Hacking Basics - Theory

From en64 wiki
Jump to: navigation, search

Introduction

Welcome to the GameShark World. In this document, you will learn several
different ways to hack your own codes. These methods range in degree of 
difficulty from easy to difficult and yield various results. As you read 
you are encouraged to practice the methods that are described in this 
document. This way, you will learn by your activities. 
    There is more than one way to hack codes. This ranges from guessing, to 
a secret hacking system, which not everyone will understand. Again, as you 
read, try the ideas mentioned. It has been proven that people learn easier 
and faster when they are active in a project. 
    It is the authors wish that the material presented here meets the 
anticipated needs of the reader's wishes to learn to hack GameShark codes. 
You might even come up with another variation of these methods to hack 
codes. If you do, let us know and we will consider including it in future 
versions of this document.

Hacking Basics - Theory

Know the Code

Offsets

    Offsets(or RAM addresses) are typically found by examination of the game
memory by using advanced hacking equipment such as a GS Pro, Shark Link or
hex viewer on a ROM. Basically, an offset is a "memory holder" in which
it (usually) holds a byte of memory(a two digit hexadecimal code).

    If you find an offset that holds the health digits when using a ROM and
hex viewer, you can be certain that it isn't the GS code(if you find the
health at offset "012203" the GS code usually won't be "80012203 FFFF".)
There is less than a 1% chance of finding an offset and it actually being
the code. The reason the offset and the offset digits in a GS code are not
the same is this - There are MANY, MANY offsets which are used to tell the
platform what type of game it is(size, language, title, checksum values, 
etc.), and other operation codes which will assign all the offsets to do
what they are meant to do. There are offsets that hold the hex values that
make up the pictures you see in the game, the coordination's of the character
you control, mathematical operations... The list goes on and on... The
header(tells the machine what type of game you're are booting) might take up
all offsets past "012203" itself!
    There is a block of info that tells where the quantifier-offsets(the
byte of memory which you change through GS codes begin and which are usually things
such as number of an item you have or level of health you have). This block is
called RAM(Random Access Memory), which does exactly what it says. RAM is
memory that will be changed all throughout its processing. Score and health
are good examples of RAM, the values for both will be changed while you're
game is running. So think of GameShark as a RAM Editor.

    More information about offsets is beyond the scope of this document and
will not be included in future editions of this text.

Systems of counting or number base

Decimal

Decimal Notation, based on ten digits, is something you already know.
Count to 50 like you normally count. You can count using decimal notation.

Binary

Binary, or dual counting, is based on two digits. It's really easy to
understand and use. You'll need to know the following -


    There are two characters used in binary - 0,1
    (Think of it as a switch).
  A "1" means the switch is turned ON.
  A "0" means the switch is turned OFF.
    That's what binary is, a bunch of switches. I won't go into any more
detail about switches now, but will return to this topic later in the
document.
    A four-digit string of code written in binary is called a "word".(this
is also the same in hex[1-digit])
    Four Binary Digits(bits - 'BInary digiTS') equals 1 digit hex.
    Three bits equals 1 digit octal.



Now that you know that, hex and octal should seem easier to learn. In
this document, we will refer to any and all hex values with "-h" and decimal
values with "-d". So value "100" decimal will read like this - "100-d" and
"64-h". How do you convert from bits to hex and back? Look at this chart -


      Hex       Binary     Hex       Binary
      0    -    0000       8    -    1000
      1    -    0001       9    -    1001
      2    -    0010       A    -    1010
      3    -    0011       B    -    1011
      4    -    0100       C    -    1100
      5    -    0101       D    -    1101
      6    -    0110       E    -    1110
      7    -    0111       F    -    1111


    If you notice, there are no more 4-digit combinations of "0,1" left. Now
for the conversion part. Look at the 4 bits, each of the numbers have a
value assigned to them. We will call these values, "Bit Values".


        Number in Hex        6

        Number in Binary     0110
        Bit Value            8421

           (The Bit Value will ALWAYS be this! So remember it!)


    You are going to learn to convert by using multiplication. Math is a
great tool to use when working with the GameShark.
    You can represent the binary word by letting "0110"(8421) = "IJKL" and
thus you get "1xL + 2xK + 4xJ + 8xI" = "L+2K+4J+8I"(in algebraic terms). Now
substitute the binary back in, you would get "1x0 + 2x1 + 4x1 + 8x0" =
"0+2+4+0" which adds up to six. Six is what the hex value was in the
beginning.
    To convert back to binary, use the formula "L+2K+4J+8K", find the
numbers, which add up to six. In this case, "4 and 2". Remember, "IJKL" = the
bit value. Then substitute the binary back in - "1x0 + 2x1 + 4x1 + 8x0" =
"0110".
    Why do that when there's an easier way? Because there is no use in
converting when you don't understand why it is done in that way. You will
learn an easier way soon, in fact, make one up!

    Octal conversions are the same as hex-to-bit. Only, octal goes up to
"7". So the bit value looks like this -


        Octal     3

        Binary    011
        Bit value 421


    The Bit Value will NEVER change. The bit value is actually the value
assigned for each bit. If you have an 8-bit value, the bit value would look
like this -

       (128)(64)(32)(16)(8)(4)(2)(1)

    Notice that every time a new bit is added(to the beginning, no doubt),
the last bits' value will double. Further explanation is beyond the scope of
this text.


    To convert between hex and decimal, use this formula -


      yz = 2-digit value hex
      (when) z = "A-hex", A = "10-dec"
      (when) z = "B-hex", B = "11-dec"
      (when) z = "C-hex", C = "12-dec"
      (when) z = "D-hex", D = "13-dec"
      (when) z = "E-hex", E = "14-dec"
      (when) z = "F-hex", F = "15-dec"
      (if) z = #, skip next step
      z-hex = z-dec, z-dec = q
      (if) y = #, skip next step
      y-hex = y-dec, y-dec = r
      y*6 = s
      yz+s = yz-dec


    This looks confusing, I know, but I'll explain it as if I were talk to a
10-year-old child.
    First, "yz" represents a 2-digit hex value. Our value will be
"64"(y=6, z=4). When "z" is an "A", A equals "10-d". Understand that so far?
If "z"(in the 'yz' hex value) is a number, skip the next step(4 is a number, 
so we skip this next step). Transfer "z" to decimal(look at the "when's"). 
If "y" is a number, skip the next step(6 is also a number, we skip the next 
step). Transfer "y" to decimal(look at the "when's"). Multiply value "y" 
by 6, the factor is "s". 6*6 = 36, s=36. Add value yz and value s.
64+36 = 100 64-h = 100-d.


    Now let's do it short-hand -


    "yz" = C8
     C = 12, yz = (12)8
     12*6 = 72
     (12)8 + 72      [7]2  --  72-d
                   +(12)8  --  C8-h
                   ------
                    [20]0  --  200-d

     C8 = 200


    If this doesn't make sense, I didn't explain it well enough. It is
important to understand how to do the number base conversions before
continuing. If you do not understand, the reader is encouraged to review the
material already presented.

Bitwise Operations

You may hear about "Bitwise Operators" and wonder what some of them 
actually do. They're used for doing binary math, for lack of a better 
explanation.

& (AND)

The AND operation can best be understood like addition.. only there's no 
adding or carrying involved... really the only similarity is that you work 
with each digit the same as you do with addition...

Like this:

 1000
+0001
------
1001

Just add each digit downward. Well, AND requires you to work with each digit 
downward as well. Here are the rules:

1 & 1 = 1
1 & 0 = 0
0 & 1 = 0
0 & 0 = 0

That means the result will be a 1 ONLY if both comparing digits are 1
Think of it as true and false.. if TRUE & TRUE, then TRUE.

 1100
&1010
------
1000

Starting from the left-most digits, 0 & 0 = 0, 0 & 1 = 0, 1 & 0 = 0, 
1 & 1 = 1.... and there's your result.

You can use bitwise AND for a technique called MASKING. Masking allows you to 
strip certain bits, while saving others. Say you wanted to strip the upper 
nybble of a byte, and save only the lower nybble... Well, you AND that byte 
with 00001111b. When you do that, the upper 4 bits will be completely stripped, 
because 0 & anything is always equal to 0 and the lower four bits will copied 
over directly, because 1 & anything = bits that were set. This can be useful 
when dealing with hex numbers as well. Say you have AC1B02FF and you want the 
lower four bits for some reason. AC1B32ED AND 0000FFFF = 000032ED


| (OR)

When using OR, TRUE or anything = TRUE

The rules:

1 OR 1 = 1
1 OR 0 = 1
0 OR 1 = 1
0 OR 0 = 0

OR is used to set bits... whereas AND is used to clear. So, if you wanted to 
set the least significant bit, your could do "BYTE OR 00000001"


XOR

XOR means EXCLUSIVE OR. it's purpose is to inverse bits.

The rules:

1 XOR 1 = 0
1 XOR 0 = 1
0 XOR 1 = 1
0 XOR 0 = 0

Pretty simple here... it works just like OR, with the exception that 
1 XOR 1 = 0. Say you have a flag, and you want to toggle it on and off. You 
can do "VAR XOR 00000001" and it will inverse it; it will turn it on if it's 
off, or it will turn it off if it's on. That's much easier than doing "if VAR = 
0 then VAR = 1, else if VAR = 1 then VAR = 0." Just a simple XOR operation and 
you're done. Much faster.


NOT

NOT works EXACTLY like XOR with the mask completely filled with 1's NOT will 
inverse the variable completely. All 1's are changed to 0 in the result, and 
all 0's are changed to 1 in the result
10101010 XOR 11111111 = 01010101
NOT 10101010 = 01010101

What's the difference?

As you can see, NOT does not have a mask... so you just say "NOT VAR" and you 
know it's the same as "VAR XOR 11111111"

The difference could be speed. Especially in assembly, where you might have 
to load 0xFFFFFFFF into a register to perform the XOR; you could just do a 
simple NOT instead.

Inversing is great because you can negate numbers with it NOT VAR + 1 = -VAR

Take for example...

NOT 00000001 = 11111110
11111110 + 1 = 11111111
and of course, 11111111 = FF, FF is -1


<< (Left Shift)

Shifting left works like multiplication when you shift left, all right-most 
bits get shifted over to the left, and 0's get shifted into the blank spaces.

Here are some examples:

00111111 << 2 = 11111100
00000001 << 3 = 00001000
10000000 << 1 = 00000000

Just shifting digit places. So, shift left by 1 is the same as multiplying by 
2, left shift by 2 is the same as multiplying by 4. shift left by 3 is the 
same as multiplying by 8, etc. Left shit works best as a means to multiply by 
a power of 2. 2^1 = 2, 2^2 = 4, 2^3 = 8, etc. Shift left x is the same as 
multiply by 2^x.


>> (Right Shift)

Right shift works the same, only opposite, so it's like dividing. When right 
shifting, bits shifted off of the right side are completely lost, and bits 
shifted in from the left come in as 0. Well, they usually shift in as 0 when 
right shifting. In MIPS, you may have noticed "Shift Right Arithmetic (SRA)" 
and "Shift Right Logical (SRL)." Shifting right logical  will ALWAYS shift 0's 
into the new spaces. Shifting right arithmetic will shift the MSB (most 
signifigant bit) into the new spaces. The MSB is treated as a sign bit with 
arithmetic right shift. That's a way to preserve the sign when you divide a 
negative number. 

Here are some examples...

SRA = Shift Right Arithmetic, SRL = Shift Right Logical:

10000000,00000000,00000000,00000000 SRA 4 = 
11111000,00000000,00000000,00000000

10000000,00000000,00000000,00000000 SRL 4 = 
00001000,00000000,00000000,00000000



===Hexadecimal===


    Hexadecimal is a programming 'language' you must know in order to hack
GameShark codes. So, what is it? Hex is what your GameShark codes are
written in. There are sixteen characters used in a GS code. The characters
are as follows -


       0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F


    Let's learn to count in hex. If you look above, you'll see how to count
to fifteen in hex. What's sixteen? "10-h" is sixteen. By the way, don't say
"ten," say, "one, zero" for '10-h'. Let's see what you've learned.

   What comes after 19?
   What comes after 3F?


  If you said, "1A" for question #1, that is correct.
  If you said, "40" for question #2, you should know how to count in hex!

Octal

Octal is just another way to write binary(like hex), but octal
words are longer than hex words. What you've already read is enough to know
about octal. You do not need to know octal to hack GS codes.

ASCII

ASCII is what you are looking at right now. ANYTHING that can be typed
on the keyboard is ASCII. ASCII is useful to know when hacking in my secret
way. It is also useful for using the text editor search option in hacking
devices such as the GameShark PRO. You don't need to know the assignments for
ASCII characters(although you might need to know them when hacking text editing
codes).

Floating Points

Floating Points are a hexidecimal representation of "real numbers", usually 
following the IEEE-754 standard. This could be considered an advanced topic, if 
nothing else, because even some long time hackers I've mentioned it to have 
never heard of them. However, even those who haven't heard of them, have 
most likely dealt with them in one game or another. To put it in the simplest 
terms possible: Floating Points are numbers with decimal points. 100.0 and 100 
are common values used by games to represent your max health. The difference is 
100 is 64 in hex; 100.0 is 42C80000 in hex.

	In hacking terms, Floating Points can make it difficult to find some things, 
if you're only using 8-Bit comparisons. I'm not saying 32-Bit comparisons are 
required though. Most things that use Floating Points are still found by 16-bit 
searches.

	So how can you convert those hex values like 42C80000 to their decimal form?
This is a question I've been asking for a while now. I'm told it involves advanced 
math functions like Shifts and XORs. Don't get worried though. As with most things 
that require much thinking, somebody wrote a program to do the conversions for us. 
You can use FloatConvert [http://www.h-schmidt.net/FloatConverter/IEEE754.html here]. Nobody really knows who wrote this, but I thank that 
person whoever they are.

	It's not required you know anything about Floating Points to hack most codes, 
but they are a major part of games and certain, more advanced, code types can be 
harder to find if don't have a little understanding of this.

About Most GameShark Hackers

Most hackers use more than one way to hack. Most know programming
languages such as binary/hex/octal, HTML and Perl, scripting languages, R300
Instruction sets, etc. HTML and Perl is included here because many hackers
want to use this language to create a website that has all their codes displayed.
You don't need to learn many of the things other than binary and hexadecimal
to "hack better than the Pros."
    Here are some ways you can hack(1 star[*] by the name is easy,
2 is harder, etc.) -


       Guessing****
          This isn't easy, because you don't always find a code this way.
          It's not only troublesome, but risky at some times. Some guessed
          codes can corrupt game data and corrupt hacking devices. 

       Modifying Codes*
          One of the easiest things to do. Change a number on an existing
          code, you make a new code. (Only works when you have a basis[base
          code] to work with.) This technique was and still is widely used.

       Looking At The Source[Code]***
          Hard, but most effective. Worth a shot. This technique requires the
          reader to have a working knowledge of dissembler programs and is
          currently beyond the scope of this work.

       Using Hacking Equipment* - ***(Code Generators; i.e. GS PRO)
          Another way to get codes. It might not be very easy, but it
          doesn't take much time. Plus, it's the second most effective way
          to hack. Can be used to get easy to hard code types.

       Porting**
          Porting is taking a code from one version of a game, and making it
          work on another version of that same game. This does not always
          work. The reason is the same reason that they make more than one
          version. Possibly to fix a minor bug. So the offsets will be in a
          higher or lower position, or even moved to a totally different
          location. You can use the "GS Code Porter"(available at GameShark
          Central) to port any code for you. Hence you can make a code
          before anyone else gets the chance! See FAQ section.

       Combination Hacking* - ***
          All you need to do is hack using two or more methods at once, for a 
          greater chance of finding a code. 

          (!!!!!There is a slight risk of loosing saved data on your GS
          when turning the system on and off while guessing or modifying
          codes.)


source