[madog]

Presumably they were using a decompiler e.g. IDA Pro to know what characters to change in the hex editor? I've done that before to find offsets in the binary to NOP out some function calls.