What is Reddit's opinion of
HxD?
From 3.5 billion Reddit comments
➔ HxD website
By popularity on Reddit, this Service is:
37 reviews of this app found across Reddit:
You can still give Universal Extractor a go, because it will extract more exotic types of compressed files than winzip/winrar/7zip. However, Universal Extractor depends on trID to do the file type, and since you already tried that, it probably won't work.
Ha, that HEX editor boasts of "large file support" up to 2 gb (i don't know if that is a "large file" by todays standards). But it doesn't claim to be fast opening them. Sorry I didn't see that.
You might want to give this HEX editor a try instead. I've never tried it, but it does get quite good reviews, and most importantly, it claims to be very fast.
This one came together REALLY fast. I probably spent a total of 3 minutes on it from start to finish. That, however, was pure luck.
For this, I first saved the original photo from .jpeg to .png. I then opened the .png in a hex editor (I use HxD), changed a single number in the text-string, then re-saved the image. Used CS6 to mirror the image and do minimal color corrections.
The RLD! update changes the directorio of the saving.. as you know C:/ProgramData/orbit/420 , But the game save in a diferent bytes.. idk why, but just do the steps and will work!
Remember when you changes somethings in the HEX editor it will creat a .bark files.. dont use that use that ok? (in the step 4 you will understand what im saying). I had the same problem but now it is working!! :DD
1 - Open your favorite editor Hex, and open files and 1.sav 2.sav.
2 - Remove the first 520 bytes of both files if you do not know identify 520 bytes, do like the link below
3 - Save the file and close the hex editor.
4 - Rename the files 1.sav -> Save001.sav and 2.sav -> Save002.sav.
5 - Copy / move the two alquivos we just change to the following directory: code: C: / ProgramData / Orbit / 420 / RLD!
5.1 - You must obligatorily change the UserName 'RLD!' to 'SKIDROW' in orbit_api.ini and steam_api.ini files, otherwise the save will not be recognized because users do not add up. Obs .: The procedure is the same for those who already have a way to change the default username, change your username for the two files.
6 - Create a new text file in the same tiretório we move the saves in step 5, and rename it to 'saves.ini' note that the extension is not ini and txt. Then add the following code and save it. code: [Saves] Save001 = saveSlot2.sav Save002 = saveSlot1.sav
Image showing what should be deleted: http://s13.postimg.org/cdoe55afr/hex_save_fc4.png
Download HxD Hex editor I used: http://mh-nexus.de/en/hxd/
As /u/Furah kindly mentioned, this is called Stenography, and there are many more complicated ways of hiding data. I can only describe this particular case:
The command in the cmd takes all of the information in a.png plus b.zip and puts it in a single file, c.png. In the same sense that "hello"+"world"="helloworld", this simply puts the two together, end to end.
The new file is a.png, so Windows knows that it's supposed to open Photo Viewer. It finds the PNG file header (89 50 4E 47 0D 0A 1A 0A), and reads the data until the PNG file trailer (49 45 4E 44), and it stops loading, so it never touches the zip.
If you force the file open with a Zip viewer, it ignores all of that PNG data and looks for the ZIP header (50 4B 03 04), then it reads until the ZIP trailer (50 4B ... 00 00 00). Everything between those two points is the stuff inside the Zip.
It doesn't need to be a zip file. It could be the .mp3, or any other data. However, the PNG header will get in the way of other programs, whereas winrar is ignoring it. In those cases, you need to use a hex editor to pry the files apart, granted you know which headers you're looking for.
http://en.wikipedia.org/wiki/List_of_file_signatures
Here's the procedure:
- Make a character using the "Classy" hair.
- Save it to a USB stick
- Bring the USB stick to your PC
- Use modio to transfer the "Player.sav" file to your PC
- Open the file in your favorite text editor. I use HxD.
- First we change the hairstyle mesh file. Search for "Classy" and change it to "Sexy". There will only be one instance of this. Be sure to use "overwrite" mode and not "insert" mode -- you do not want to change the file size. Change the leftover characters at the end of the word to '00's.
- Next we change the texture parameters. There are five of these. Search for "Cls" and the first instance you find will be "HMF_HIR_Cls_Diff". Change the "Cls" to "Sxy" so it becomes HMF_HIR_Sxy_Diff. Do the same for the 4 other instances that appear right below this, which end in Mask, MDL, Norm, and Tang.
- For any other hair style, we would be finished editing the file here. However, the forehead will clip through part of this particular hair model. The fix is to change the scalp texture to a crewcut texture to hide the flaw, sort of like spray-on hair. Search for "Bald" and you will hit a texture name called "HMF_HED_PROBase_Scalp_Bald_Diff". Change this to "CrewCut.HMF_HIR_Cru_Diff", once again padding the end with 00s.
- Save the file
- In Modio, do a "replace file" on player.sav
- In Modio, Rehash and Resign the file
- In Modio, write the file back to the device.
Now all that's left to do is load the save on your 360. And voila, a character with "custom sexy" hair. You can do the same with the "Cute"/"Cte" hairstyle (basically Dr. Michel's hair) and the "Mom"/"Mom" hairstyle (basically Kelly Chambers' hair from ME2). Those two styles do not need step 8 above.
Use MO "Saves" tab and it will list the missing esp for the save the mouse hovers over.
Or, use WryeBash "Saves" tab and it will list mods in the right window for the save clicked upon.
Or, open the save in a hex viewer like http://mh-nexus.de/en/hxd/ and search text-string for .esp
Check the .skse co-save instead if it exits.
Try doing this:
Export your save. (This will be referred to as save A.)
Open the game and just hit Save without changing anything.
Export that save. (This will be referred to as save B.)
Open the game, and do something to change the amount of money you have, changing as little else as possible. (For example, buy an item and throw it away, if that's possible in that game.) Save once more.
Export that save. (This will be referred to as save C, obviously.)
Do a binary comparison of save A and B, and note any offsets with values that are different. (This is comparison A.)
Do a binary comparison of save C and either save A or B, and note any offsets with values that are different. (This is comparison B.)
Now look for offsets that are different in comparison B, but not in comparison A. Try putting different, random values in there to see what happens. Worst case scenario you'll break the save, but you have at least three backups, so that's no big deal.
If in either comparison you get tons of offsets with differences, this method won't work for determining the address, but it can't hurt to try.
You can do a binary comparison between two files with HxD (a hex editor), or from the Windows command line with fc /b file1.ext file2.ext > output_file.txt.
If you want, you can just do steps 1-5 and post the save files, and I'll take a look at them myself.
I had to do this the other day when I couldn't figure out why my "single-player" game wasn't pausing (slaps forehead).
I did some Googling and most of the instructions were for much older releases of the game, and for changing SP to MP, but I figured out something that worked.
Note: I'm not on my PC at the moment, so I'll do the best I can without the files in front of me...
Download HxD (a freeware hex editor). I downloaded the "portable" version, because I didn't want to install it. Find the folder for your saved games. I think they were somewhere in <User>/Documents/7 Days To Die/
Quit out of the game application if it is open.
make a backup of the main.ttw file in the folder for the saved game you want to change
Open main.ttw in HxD. You are supposed to look for a value of 07 at location "0x000C" in the file. I couldn't figure out how to determine where that location is, so I just did a CTRL+F for the first instance of "07". Change the "07" to "06" and save the file.
(Re)launch the game.
Hope that helps.
Yep, the PM seems like a no-brainer. Not necessary for single or two-key posts, but otherwise it should just be the normal way to handle this. Hence the post. I'd also like to know what the mods think of this.
> How on earth did you hide a 7zip file within a photo because that is quite clever :)
That's an old trick from the age of the RAR achiver. The image is at the beginning of the file so that all the stupid image display programs can cope, and the archivers for some reason can find their data even late in the file, so all you need to do is to add the archive to the end of the image file. Concatenation can be done with a simple command box ... command, but I used a function built into this nice hex editor I always use: http://mh-nexus.de/en/hxd/
I think it's nice to have people view an image - anybody clicks on those - and then tell them that they hereby already downloaded the software, all they need to do is to unpack it. Here's another example where I used that: https://i.imgur.com/fYkFVtk.png https://www.reddit.com/r/SlaloM_for_Steam/
(I keep recommending this software of mine, but I can't say that I have had any user feedback yet.)
The .IRX libraries contained in the MODULES folder are the equivalent to Windows DLL's or drivers. So not there.
The .PSS files are well understood proprietary audio/video containers.
The game's executable/code is SLPM_551.55. The entry point descriptor and launch options are always in plain text at SYSTEM.CNF since the PS1 era, basically an AUTORUN.INF of sorts for Sony consoles.
--
I bet it's compressed inside the big data container in the root: PROJECT.BIN. Probably a custom binary format, checksummed and even XOR'ed. Good luck.
Use a templated hex editor like 010 Editor. If you want something more entry-level, free or less fancy just use HxD for simple hex editing. BinWalk is useful to assess the entropy and find traces of compression methods/well known file format headers/encryption.
If the file type is complex you may have to end up disassembling the game's code to find interesting strings instead of black box reverse engineering. But that's on a totally new level of complexity.
I think I remember this phenomenon, ZFS puts some signature on the disk so Windows do not like it anymore. I guess it would be sufficient to zero out the first and last 10MB of that disk. An easy way would be, if you have a linux handy an just dd from /dev/zero to the disk. If you don't fell comfortable with linux you may try a disk editor like HxD there is a physical HDD editing mode under MENU > Extra > Open Disk. Alternatively you could use a diskbenching tool like HDDscan there is a WriteTest that writes zeroes to the disk. Be aware you have to start these tools always as administrator, and THEY ARE DANGEROUS, THEY WILL DESTROY ALL DATA ON THE DISK, SO BE TOTALLY SURE THAT YOU SELECTED THE RIGHT DISK TO OVERWRITE
That decoder is designed to show the hex representation of ASCII text and may not make sense of data outside the standard ASCII range. It's also probably not designed to handle as much data as a JPEG file contains and may end up truncating it.
You should use a hex editor to view the contents of a binary file. I use WxHexEditor. HxD is a popular one but it's Windows only.
Bro.. I used to do this shit way back in the day with an old school hex editor. Unfortunately I go to a school where just about every professor is a hacker of moderate skill and they can just repair the header of the file and see a blank document. Rough. Guess I have to do work.
Oh and for those saying things about PDFs... PDFs have headers too. Download http://mh-nexus.de/en/hxd/. Open file in it. Delete 5 or 6 lines from line one down. Save... profit?
In this episode, I'm going to demonstrate how to edit the amount of experience your MEC troopers receive for each kill.
You are going to need a HEX editor to do this, here's a link to the one I'm using:
I hope you enjoy this video, and find it useful!
You can follow me on twitter at: https://twitter.com/CommanderFaleg
Join me on Facebook: https://www.facebook.com/FalegsChanne...
Hi
You can find it this way:
- Download this text file It's basically the whole bible in one text file (ca. 4 MB)
- Download HxD. It's a free Hex editor with a lot of additional features
- Open the file in it. Click in the analysis menu on statistics (I have german HxD, cannot tell the exact english menu name)
- The editor will count all existing chars and display them to you. You can hover over a bar to see what char it represents (in the status bar).
You can repeat this step for every other binary file or Text content. Simply copy text to clipboard, create a new file in HxD and then on the right side of the editor, paste the text. You do not need to save for the statistics to show up, but if you change the file you need to close and reopen the statistics window for it to count.
The RLD! update changes the directorio of the saving.. as you know C:/ProgramData/orbit/420 , But the game save in a diferent bytes.. idk why, but just do the steps and will work! Remember when you changes somethings in the HEX editor it will creat a .bark files.. dont use that use that ok? (in the step 4 you will understand what im saying). I had the same problem but now it is working!! :DD
1 - Open your favorite editor Hex, and open files and 1.sav 2.sav.
2 - Remove the first 520 bytes of both files if you do not know identify 520 bytes, do like the link below
3 - Save the file and close the hex editor.
4 - Rename the files 1.sav -> Save001.sav and 2.sav -> Save002.sav.
5 - Copy / move the two alquivos we just change to the following directory: code: C: / ProgramData / Orbit / 420 / RLD!
5.1 - You must obligatorily change the UserName 'RLD!' to 'SKIDROW' in orbit_api.ini and steam_api.ini files, otherwise the save will not be recognized because users do not add up. Obs .: The procedure is the same for those who already have a way to change the default username, change your username for the two files.
6 - Create a new text file in the same tiretório we move the saves in step 5, and rename it to 'saves.ini' note that the extension is not ini and txt. Then add the following code and save it. code: [Saves] Save001 = saveSlot2.sav Save002 = saveSlot1.sav Image showing what should be deleted: http://s13.postimg.org/cdoe55afr/hex_save_fc4.png Download HxD Hex editor I used: http://mh-nexus.de/en/hxd/
Well, one problem with this is that after modification, the file is most probably of a different size. But maybe the software will not care - as long as the file isn't bigger.
I use HxD for my hex editing/viewing:
With it, you should be able to open both files, copy the complete content of the PNG, and insert it into the bin file, then you have to remove as much after your insertion as necessary so that the overall size is equal again. Before you set out to do this, make sure that your new PNG is not larger than the original. If it is larger, forget all of this.
The hex editing is going to be the most straight forward part of this.
- Download HxD in whatever language you like, install it.
- Open it, open 8021x.exe.
- CTL+F, make sure Datatype is Text-string. Search for 'SUAdvapi.dll'.
- It will jump to the string. Highlight 'SU' and type 'FK'.
- Save the file.
That's all there is to the hex editing part of it. The real challenge is that they want you to modify and build the VS project yourself. They ask that you add code to the SiteTimerHook method, which looks like this:
BOOL WINAPI SetTimerHook(In_opt HWND hWnd, In UINT_PTR nIDEvent, In UINT uElapse, In_opt TIMERPROC lpTimerFunc) { if(nIDEvent == 6) { // TODO: do some magic to uElapse :) }
return (*hProcSetTimer)(hWnd,nIDEvent,uElapse,lpTimerFunc); }
SHA1 is a hashing function: SHA1
The prefetch file is not a flat text file, so opening in notepad/wordpad would be painful. A hexeditor allows you to read a file in "raw" format, excluding any sort of encoding or formatting. Ok that isn't technically accurate, but portrays the end result.
Check out HxD for a free and simple hexeditor.
Open the prefetch file and do a find on "helper.exe" (make sure the datatype is Text-string), the actual image path should be the second hit. Once you have the actual helper.exe, load this binary into HxD and use Analysis->Checksums->SHA1 (ensure the region is "Entire file"). This string is the unique hash of the file, and can accurately 'name' the file the way filename can't.
VirusTotal is an online repository of files people upload and have scanned by multiple AV scanners. Useful for tracking and identifying malware. It's pretty popular, google it.
You can't just overwrite the names unless the new name is the exact same length as the old name because the strings are stored Pascal-style with a length prefix. Rather than using Notepad++, I would use a dedicated hex editor such as HxD as such programs will let you easily change the prefix and make sure nothing else changes too.
Here's an example. If I open up my world in HxD and scroll to the end of the file, I see all the NPC names; the first name on the list is "Alfred" who is my merchant. The byte before "Alfred" is x06 which signifies that the name is 6 characters long. If I want to change his name to "Stephen" I need to not only change the name, but also change the prefix to x07. This composite image may be helpful for doing this sort of thing.
Here's a little tip if you have to go to court. Download a Hex editor. In most JPEG photos data is there telling what camera and what editing software was used. Even if you photoshop a image the Hex Editor will tell you.
Hex editor
http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm
Google Search Hex editor
Well, the tool you used doesn't correctly translate high-ASCII, which would throw a wrench into things. In the future, if you want to see the hex representation of a file, I'd recommend using a dedicated hex editor like HxD.
I've used a hex editor to edit files on Android games before. It gave the hex values in one field, then the plaintext translation next to them. You manipulate the hex values and can see the plaintext change that it will have. Very easy when editing variables.
I googled "hex editor" and literally the first thing to come up is the one I used: Here. I remember Ctrl+F being my best friend; there's decrypted text strings interspersed with all the garbage encryption, so if you search for "XP" you'll find anything mentioning those plaintext characters.
Let me know if this helps you. It would be very good information to have.
I was afraid of that.
It makes me wonder how much of my existing drive would be overwritten. I doubt it does a complete format of every sector. I would imagine it does something along the lines of a quick-format. Only overwriting what is necessary to define the array leaving the vast majority of the data in place, but with no easy way of accessing it. If I knew what sectors of the drive would be overwritten, I could back up just those sectors to a flash drive with a program like <strong>HxD editor</strong>, create the array, and restore those sectors after I simulate a drive failure by removing the drive from the array.
Where's the cutoff point in terms of what a game should be searching for, I mean. If you're saying that a game should only detect if you're actually using something to cheat on the game, then I agree with you and the ban in the original post should have never happened.
Despite it's name, all CE seems to be is a memory scanner and hex editor, for which there are plenty of legitimate uses. I don't want to have to worry about what I've used or had open on my computer in case games might search through my programs and ban me based on something they find.
I don't use CE, but I do use HxD which can do a lot of the same things. I've never used it to cheat in an online game, and would be pretty pissed if I got VAC banned for leaving it open in the background. Is it fine because this hex editor is not marketed towards cheating, or are all programs that you could potentially cheat with good grounds for a ban?
And what about web tools? There are some websites that could allow you to cheat. Is it then fine, because of this, for games to check your browser tabs and history?
My point is basically that it's none of Valve's business what programs I have on my own computer when they're not being used to cheat. I really don't want to constantly worry about what I'm doing looking suspicious in case I get VAC banned. I don't even want to have to explain to Valve what files on my computer are legitimately for.
Alright, this isn't hard, but it might look a little scary. It's not really, at all.
Go into the save editor and get your new save onto your SD card. You might want to change the folder name of your old save just to keep things from getting confusing.
Assuming you're on Windows, download this hex editor (around the bottom third of the page).
Once you have it up, open up the new save's garden.dat. Referencing this screenshot, click on the drop down that says 16 right below the Analysis menu, and set it to 8.
Select the first row there (from 00 to 07), and copy it to your clip board (ctrl+c or however you prefer to copy things). Try to avoid messing with the rest of the file.
Close the new save (right click on the tab and close it), and open up the garden.dat from your old save.
Repeat the same thing with the 16 -> 8 column size. Select/highlight the first 8 bytes again, but this time paste in what you copied earlier. Save the file (ctrl+s).
You can now copy it to your SD card to load into the save extractor. You should probably also keep a copy of that save somewhere safe, just in case.
As a side note, those permanent roses everywhere. They appeared in your old town, and now again in your new town, right? Were they there right after you made a new town, or only after you edited it?
You could open it with this tool and see if its human readable.
Aside from that you could check if excel can open them.
Contacting the original developers might be necessary if its important to you.
https://wiki.classe.cornell.edu/Computing/
https://en.wikipedia.org/wiki/Insure%2B%2B
One of these may open it.
Binary files are files that aren't raw text. (although all data is binary.) Such as JPEG, ZIP, MP4, etc
Text files are files that have text stored with an encoding scheme such as ASCII, UCS, UTF-8, CP437, etc.
Base64 is an encoding scheme to store binary files within ASCII standards.
UTF-8 Text: ☆ WHITE STAR Base64 Encoded Text: 4piGIFdISVRFIFNUQVI=
Notepad, assumes all files are text files and will guess the encoding scheme, thus changing the data when you try and copy paste it.
If you wish to access binary files without doing that use a hex editor.
If you know that it's not a text file, you can use Microsoft's/Sysinternal's "string.exe" to extract anything above 3 characters. Does Unicode as well.
https://technet.microsoft.com/en-us/sysinternals/bb897439.aspx
Personally, if I just want to take a look, I open the file with right-click "Open with HxD (readonly)". I like this hex editor a lot.
It's not actually necessary to use an ID from another game, btw. You could make up any ID you want and Nintendont wouldn't know the difference. The only requirement is that the ID has to be 6 characters long.
If you aren't using a loader I don't think just renaming the folder/filename would work. Nintendont reads the ID from within the game iso itself. So it would still save to the same memcard ID as Melee (if you have memcard emulation on and multicard off).
You could use a hex editor like HxD to change the ID in the header of the iso, however. I suggest using a similar ID to Melee's, actually, because if you ever want to backup your saves it would make finding Melee & 20XX easier (once again, assuming you have memcard emulation on and multicard off).
I've gotten into DPFMate.exe quite deeply already. It has JPEG compression code, which is used both for saving JPEG files and encoding for the photo frame.
When encoding for the photo frame, JPEG quality is taken from the JpgQuality setting in the info section in StartInfoUnicode.ini, in the same directory as the executable. So, you should be able to alter the quality by copying both DPFMate.exe and StartInfoUnicode.ini to the same directory on your hard drive and editing the number after JpgQuality= in the ini. It's currently 90 and the maximum quality is 100.
The header near the start of acme_4.bin is used to get LCD size, but the quality settings are ignored.
Chroma subsampling is hard-coded enabled via parameters passed to the JPEG encoder. It should be possible to disable this by changing the byte at offset 9377 hex from 3 to 0. If you need a hex editor for Windows, http://mh-nexus.de/en/hxd/ is pretty good. If you want to check your work, comparing with an unmodified copy, use a command like: fc /b DPFMate.exe "DPFMate - nosubsample.exe"
You should see:
Comparing files DPFMate.exe and DPFMATE - NOSUBSAMPLE.EXE 00009377: 03 00
If you save the data in a raw format (without header etc., just wave data), you can use any tool, even "DOS" commands. I use HxD for this, my preferred hex editor. I has a built-in tool for file concatenation. You can populate a list and then execute the concatenation.
I would recommend using HxD. And there's no real tutorial, you just press Ctrl-G and go to those offsets. Make sure to convert the map bank and map numbers to hexadecimal as Advance-Map displays them in decimal.
It's kinda hard to tell what's going on based on your description. You might want to use a hex editor to see what's going on in your file. HxD is free ware- here's a link HxD!
Well I guess opening the file with a hex editor and matching the header against a list of file signatures would be the best way to spot the lazier ones simply renaming whatever file they have on their desktop. If it's completely blank data I don't think there's any easy way to find out as that - even if very rare - can happen.
You need a hex editor. My prefrence is HxD. Then you create a new file and write only '12' as the hexedecimal value of the first (and only) character in your file. after that you save it and open the file in notepad.
If you can remember a part of the text, go grab a disk editor like HxD and search for it. With so many different caches on a modern PC, it's very likely your letter was swapped to disk at some time before it rebooted. It is important to run the search asap though, before you do too much on the pc.