effect at the end of the piece of work already under way — a few seconds.
• Nothing is lost if you close it. Progress is saved every few seconds. Reopen the same save later — even renamed, even moved to a different folder — and the app offers to pick up where it left off. That includes after a crash or a force-kill, which is exactly when you want it most.
• When it finds the answer it shows both forms of the ID (Steam32 and SteamID64), each with a Copy button, plus a one-click jump to the re-sign screen.
• An advanced option can search only part of the range if you already know roughly where to look. Most people should leave it alone.

2. Re-sign saves

Pick the folder holding your saves. Every *.bin in it is listed with a tick box. Then give it two IDs:

• Saves belong to — the ID they are signed with now. Press Work it out for me to run the search from screen 1 on the first ticked file.
• Move them to — the account that will play them.

Either box takes the short (Steam32) or long (SteamID64) form. Each file is re-signed and its result appears next to it in the list.

Three guarantees:

• Every original is backed up first, into a backup_<timestamp> subfolder or as a .bak beside the file (your choice in Settings). Backups are never overwritten.
• A file is only replaced after the new bytes are proven to decrypt with the new ID. The new version is written to a temporary file and moved into place only once that check passes.
• One bad file never stops the batch. A save that is not signed with the ID you gave is reported as failed, left exactly as it was, and the rest carry on.

3. Check a single ID

You already have an ID in mind and want to know whether a save belongs to it. Choose the file, type the ID, press Check. Instant, and it uses the full-decryption proof rather than the quick 4-byte test — so a "MATCH" is a real match.

---

Troubleshooting

What you see	What it means
"Not a valid encrypted save"	The file is not an encrypted DSSS/Lime save. Wrong file, or already decrypted. The tool refuses rather than search meaningless data.
The search finishes with no result	The save was not written by any Steam account ID — most likely it is not an RE4R save, or it has been modified by another tool.
Re-signing reports a file as failed	That file is not signed with the ID in the Saves belong to box. It was left untouched; run a search on that specific file.
The game does not see the re-signed save	Check the destination path is ...\userdata\<your id>\2050650\remote\win64_save, and that Steam Cloud has not overwritten it — start the game offline once, or disable cloud sync for RE4R while you swap saves.
The app will not open a second window	By design: one copy per machine. Starting a second brings the existing window to the front.
Something crashed	Full details are appended to %APPDATA%\RE4SaveIdFinder\last-error.log. Quote it in a bug report.

---

Command line

The same .exe, run with arguments, is the original scanner:

RE4SaveIdFinder <input.bin>                  # scan all 4.29 billion IDs (~7 min)
RE4SaveIdFinder <input.bin> <start> <end>    # scan a range
RE4SaveIdFinder --help                       # usage

> RE4SaveIdFinder.exe data001Slot.bin
Scanning 4,294,967,295 IDs in 2,148 chunks on 31 threads.
4.25B/4.29B  10.9M IDs/s  elapsed 06:31  ETA 00:04
Scanned in 00:06:53 (10.4M IDs/s). Raw candidates: 4
  486045545    false positive
  1546153230   false positive
  1672240761   false positive
  1958520491   VALID

Steam32 ID : 1958520491
SteamID64  : 76561199918786219

Exit codes: 0 found · 1 not found · 2 bad input (including --help) · 3 self-test failed.

The app is a Windows GUI executable, so it has no console of its own. On the command-line path it attaches to the console that started it; redirecting output to a file or pipe is left untouched. Running it with no arguments opens the desktop app.

The command-line path never reads or writes the settings file and never takes the single-instance lock, so scripts and CI keep working while the window is open.

---

Where it keeps things

Everything the app remembers lives under %APPDATA%\RE4SaveIdFinder — never next to the .exe, so the executable stays portable. Delete that folder and you are back to defaults.

config.ini

Plain INI text with a comment header; safe to edit in Notepad, safe to delete. Any value that is missing, unreadable or out of range falls back to its default rather than upsetting the app. Settings are written as they change, not only on a tidy exit, so a crash does not lose them.

Key	Meaning
ConfigVersion	Format version of this file
Threads	Worker threads a search may use
ChunkSize	IDs per work unit; smaller reacts to Pause/Stop sooner
AutoBackup	1 = backups into a dated subfolder, 0 = .bak beside each save
ShowHints	1 = show the welcome tip on start-up
LastMode	Screen to open on (Find, Resign, Check, Settings)
LastSaveFile	Save file used last, reopened next time
LastFolder	Save folder used last
LastSourceId / LastTargetId	IDs last typed on the re-sign screen
WindowX / WindowY / WindowWidth / WindowHeight / WindowMaximized	Window position and size

Threads. The default is ProcessorCount - 1, and that is also the maximum the slider allows: one logical processor is always reserved so the machine stays responsive during a search. A larger number in the ini is ignored in favour of the default.

jobs\<sha256>.json

An unfinished search is remembered under the SHA-256 of the save file's contents, so picking the same save from a different folder — or after renaming it — finds the same progress. Each file records the hash, original path, file size, the range, the chunk size, the completed chunks (and the contiguous high-water mark), the raw candidates found so far, the thread count, UTC ISO-8601 start and last-updated timestamps, and the status (running / paused / completed).

A chunk is recorded only after its scan has returned, so resuming can never skip a range that was not actually searched. A finished search is marked completed and never prompts again — it just shows the answer it found. Clear saved progress on the search screen forgets one save; Forget all saved progress in Settings clears the lot.

One window at a time

The desktop app takes a named Global\ mutex, so only one copy runs per machine. Start a second and the existing window is brought to the front; if Windows refuses that, the second copy says so briefly and exits. An abandoned mutex from a previous crash is taken over cleanly, and if the global name cannot be created at all the app falls back to a per-session lock rather than refusing to start.

---

How it works

Why it is fast

LimebrellaSharpCore's own LimepickSegmentBatch computes Header^(~id) mod privateKey1 for each candidate — a full modular exponentiation, about 512 IDs/s. At that rate the full space takes roughly 74 hours.

The exponent is ~id, which for a 32-bit id is exactly 2^64 - 1 - id. So as the candidate rises by one, the exponent falls by one:

result(id+1) = result(id) · Header⁻¹   (mod n)

Scanning a contiguous range therefore needs one modular exponentiation up front and a single modular multiply per candidate after that. Measured ~620× faster: 10.4M IDs/s across 31 threads.

Why the answer is trustworthy

The inner test compares only 4 bytes of decrypted output, so it collides by chance roughly once per 2^32 candidates — a full scan typically yields several hits, most of them wrong. A real scan of one save produced 4 candidates and only 1 was genuine.

Every candidate is therefore confirmed by decrypting the whole file and validating its checksum. Only a candidate that passes is reported, in the app exactly as on the command line. A tool that stops at the first 4-byte match will hand you a wrong ID with no indication anything went wrong.

On startup the fast path is cross-checked against the library on known IDs; on any disagreement the tool refuses to scan (exit code 3, or a plain-language dialog in the app) rather than produce a wrong answer.

A file is only accepted if it really parses as an encrypted DSSS save. The library would otherwise happily treat any file as raw plaintext and send the search off across meaningless data.

---

Requirements

• Windows x64 with AES-NI (any CPU since ~2010)
• Nothing else — the published .exe is self-contained and needs no .NET runtime

Building

dotnet build -c Release
dotnet publish -c Release -o publish     # single self-contained .exe

EnableWindowsTargeting is set, so the project also restores and compiles on Linux or in a Linux container; the resulting .exe still only runs on Windows.

Two self-checks live under tests/. Neither is ever compiled into the published executable.

dotnet run --project tests/CoreSelfCheck -c Release    # runs anywhere, including Linux
dotnet run --project tests/UiStartupCheck -c Release   # Windows only

CoreSelfCheck covers the parts that do not need a window — searching, resuming, re-signing, the settings file — against a real DSSS save built with the library's own writer. It also lints src/ for the two initialisation-order traps that have each stopped this app from opening its window despite a clean build:

• a static initialiser that reads a static declared later in the same file (following method calls, because the reference is usually indirect);
• a control constructor that sets a property which raises layout or paint — Padding, Size, Dock, Font and friends — before assigning a field one of its own overrides reads.

--lint <folder> runs just those two passes over any folder of C#.

UiStartupCheck needs the Windows Desktop runtime, so it only runs on Windows. It force-runs every UI type's static initialiser, checks every colour and font, then creates each custom control, gives it a window handle, lays it out and paints it into a bitmap, and builds all four screens, the main window and the message dialog the same way launching does — without showing anything. Any exception fails the run and prints the type, message and stack.

Credits

Save format handling and all cryptography by LimebrellaSharp by Michał Gębicki (MIT) — see THIRD-PARTY-NOTICES.txt. This tool only makes searching for an unknown ID practical, and wraps the whole job in a desktop app.

License

MIT — see LICENSE.

Bundles LimebrellaSharp (MIT), whose notice is reproduced in THIRD-PARTY-NOTICES.txt.