Hie We

  • October 2019
  • PDF

This document was uploaded by user and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this DMCA report form. Report DMCA


Overview

Download & View Hie We as PDF for free.

More details

  • Words: 1,474
  • Pages: 6
��������������������������������������������������������������������������������� ����������������ű�����������ű������ű������ű���������� �� ��� ������������ ���������Ű�����������Ű�������������Ű�����Ű����������� ������� ������������ ��������Ű�����������Ű�����������Ű�Ű����Ű������������ ���������� ������������ �������������ű�����������ű�����Ű��Ű���Ű������������������������������������� ������������Ű�����Ű�����������Ű�������Ű� voice: (384-2-)23-31-40 ��� �����������Ű�����Ű�����������Ű�������Ű�� FIDO: 2:5020/35.200 ��� ����������Ű�����������ű�����Ű�������Ű��� E-mail: [email protected] ��� ��������������������������������������������������������������������������������� ��������������������������������������������������������������������������������� Release 5.16 28 May 1996 ( English translation: M.Korneff ) ���� Contents ���������������������������������������������������������������� 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14.

About HIEW Assembler mode Basing Block operations Video modes Status bar Keys Bookmarks Jumps (call/jmp) in the disassembler mode Search/replace operations Crypt operations INI file SAV file History

���� About HIEW �������������������������������������������������������������� Basically HIEW (Hacker's view) is a hex viewer for those who change some bytes in the code (usually 7xh to 0EBh). Hiew is able to unlimited length files in text/hex modes and in 386 disassembler mode.

need view

Features: � � � � �

Text/hex mode editor Built-in 386 assembler HIEW is able to create new files Search and replace mode (can be restricted to block size) Context-sensitive help (but who needs any goddamned help anyways? HIEW can operate without help file HIEW.HLP) � Search of assembler commands using pattern (for real hackers!) � Version 5.02 compiled for OS/2, EXE for DOS use as stub

���� Assembler mode ���������������������������������������������������������� "Byte/word/dword/pword ptr" may be abbreviated to "b/w/d/p". All numbers are hex, so the letter "h" is optional. You can use math operations (i.e. mov bx, [123+23-46h] = mov bx,[100h]). Error messages are very brief (invalid command, syntax error, invalid operand, missing/invalid size). Unconditional JMP will be translated to 0E9 XX XX, so if you want near jump (0EB), you have to type jmp short xxxxx (or jmps xxxxx ).

There is 386 assembler in HIEW version 5.00 or later, so check jumps carefully because you may get unwanted long jump in 8086 code. WARNING! The same command can the assembler you're using.

be assembled differently depending

all on

���� Basing ������������������������������������������������������������������ Base is a constant that will be added to offset and jump addresses. If current offset is YY and you need XX, you should type base "*XX" (asterisk is required!). ���� Block operations �������������������������������������������������������� Block operations are working only in Hex and Decode modes. You can mark blocks without switching to Edit mode. Block can be written to file using PutBlk(F2). If you want to append the block to the end of file, you should type "FFFFFFFF" offset. You can insert the block to the current file from another file using GetBlk (CtrlF2). Block will be inserted on the current offset. ���� Video modes ������������������������������������������������������������� HIEW supports video modes up to 132x75. ���� Status Bar �������������������������������������������������������������� ������������������������������������������������������������������������������ xxx% Filename.ext R xxxxxxxx xxx -------- YYYYYYY� HIEW X.XXa by SEN ������������������������������������������������������������������������������ ���� ������������ � �������� ��� �������� �������� percent � � current � � file length in bytes indicator � � offset � � (only if BAR=P � � � � 1: status of the bookmarks: in HIEW.INI) � � � � '-' free V � � ��> '1...8' respective position filename � � is currently used � � '*' current � � 2: "<Editor>" = Edit mode � � V � status of the file: ��> 1: Text mode: number of the first R - open in Read mode column W - open in Write mode 2: Decode mode: measurement of U - modified operands and addresses ���� Keys �������������������������������������������������������������������� All keys are described in HIEW.HLP (press Alt-H). HIEW.HLP may be modified. First line of HIEW.HLP must be "[HiewHelp 5.01]". Semicolon ';' is a comment prefix character. By pressing Alt-H the respective section (from [xxxx] till [yyyy]) will be displayed. HIEW.HLP must be terminated with [End]. ���� Bookmarks ���������������������������������������������������������������

Bookmarks is for saving/restoring of the current screen. Press '+' to save the state of current screen. You can save eight screens. To restore any saved screen, press Alt-1...Alt-8 respectively. There are different bookmarks for different modes (Text/ Hex/Decode). ���� Jumps (call/jmp) in the disassembler mode ������������������������������� Now jumps is 100% configurable. Jumps can be specified in HIEW.INI in the jumpTable array. This line (C Language) consists of digits and letters. First character used to undo jump ('0' in HIEW 4, 'Z' in HIEW 5 day 28). After reading from keyboard the character will be converted to the upper case, then search in jumpTable will be performed. Default value of jumpTable is '1'-'9', then 'A'-'Z'. ���� Search/replace operations ����������������������������������������������� If search string was entered in ASCII field, case-insensitive search will be performed. If you want to perform case-sensitive search, move the cursor to the HEX field and press Enter. You can search assembler commands (F7). Now search/replace can be restricted entering the search/replace string).

to

selected

block

(F4

In the disassembler mode you can use wildcards in assembler for searching. The wildcard character is '?'. For example, DECODE 'mov ax, ?' will look for 'mov ax,1234h", "mov ax,sp", etc.

during commands

���� Crypt operations (F7/F8 in Edit) ���������������������������������������� Crypt operations are using for crypting/decrypting the code/data. Crypt algorithm is very simple. Code/data will be crypted by the bytes/words (to change the size ot the unit, press F2). Crypting routine must be terminated with "LOOP numberLine" operator. Available commands: Reg mode : Reg-Reg mode: Reg-Imm mode: Imm mode :

neg,mul,div mov,xor,add,sub,rol,ror,xchg mov,xor,add,sub,rol,ror loop

All 8/16 bit registers are available, except AL/AX that will be filled with (de)crypted byte/word. The differences from standart asembler: there are no jumps; 'loop' means 'jmp/stop' the operands of 'rol/ror' commands must have the same size, i.e. ROL AX,CL not allowed. Example: a. XOR byte with 0AAh: 1. XOR al,0aah 2. LOOP 1

b. XOR word with mask increment 1. MOV dx,0 2. XOR ax,dx 3. ADD dx,1 4. LOOP 2 ���� INI file ���������������������������������������������������������������� INI file must be located in HIEW.EXE home directory. First line in HIEW.INI always "[HiewIni 5.03]" ! Blank line or line, beginners with ';' is ignored. -----8<------ Example HIEW.INI -------8<------[HiewIni 5.03]

; ; ;

Startup

; legal values

; startup mode ; StartMode

= Text

; Text | Hex

; beeper Beep

= On

; On

; percent indicator Bar

= Left

; Left | Right

| Percent

; warp/don't warp long lines ; Auto=Off for textfile, On for binary Wrap = Auto

; Auto | On

| Off

; tabulation ; Auto=On for textfile, Off for binary Tab = Auto

; Auto | On

| Off

| Code

| Off

; step for Ctrl-Left, Ctrl-Right in textmode StepCtrlRight = 20 ; 1 - 128 ; Show/Do not show mouse cursor DisableMouse = On

; On

; see next line :-) ActionAfterWriteSavfile = None

; None | ExitF10 | ExitESC

| Off

; table symbols for branch call/jmp JumpTable = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ; Select symbol "linefeed": automatic Linefeed = Auto ; ; ;

0x0a / 0x0d / 0x0d:0x0a ; LF | CR | LFCR

Colors ColorMain ColorCurrent

= 0x1B = 0x71

; main color ; current byte

ColorMark ColorEdit ColorEditOut ColorError ColorMsg ColorTitle ColorKbNum ColorKb ColorKbOff ColorBar ColorWin ColorWinBold ColorWinInput ColorMenu ColorMenuText ColorMenuBold ColorHelp ColorHelpText ColorHelpBold

= = = = = = = = = = = = = = = = = = =

0x5E 0x1E 0x1D 0x4E 0x2E 0x70 0x07 0x30 0x37 0x02 0x70 0x7F 0x3F 0x30 0x31 0x0F 0x20 0x2E 0x0F

; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;

block color file editing non-file editing error messages messages status bar keys key is active key is inactive progress indicator input dialog - " - selected - " - input field menu frame - " - field - " - text help frame - " - field - " - text

; ---+--- End of Inifile ---+----------8<--------8<--------8<-------���� SAV file ���������������������������������������������������������������� If executed without any parameters, HIEW will look for SAV file in the current directory (you can specify /FS=<savefile> in the command line) and restore previously saved (Ctrl-F10) state. If executed with filename, HIEW will use SAV file only to restore search/replace data. ���� History 5.03aa

����������������������������������������������������������������

3/10/95 - OS/2: DosSleep( 1L ) - Unvisible cursor

5.10ee 22/12/95 5.11bb 24/01/96 5.13 01/02/96 -

5.14

5.15 5.16

09/04/96 12/05/96 28/05/96 -

fixed bug: invalid jump for Jc 7E/7F fixed bug: invalid opsize, if previons byte is 0x0F save screencopy into file ( PrScr deleted ) choise symbol "linefeed" in INI-file for replace write full buffer ( was: 1 byte ) for OS/2session get key with KbdCharIn ( was: getch() ) delete DosSleep( 1 ) fixed bug: call/jmp PWORD ptr fixed bug: marked text on 2-lines fixed bug: crash scrolling Up, if upper code is 24 one-byte command (ex. NOP ) fixed bug: OS/2: trap on create file fixed bug: ( from 5.13 ) double prefix 0x66 fixed bug: bad assembler with [EBP] for (Pg)Up looking symbol 0x0A added leading zero to all digit in decode pattern find with wildcards as in decode fixed bug: pattern find truncate line fixed bug: pattern find not found "mov ax,?"

���������������������������������� = YES = �����������������������������������

Related Documents

Hie We
October 2019 31
Hie Lo
November 2019 27
Hie Lo
October 2019 12
Tratamiento De La Hie
May 2020 16
Dzi Cv Hie Otherone
May 2020 4
0809 Cours-04 Hie
December 2019 9