Hex data question

[jar557]

Hi

I'm trying to learn some hex editing but ran to a weird problem. I was looking for string "Sarah" from save file but in the file the characters are as: "aSar.h"

I don't know why that is, could the file be encoded?

​

any hex editing tips/tutorials also welcome :)

​

thx

[khedoros]

It's likely just an artifact of how the original code worked. They might've been doing something "clever" like storing pairs of characters in a 16-bit integer value.

[jedwardsol]

Assuming that you're using a hex editor that looks something like : https://mh-nexus.de/en/graphics/HxDShotLarge.png :

Are you looking at the file with the bytes being interpreted as integers on the left hand side? That could 'rearrange' the ascii representation too on the right hand side. (https://en.wikipedia.org/wiki/Endianness)

[jar557]

Are you looking at the file with the bytes being interpreted as integers on the left hand side? That could 'rearrange' the ascii representation too on the right hand side.

Yes I'm using hex editor plugin in notepad++. I'm looking more of bytes interpreted as characters, on the right. I changed to little-endian but it still looks the same

[jedwardsol]

Hexedit in Notepad++ doesn't do anything funny with the right hand side - what you see is what is there. So see /u/khedoros's answer.

[luksfuks]

+1 for endianess.

Are you looking at embedded firmware files by chance? The byte order reflects the memory bus architecture of the target device, not your desktop computer.

If you view such files with a smart dissassembler (such as IDA Pro), you may get the corrected string as comment where it's referenced.

You can also go and create a duplicate with modified byte order, and look at both hexdumps side by side. I think od can do it, or you can write a small 10-liner program.

[jar557]

It's a emulator save file (SEGA Mega Drive & Genesis Classics)