Hex editing & Mini Tweaker tutorials

[swdw]

Will Break these up because of the character per post limit:

Note: When Silent 3ditor is farther along, hopefully hex editing will be a thing of the past.

Below is a collection of mini tweaker and hex editing tutorials.

You can also download a copy of this file for offline reference from
Hex_editing_Mini_Tweaker_s.pdf

Lets start with hex editing first. It will make the Mini Tweaker tutorials make more sense.

----------------------------------Hex Editing---------------------------------------

HEX EDITING TUTORIAL - By DI at http://www.campaigncreations.org/development/hex.shtml

Before I begin, I'm going to have to ask you to bare with me, because not only is this subject somewhat complicated if you've never done anything like it before, but I am not extremely experienced in it myself. I am also going to skip over some of the subjects which are important to know about if you are planning to do new "research" into files, but will probably not need to know if you are just using other peoples' research to implement changes. In short, this tutorial will just teach you how to read and edit a file that someone else has already dechipered. It will not really help you decipher new files yourself. With that said, let's begin to hex edit. =)

Introduction to Hexadecimal

Hex is short for hexadecimal, which just means a number system which uses base-16 digits. The number system we normally use is called the decimal system, which uses base-10 digits. In other words, in the "normal" decimal system, there are ten different "symbols" that each digit can have: 0, 1, 2, 3, 4, 5, 6, 7, 8, and 9. Since the hexadecimal system is base-16, it has 6 more symbols for digits than the decimal system. In particular, it uses the decimal 0-9 and also A, B, C, D, E, and F to represent decimal equivalents of 10, 11, 12, 13, 14, and 15.

In the decimal system, each digit "place-holder" can only go from 0 to 9. So, the decimal number "ten" must have two place holders: a 1 in the tens-place and a 0 in the ones-place (10). The tens-place is followed by the hundreds-place, then the thouands-place, then the ten thousands-place, etc. And because it is a base-10 number system, each place can be represented by a power of 10. For example: (the carrot ^ symbol means "to the power of" -- in other words, it denotes an exponent)

1 = 10^0 or 1
10 = 10^1 or 10
100 = 10^2 or 10*10
1000 = 10^3 or 10*10*10
10000 = 10^4 or 10*10*10*10

In the hexadecimal system, each digit place-holder can go from 0-F. Unlike the decimal number "ten," the hexidecimal number ten only needs one place-holder because it is already represented just by the symbol "A." Because there are sixteen different symbols each digit can take, the hexidecimal ones-place can actually hold all the numbers from zero to fifteen:

0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F

That means that the next place-holder is not the "tens-place" as it is in the decimal system, but the "sixteens-place." However, it looks exactly the same as the ten in the decimal system. "10" in hexadecimal translates to 16 in decimal. Get it? Since the ones-place goes from zero to fifteen, we don't move a place over until the number sixteen. Really, 10 in hex means one "sixteen" and zero "ones" since there is a one in the "sixteens"-place and a zero in the ones place. Correspondingly, there is no "hundreds"-place or "thousands"-place in hexadecimal because those places only exist in the decimal system because they are powers of the number ten. In hexadecimal each place-holder is a power of sixteen, and thus the sixteens-place is followed by the "two hundred-fifty sixes"-place and then the "four thousand-ninety sixes"-place and then the "sixty five thousand-five hundred-thirty sixes"-place, etc. Like how the places in the decimal system are represented by powers of ten, each place in the hexadecimal system is a power of sixteen. For example:

1 = 16^0 or 1 in decimal
10 = 16^1 or 16 in decimal
100 = 16^2 or 16*16 = 256 in decimal
1000 = 16^3 or 16*16*16 = 4096 in decimal
10000 = 16^4 or 16*16*16*16 = 65536 in decimal

Still a little confused? Well, read it over again and see if these examples help: (hex is used to abbreviate hexadecimal and dec is used to abbreviate decimal)

1 in dec = 1 in hex
10 in dec = A in hex
100 in dec = 64 in hex
1000 in dec = 3E8 in hex

Now, take that last example and see if you can figure out why 3E8 in hex is equal to 1000 in decimal. Figure it out? O.K., let's compute this. First, there is a 3 in the "two hundred-fifty sixes"-place, right? In decimal, if you have 3 in the hundreds place, that means you have 3 hundreds, right? So, in hexadecimal, a 3 in the two hundred-fifty sixes"-place means there are 3 two hundred-fifty sixes -- in other words:

3*256 or 768 (for the decimal equivalent)

Now that takes care of the "two hundred-fifty sixs"-place. Now, the next place-holder, the "sixteens"-place has a E in it. Now what is E?... Well, if you forgot already, E in hexadecimal means fourteen. So, that means there are fourteen sixteens or:

14*16 or 224 (for the decimal equivalent)

Now, finally for the ones-place. In the ones place there is a 8, which means...? Don't think too hard. 8 just means eight. =)

8*1 or 8 (for the decimal equivalent)

Finally, we add all those decimal equivalents up and we get... 768+224+8 = 1000, which is what we expected in the beginning.

Now, what about converting a decimal number into hex? Well, the process is the same, just in reverse. For example, 289 in decimal is equal to 121 in hexadecimal. Let's test it.

We start by finding the largest power of sixteen that will go into our decimal number, 289. Well, 289 is between 16^2 or 256 and 16^3 or 4096, so 256 is the largest power of 16 that will go into 289. Then, we find how many 256's go into 289. In this case there is only one. So, what do we know now? Well, in the hexadecimal number we are looking for, there is a 1 in the "two hundred-fifty sixes place" because there is only one "two hundred-fifty six" in that number (just as in the decimal 100, there is only one hundred; decimal 200, two hundreds; decimal 756, seven hundreds; etc.).

Now that we have taken care of the "two hundred-fifty sixes"-place we can go ahead and subtract that one 256 from our original number.

289 - 256 = 33

The next hex place we have to fill in is the sixteens-place. How many sixteens are in 33? Take a wild guess: two. =) So, we put a 2 in the sixteens-place and subtract those two sixteens.

33 - 16*2 = 1

Finally, we have to fill in the ones place. So, how many ones go into 1? =) ... Now we subtract that 1:

1 - 1 = 0

And we know we're done because we have zero left. Now, its just a matter of putting that hex number together. Let's see, we have:

1 two hundred-fifty six or 100 in hex
2 sixteens or 20 in hex
1 one or 1 in hex

Adding those together, we get 121. A 1 in the "two hundred-fifty sixes"-place, a 2 in the sixteens-place, and a 1 in the ones-place, as we expected. Note that adding those numbers in hex works just the same way as it does in decimal. In fact, all hex adding works like that. But remember, if you have 9+1 in hex, you get the single digit A and thus you do not carry over a place (because you don't have a second digit to carry over). You only carry over a place when you have something like F+1 because that cannot be expressed by a single hex digit (sixteen in hex is 10). In decimal you carry over every ten because the system is base-ten. In hexidecimal you carry over every sixteen because the system is base-sixteen.

So now, hopefully you understand the basics of the hexadecimal system. Now, the trouble is, you also have to think like the hexadecimal system. In other words 5+5 doesn't equal 10, it equals A, and 4*4 doesn't equal 16, it equals 10. B+A+D doesn't mean BAD, it equals 22. =) While you probably will use a "hexadecimal calculator" most of the time to compute values and switch them between decimal and hexadecimal, it is still important to be able to do these basic calculations either in your head or at least on a sheet of paper so that you don't forget what it all means (and so you understand it when people talk like that =).

Here are some practice excercises. Do them without the aid of a hex calculator, otherwise you're wasting your time. You may use a regular decimal calculator, but try to compute as much as you can in your head, and for the third section, see if you can do the computation "in hex"; in other words, don't convert the numbers to decimal, then compute, then convert back -- see if you can do it all in one step:

Convert the following hex values into dec:

1) 64
2) 16D
3) 7CF
4) F4240
5) 75BCD15

Convert the following dec values into hex:

6) 22
7) 209
8) 2748
9) 52685

Compute the following hex values: (all numbers in hex)

10) 6 + A =
11) 78 + AB =
12) 10 * 10 =
13) 10 * F =
14) 100 / 10 =
15) F5000 / F5 =
16) (6 + A) * (1000 / 10) * (115 - 20) =

Yes, its all very tedious business, but that's what hex editing is all about. =)

Answers: 1) 100; 2) 365; 3) 1999; 4) 1000000; 5) 123456789; 6) 16; 7) D1; 8) ABC; 9) CDCD; 10) 10; 11) 123; 12) 100; 13) F0; 14) 10; 15) 1000; 16) F5000.