Credit goes to dbzfanatic & whoever just send me a PM so I add you
PART 2
Actually I thought I mentioned the file compare method on here already :P. That's a method, also the most common, to find the values you need if the straight "search for them" method doesn't work. If you could read team names at all that means there's no encryption, I posted a bit more info about that in a previous post with an example of plain-text and basic encryption. I'm glad this is what you were looking for. Ok on to the next topic.
How to Hex
Most people think hexing is a really daunting task. It isn't. I actually already explained most of what you need to know in post #9 but I'll go over the basics again. Once you open a file in your hex editor you should see something like this on one side (the left usually)
0D 0A 3C 21 2D 2D 20 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 0D 0A 54 68 69 73 20 63 6F 64 65 20 73 68 6F 75 6C 64 20 62 65 20 70 6C 61 63 65 64 20 69 6E 20 74 68 65 20 68 65 61 64 65 72 20 6F 72 20 69 6E 20 61 20 43 53 53 20 66 69 6C 65 2E 0D 0A 49 74 20 63 61 6E 20 62 65 20 6D 6F 64 69 66 69 65 64 20 74 6F 20 6D 61 74 63 68 20 74 68 65 20 61 70 70 65 61 72 61 6E 63 65 20 6F 66 20 74 68 65 20 72 65 73 74 20 6F 66 20 74 68 65 20 73 69 74 65 2E 0D 0A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A 2A
and on the other you should see what that represents, in this case it's some html
..<!-- ************************************************** *************..This code should be placed in the header or in a CSS file...It can be modified to match the appearance of the rest of the site...******************************************* ************
If the right side is easily readable like it is here, there's no encryption. If it looks something like
A2e76f!_ #
[email protected] ......... emishUGLhvEEas~_
then it's probably encrypted. You need to look carefully though since some things may seem encrypted at first glance but really aren't like
sysSettings1sysSettings2sysSettings3.........weapo n_023464........63
In this example you can see that system settings 1, 2, and 3 are unlocked and the player has 99 (which is 63 in hex ;) ) of the item "weapon_023464". They won't always be this easy to read but this shows my point quite well. If we wanted to unlock system setting 4 in this example the first thing to try would be to change the right side (the "readable" side) to
sysSettings1sysSettings2sysSettings3sysSettings4.. .......weapon_023464........63
rehash/resign, load it back and see if it works. If it doesn't then the next method to try would be to find a savegame that already has it unlocked and compare the two. Let's say the save with it unlocked looks like this
sysSettings1sysSettings2sysSettings3sysSettings_04 .........weapon_023593........03
We can clearly see that they changed the naming on menu 4. So all we need to do is change our modified file to
sysSettings1sysSettings2sysSettings3sysSettings_04 .........weapon_023464........63
rehash/resign and load and all should be well.
"Oh but that's easy, what if the file is encrypted then what do I do?" I know some of you are thinking this. Well that's where the file-compare method comes into play again. Say we have 2 saves that look like this.
We can see some similarities and some differences. Notice they both have "01234567890123456789" in them in the same place and they both end with "!....". The first 8 letters are different though and some of the middle is different. A safe assumption is usually if something changes at the very beginning of the file or at the very end it's a potential checksum. I'll explain more about those later. Say we only changed our stat for gold in the game between the two saves we have. Since we think the first change is a checksum that means the second change must be our gold number. Now we have no idea what the encryption method is at the moment but we do know how much our gold was and is and where in the file it's saved now. So we keep that information handy and build up our gold to an ungodly amount through work or cheats, save, and open the file. It now looks like this.
We can clearly see that the same two places have changed. First thing to try (shot in the dark) is take the area we think is gold and put it in our first save. That would make it look like this
We ignore the possible checksum for now, rehash/resign and load it up to see if it works. To our shock it does! Our gold has jumped but everything else is exactly the same as the first save so we think to ourselves "what else could have changed between those two saves I had first?" The answer is simple. The time. The first few bytes of our file are our gameplay time. There are games that use checksums and if the edited save doesn't load up then that game probably does. This example was just to get you into basic hexing, not bypassing game security. If this made your head explode, please get a bucket and try again :P. It gets easier, I promise. Just re-read this a few times, eventually it will "click" and you'll understand.
Edit: Just in case my way was a bit difficult to understand I found another explanation posted by Emerald Lance, it's the same info just worded a bit differently. Maybe you can understand this one if you can't understand mine:
Emerald Lance, said:
Hex editing can indeed be a daunting task for beginners. When I first started, I remember that it just looked like a swirl of coded nonsense. But there are only two things you need to get started: a hex editor, and knowledge on how to count in hex.
If you're talking about modding 360 game saves, programs like Modio and Horizon have a hex editor built in, so we'll skip that part. Assuming you don't know how to count in hex, this is the general basic concept. When you normally count, you go 0-9, and then it starts again as the zero of the next series of numbers, in this case 10-19, then 20-29, and so on. In hex, you count from 0-F; instead of going on to 10 after 9, you go from 9 to A. In hex, A means 10, and F means 15, so in hex 10 means 16, and so on. A lot of people starting off have a bit of trouble understanding at first, but you'll get it sooner or later; I learned by trying to count in hex in my everyday life, and by studying how color sliders that went up to 255 were different than the ones that went to FF (there is no difference, just decimal vs hex). Of course, this is assuming you don't already know how to count in hex.
While much of the hexing process is just changing values, you gotta know where those values are in in order to change them. Every game is different, so this is important. There are two methods you should be familiar with: Ctrl+F, and comparison. Let's say you want to edit a character's HP stat. While playing the game, take note of what it is. Let's say it's 590. Right it down and use a hex calculator (Windows has one that comes with it) to find out what it is n hex; in this case, 590 = 024E. Remember to add a 0 at the beginning of values that have an odd number of digits, since hex is in bytes (two digit values) and it helps make sure you don't get a bunch of values you don't want. Now, in your hex editor, hold the Ctrl key and press F, then type in the hex value you want to search for.
It isn't uncommon for the search to turn up multiple hit, especially when searching for lower (and by proxy, more common) values. When this happens, you need a comparison. Play the game normally and do something to change the value you want to edit, in HP's case I guess level up once. Take note of the new HP value in hex, and repeat the Ctrl+F process with this new save. Let's assume you're new hex number is 02D6. Since the only instance of 024E that changed was HP, then that should be the only instance that is now 02D6. Look for 02D6 now, and find the place where it sits that 024E used to sit. It's easiest to do this when you have both old save and new save open at once; you can also write down each address if there aren't a lot of instances. Once you find the value (and know that it's HP) change it to whatever you like. It can be sometimes risky to edit games with a maximum value of 9999 (270F in hex) to higher than their maximum, but in most games it works fine. Now just remember to resign/rehash the save (again, programs like Modio and Horizon do this) and inject it into your drive.
There are a few things that can go wrong with just simple hexing. While most older games can just be edited easy, newer or more popular games often have some measures put in place by the developer just to make sure it isn't hacked. The game save could be compressed or encrypted (will essentially show gibberish until decompressed or decrypted) or could have a checksum (a little line of encrypted code that changes every time values change during gameplay; if the values don't match the checksum, you get a corrupt save). Just remember that not everything can be edited with just hex knowledge alone.
Believe it or not, this is all there is to know (that can be taught) about hexing. Everything else is just picked up as you go, including better understanding of hex as a language (as opposed to just a number system). I hope this helps, and I hope it gets you started on your hacking way.