Post: Explaing gamesave modding for the masses [Intermediate]
12-07-2009, 11:52 PM #1
bmxdude9
Million Miles Of Fun!
(adsbygoogle = window.adsbygoogle || []).push({});
Explaing gamesave modding for the masses [Intermediate]
By: Bmxdude9


Okay so I am sure with Chris modding his gamesave to get three primary guns, playing in matches after the leaderboard hack etc I think it is time for me to give a little explanation as of what I know that could drastically help gamesave modders in their workings. Let me first note that is much easier than what Ive said in the past but some aspects might take awhile to grip so bare with me. Now enough of that lolly gagging time to explain what gamesave modding is actually doing and how to find what were looking for.

Lets make this clear everything you modify hex you ARE modifying a command you cant exactly see such as

lui t2, $08ff(loads the data 08ff into a register, its truly 000008ff) Well this is what YOU see it as in your hex editor.

3c0a08ff*see our data 08ff* Winky Winky and this is what you normally see.

3c 0a 08 ff

Well when you mod the 08 and ff you are changing what the gamesave loads, get it now? Happy


Okay I am pretty sure how this works, I wont put it in assembly even though thats its true binary I will explain in words what is going on. First off like you said the address gets modded for people who "hacked" their gamesave because of the data amount so say the normal data is 00 then well here is what it normally does(in English words for you guys)

This is what is going on with the file(stuff you dont see - this example is if its not modded)

    
Loads the first half of the address location
Loads the first half of the string(0001) that being 00
Loads the second half of the hex string(value) 01
Loads the second half of the address location
loads up a valid pointer and 'if statement like value' then...
Branch the data 0001 to the correct location on server
Load pointer part 1
Load pointer part 2
Check the sum of values and branch back
Use a pointer to return to data if data is legit
Store First half of the Address location
Store second half of the Address location
store the value of 0001 if legit into a saved register
return data back to svg and save.


That all happens in a split second or two but thats why, we have to fool the data where it checks out the values of your rank etc and find a glitch so it thinks its legit, or modify it to make it NOT branch to a new location(keeping it the value we modded without changing the address location)

Thats only after a few minutes of playing around, but really if we want to get pro @ this then we will need to understand what all the hex means instead of playing around. For example anything like...

    
00 00 00 00 00 00

Is not used and reserved for later use while some data such as

    
3e 00 00 ff c4

Might actually be loading the data value 'c4' into a register such as.

    
[COLOR="Magenta"]3e[/COLOR] [COLOR="DarkOrange"]00 00[/COLOR] [COLOR="Olive"]ff[/COLOR] [COLOR="Red"]c4[/COLOR]


Color key(also note the above data is an example)
----------------------------------------------------
Defines that its a load command of some type
Defines the register the data is saved in
Defines the print value
The value that is being loaded/saved


Thats what I mean when I say actually learning what the bytes in the hex mean, instead of finding random addresses and values then modding them, which in some case they might be a value such as 0x00000100 would define the data for score but it is also loaded some where in which we would need to find for it to load correctly and most of all work. Now on to explain data instructions..

What is a data instruction you ask? Well its telling the data what to do, such as in that above example such as load store etc. A data instruction is a command telling what the gamesave to do, such as store data, return data to its original values etc.

Here are two examples, note their fake as I dont have my gamesave on me @ this moment so I cant give out what I already know about this svg.

Say we want to load the data A1(stake sauce lulz) so the processor and gamesave uses this command(or something similar)

    addiu t5, t5, $00A1(HEX=254a0004)


Now lets see what that means in the hex(what YOU mod)

    
[COLOR="Red"]25[/COLOR] [COLOR="DarkOrange"]4a [/COLOR][COLOR="YellowGreen"]00[/COLOR] [COLOR="MediumTurquoise"]A1[/COLOR]


Tells the game this is a type of loading instruction(addiu)
Tells we are loading this data into a register(t5)
Tells it that we are loading it as zero(its the same as it would be addiu t5, zero, $00A1... SAME THING)
And lastly our value


Hopefully you learned something from this and really its not that hard but it can get MORE advanced depending what section of the gamesave memory you are looking at. Best of luck on your modding adventures and hopefully you can get an idea what needs to be changed instead of playing with a whole line. And oh btw an example of instruction modding on a small scale would be the tenth prestige hack because you modify the value being loaded and remaining the instruction. And just like HSx9 originally did changing everything to 'ff' will screw up the commands making everything crazed.

Happy Hacking! Smile^

~bmxdude9
(adsbygoogle = window.adsbygoogle || []).push({});

The following 2 users say thank you to bmxdude9 for this useful post:

IW_JOSH, Xx-Snip3-xX
12-07-2009, 11:53 PM #2
Nice ! Thx Smile
12-08-2009, 12:06 AM #3
zirak
Do a barrel roll!
Originally posted by bmxdude9 View Post
Explaing gamesave modding for the masses [Intermediate]
By: Bmxdude9


Okay so I am sure with Chris modding his gamesave to get three primary guns, playing in matches after the leaderboard hack etc I think it is time for me to give a little explanation as of what I know that could drastically help gamesave modders in their workings. Let me first note that is much easier than what Ive said in the past but some aspects might take awhile to grip so bare with me. Now enough of that lolly gagging time to explain what gamesave modding is actually doing and how to find what were looking for.

Lets make this clear everything you modify hex you ARE modifying a command you cant exactly see such as

lui t2, $08ff(loads the data 08ff into a register, its truly 000008ff) Well this is what YOU see it as in your hex editor.

3c0a08ff*see our data 08ff* Winky Winky and this is what you normally see.

3c 0a 08 ff

Well when you mod the 08 and ff you are changing what the gamesave loads, get it now? Happy


Okay I am pretty sure how this works, I wont put it in assembly even though thats its true binary I will explain in words what is going on. First off like you said the address gets modded for people who "hacked" their gamesave because of the data amount so say the normal data is 00 then well here is what it normally does(in English words for you guys)

This is what is going on with the file(stuff you dont see - this example is if its not modded)

    
Loads the first half of the address location
Loads the first half of the string(0001) that being 00
Loads the second half of the hex string(value) 01
Loads the second half of the address location
loads up a valid pointer and 'if statement like value' then...
Branch the data 0001 to the correct location on server
Load pointer part 1
Load pointer part 2
Check the sum of values and branch back
Use a pointer to return to data if data is legit
Store First half of the Address location
Store second half of the Address location
store the value of 0001 if legit into a saved register
return data back to svg and save.


That all happens in a split second or two but thats why, we have to fool the data where it checks out the values of your rank etc and find a glitch so it thinks its legit, or modify it to make it NOT branch to a new location(keeping it the value we modded without changing the address location)

Thats only after a few minutes of playing around, but really if we want to get pro @ this then we will need to understand what all the hex means instead of playing around. For example anything like...

    
00 00 00 00 00 00

Is not used and reserved for later use while some data such as

    
3e 00 00 ff c4

Might actually be loading the data value 'c4' into a register such as.

    
[COLOR="Magenta"]3e[/COLOR] [COLOR="DarkOrange"]00 00[/COLOR] [COLOR="Olive"]ff[/COLOR] [COLOR="Red"]c4[/COLOR]


Color key(also note the above data is an example)
----------------------------------------------------
Defines that its a load command of some type
Defines the register the data is saved in
Defines the print value
The value that is being loaded/saved


Thats what I mean when I say actually learning what the bytes in the hex mean, instead of finding random addresses and values then modding them, which in some case they might be a value such as 0x00000100 would define the data for score but it is also loaded some where in which we would need to find for it to load correctly and most of all work. Now on to explain data instructions..

What is a data instruction you ask? Well its telling the data what to do, such as in that above example such as load store etc. A data instruction is a command telling what the gamesave to do, such as store data, return data to its original values etc.

Here are two examples, note their fake as I dont have my gamesave on me @ this moment so I cant give out what I already know about this svg.

Say we want to load the data A1(stake sauce lulz) so the processor and gamesave uses this command(or something similar)

    addiu t5, t5, $00A1(HEX=254a0004)


Now lets see what that means in the hex(what YOU mod)

    
[COLOR="Red"]25[/COLOR] [COLOR="DarkOrange"]4a [/COLOR][COLOR="YellowGreen"]00[/COLOR] [COLOR="MediumTurquoise"]A1[/COLOR]


Tells the game this is a type of loading instruction(addiu)
Tells we are loading this data into a register(t5)
Tells it that we are loading it as zero(its the same as it would be addiu t5, zero, $00A1... SAME THING)
And lastly our value


Hopefully you learned something from this and really its not that hard but it can get MORE advanced depending what section of the gamesave memory you are looking at. Best of luck on your modding adventures and hopefully you can get an idea what needs to be changed instead of playing with a whole line. And oh btw an example of instruction modding on a small scale would be the tenth prestige hack because you modify the value being loaded and remaining the instruction. And just like HSx9 originally did changing everything to 'ff' will screw up the commands making everything crazed.

Happy Hacking! Smile^

~bmxdude9

It's also possible, instead of it storing instructions on how to run and stuff, it can also be a file that stores any integer values for the actual address the main game pushes onto register.
12-08-2009, 01:57 AM #4
sensi
Banned
see now this is actually a useful post, thanks alot
12-08-2009, 02:16 AM #5
bmxdude9
Million Miles Of Fun!
Originally posted by sensi View Post
see now this is actually a useful post, thanks alot


no problem, HSx9's is good as well but he covers the modding I cover the more advanced features to get an idea of what can be done.

Copyright © 2026, NextGenUpdate.
All Rights Reserved.

Gray NextGenUpdate Logo