How to Hack Any Locally Saved Game

In this article, I will show you how to hack any locally saved game. By hack means changing the attributes of your character or any game entity attribute in the saved file, and by any locally saved game means the file is hackable.

For this demo, we will hack my good old Diablo 2 character - Lestat the Barbarian. But you may hack any saved game you have, this method is not exclusive to Diablo 2. Before we proceed, download a copy File Kit here. File Kit is a small portable program (no need to install) that I developed to help you analyze files and hack games like Diablo 2. 

1. First of all, did you find the location of the saved files?
   If not then, follow these procedures, before going to step 2:
   • Play the game (remember the value of one of the attributes that you want to modify, ie. strength, you will need it later at Step 2), save and exit.
   • Mark the current time.
   • Open the file manager and search for all files that are last modified today. I would suggest searching on the folder where your game is installed, otherwise, it could take a while if you search all your drives.
   • Windows should give you the list of all modified files today.
   • Sort files by date modified in descending order and the file closest to the time your marked could be the potentially saved game file.
   • How to verify? Try to play, save and exit the game again. If the date and time of the file changes, then we're on the right track.
   • In my case, there are different files modified as shown in the image below. I'll just use my intuition that Lestat.d2s is the file I'm looking for since the extensions of the other files correlate to online server logs and maps. 
   • Extract the FileKit you've downloaded in the folder where the saved game is located.
   • Create a backup copy of your saved game so we can revert to the original file in case anything happens.
2. Checking the file
   If the developer added an extra layer of protection thru encryption, you will not be able to modify the attributes to your preference. Or if somewhere within a file a hash of all character attributes is checked upon loading, then it is impossible for you to edit the file unless you get hold of the hash computation. Diablo 2 uses a checksum as a hash to verify the integrity of its data but I will not include it here, as this article focuses on the general approach in modifying entity attributes of any game. There are several ways to hash and generate a checksum, this will be a topic for another article.
   • Number attributes such as strength, energy, vitality, etc... are not saved as plain text, but rather as binary. So we need to find the attribute value you took note earlier, but first, we must learn how to properly convert it for binary string searching later on.

     

     Suppose the attribute you're looking for is a strength of 1000. It is most likely represented in either 2-byte or 4-byte form, where the least significant byte is on the left. 

   • To search for the binary string of the value 1000, we need to use the FileKit Binary String Finder. Most games and other systems save files in binary format like the image above. But there are special cases, where you need to find the pattern yourself. In Diablo 2, I have to search for \208 and \15, as the bits are shifted by 1-bit and the bit that represents 1024 should be 1. If you do not have the normal case, visit the FileKit documentation here to compare and look for patterns in your files.

     In Diablo 2:
     filekit finder lestat.d2s \208\15

     Where lestat.d2s is the saved file, \208 is the Least Significant byte decimal equivalent of 1000 and \15 is the most significant bit. 

     Normal case would be:
     filekit finder {filename} \232\3

     The output of the screen will be something like this:
     
     In my lestat.d2s file, there's only one occurrence of \208\15, which is at byte 768 (byte starts at 0 in FileKit convention). If you see more than one file position occurrences of your attribute value, then most probably, one of those locations is the file position you want to modify. To confirm, which position, play the game again and increase your strength to let's say 1001, then try to find 1001 in the saved file. The position that appears the same for 1000 and 1001 is the confirmed position.

3. Now its time to modify the file.
   We will use the FileKit binary byte editor to accomplish this step. Let's say I want to increase my strength from 1000 to 1020. Now, this would normally be \252 and \3 in most systems and games but in Diablo 2's case it's \248 and \15.

   From the folder where the save game is located type:
   filekit editor {filename} {confirmed file position} {decimal value 0-255}

   filekit editor lestat.d2s 768 248
   The command line filekit editor lestat.d2s 769 15, will not be run since 769 value is already 15 (in decimal).

   If there is more than 1-byte of data you need to modify, you need to call the editor again, since it updates value only by a byte. Let's view the contents of position 768 using the FileKit viewer.

   filekit viewer lestat.d2s 768

   As you can see in the file viewer, byte 768 value is f8 in hex, which translates to 248 in decimal.

4. Now run the game, check the stats and enjoy (In my case, I still have to run the checksum and update the game before I can enjoy my new 1020 strength).