Hex editing with Emacs

Posted on March 26, 2023
Tags: , ,

I downloaded Max Payne yesterday but it wouldn’t work properly under Linux. Every time I click on new game, the game would crash with an error message complaining about the jpeg format. After checking the reviews on protondb, it turns out that running the game under recent CPUs such as Ryzen 3000+ or in my case, a 12th gen Intel CPU, would require modification to the game’s dll file to get rid of the error message. To be more concrete, the goal is to find the file rlmfc.dll under the game’s installation directory and change the bytes at address 0x256ED from 83 E0 0F to 90 90 90.

In this blog post, I’m going to show how to use emacs to edit the hex file.

First, you need to open the dll file and switch to emacs’s hexl-mode so you can perform low-level byte editing. On Linux systems, if you are not using flatpak or a non-standard steam installation location, the dll file can be found under the directory ~/.local/share/Steam/steamapps/common/Max Payne/. You can use the good-old C-x C-f (the default key binding for the command find-file) to open the dll file in plain text mode then use M-x hexl-mode to switch into the hex mode. As an alternative, you can use the command hexl-find-file to open the file and enter hex mode. This should give you the following view:

Next, type M-g (default key binding for the command hexl-goto-hex-address) and emacs will pop up a mini-buffer where you can type in the address you want to jump to. The address should not include 0x at the very beginning. In my case, I can simply type 256ED (the case does not matter).

Finally, type M-x hexl-insert-string and then type in 909090 into the mini-buffer before hitting the return button. This will overwrite the hex string at the cursor (83E00F in my case) with the string that you typed in. Note that the word insert is confusing. Your file does not get any longer. It really is an overwrite. Here’s the final edit result: