Hiew en
Hiew en
**VERY IMPORTANT**: Assembler search wildcards have been changed. They are
unified with the File wildcards now (see 'String Wildcards')
Crypt is 32-bit now. Crypt programs (*.cry) are written in text format
now. Old binary format from version 5.01 will be supported by current version
(6.7x) only! Tho new operators were added: AND, OR. Programs can be up to 32
lines long. Lines starting with ';' treated as comments.
� About HIEW
� Assembler mode
� Basing
� Block operations
� Status bar (New in 7.00)
� Keys
� Bookmarks
� Jumps (call/jmp) in disassembler mode
� String wildcards (New in 7.00)
� Search and replace (New in 7.00)
� Crypt
� Local and Global offsets (New in 7.00)
� Keyboard macros (New in 7.00)
� INI file
� SAV file
� XLT file structure
� Command line (New in 7.00)
� History (Always new)
Basically HIEW is a hex viewer for those who need to change some bytes in the
code (usually 7xh to 0EBh). Hiew can view files of unlimited length in text,
hex, and Pentium(R) 4 disassembler mode.
Features:
Starting from version 5.00 HIEW works with 386 assembler, so when
working with 8086 code check entered jumps carefully, because you may get
unwanted long jump.
Block operations work only in "Hex" and "Decode" modes. You can mark
blocks without switching to Edit. Marked block can be written to a file by
pressing F2 (PutBlk).
To append the block to the end of file, type '*' character. You can load a
block from another file by pressing Ctrl-F2 (GetBlk). Block will be loaded at
the current offset.
������������������������������������������������������������������������������
xx% Filename.ext .dFRO -------- xxx PE xxxxxxxx�Hiew 7.00 (c) SEN
������������������������������������������������������������������������������
��� ������������ ����� �������� ��� � �������� �����������������
percentage � ����� � � � current progress bar will
indicator � ����� � � � offset appear here
(when BAR=P � ����� � � V
in HIEW.INI) � ����� � � neexecutable type
V ����� � �
file name ����� � �
����� � ��> * Text mode: index of the
����� � first column
kbmacro state: <����������ٳ � * DeCode mode: operands and
R - recording ���� � addresses width;
0..8 - replay ���� � 'a' means it was
���� � recognized automatically
search direction <����������ٳ � for executable
��� �
search area: <����������ٳ ��> status of all bookmarks
F - whole file �� '-' free
B - block �� '1..8' occupied
A - list from the command line �� '*' current
��
file state: <����������ٳ
R - opened in Read mode �
W - opened in Write mode �
U - modified �
�
O - overwrite block <������������
I - insert block
���� Keys ��������������������������������������������������������������������
All keys described in the HIEW7.HLP help file (press F1 to open). You may may
modify HIEW7.HLP, but modified version should keep "[HiewHelp 7.00]" in the
first line. Semicolon
';' denotes a comment. F1 calls corresponding section (from [xxxx] to [yyyy]).
Bookmarks allows you to save the current screen and restore it later. Press
'+' to save state of the current screen. Up to eight screens can be saved, and
each saved screen is assigned an index 1..8. To restore a screen press one of
Alt-1...Alt-8 according to the screen index. Bookmarks are kept separately for
each mode (Text/Hex/Decode).
Jumps are more configurable now. They can be specified in the jumpTable
array of HIEW.INI. It is a string (in C since) of digits and letters. First
character ('0' in HIEW 4, 'Z' in HIEW 5 day 28) is used to undo jump. Character
read from the keyboard are converted to upper case, then looked for in the
jumpTable. By default jumpTable consists of digits '1'-'9' followed by letters
'A'-'Z'.
Wildcard symbols:
Examples:
For example, in the DECODE mode <F7><F7> 'mov ax, *' will find 'mov ax,1234h",
"mov ax,sp", and like.
"mov ?x, ax" will find "mov ax,ax", "mov bx,ax", "mov cx,ax", and "mov dx,
ax",
but not "mov bp,ax" or "mov si,ax".
Since version 6.10 search and replace can be performed in all files
that were specified in the command line. Option "fillArg" must be activated by
pressing "F4" while entering search or replace string.
Alt-? can be used in ASCII and hex searches as any symbol wildcard. For
example (HEX mode, F7): 00 01 ?? 03 04 (?? is shown in place of Alt-?) will
find '00 01 02 03 04', '00 01 FF 03 04', '00 01 AC 03 04', and like.
Crypt can be used for (de-)crypting code or data with some simple
algorithm. Single byte, word or dword of code or data is crypted at a time
(press F2 to change crypt width). Crypt routine must end with "LOOP lineNumber"
operator.
Available commands:
All 8/16/32 bit registers are available, except for AL/AX/EAX that is
used for (de-)crypted byte/word/dword input and output.
Differences from usual assembler:
* there are no jumps;
* 'loop' means jump or stop
* 'rol/ror' operands must have the same width, i.e. ROL AX,CL is not
allowed.
* 32-bit registers cannot be used as 'div' and 'mul' operands
Example:
a. XOR byte with 0AAh:
1. XOR al,0aah
2. LOOP 1
c. divide byte by 2
1. MOV cl,2
2. MOV ah,0 ; register AH use for DIV
3. DIV cl
Since version 5.40 Hiew can show (and set) local offsets, i.e. offsets from the
beginning of a segment or an object. Local offset is represented by a dot
followed by the offset itself.
For the case of the local offset in the NE/LX files, the new offset is
calculated as SSSSOOOO, where SSSS is a segment number for NE, or base for LX;
OOOO is a local offset. If SSSS is zero, then the offset is calculated from the
current segment.
For PE files object alignment (OA) is used in calculating the base. If you
enter (with F5) a local offset that is less than OA, the jump is performed in
the current section.
For LX files having objects larger than 0xFFFF (see object 1 in FC.EXE),
offsets are displayed as in some debuggers (for example, in SD386), and you
should use jumps like .0x200234, although there's no such base as 0x200000.
*NB!* If the first input symbol is '.', the offset is considered local,
otherwise it is global.
If a local offset is set, then wildcards and NE/LX/PE links are searched only
in code segments. For dual-EXE the search area is defined by the active header.
If MZ header is active, then search stops at NewExe header.
Since version 7.00 64-bit offset representation is switched on for files larger
than 4 gigabytes. The offset is shown as 'high32,low32'. This is because
otherwise long numbers with lots of zeroes are difficult to read.
Titlebar for this kind of files always displays 64-bit offset, while in the
left column it's only shown on screens wider than 89 characters, otherwise just
low 32 bits are displayed, and you have to check the titlebar for the rest.
Macro manager:
Also it is possible to run Hiew with a macros from the command line:
HIEW /MACRO0=<filename>
���� INI file ����������������������������������������������������������������
typedef struct{
BYTE sign[ 9 ], // "HiewXlat",0
unused[ 5 ],
versionMajor, // 0x05
versionMinor; // 0x40
}XLAT_HEADER;
typedef struct{
BYTE title[ 16 ], // show in F8
tableOut[ 256 ], // for output
tableIn[ 256 ], // for input
tableUpper[ 256 ]; // for search with ignore case
}XLAT;
Thanks to:
Ruslan Kantorovych
Tadashi Yamakawa
Alexei Kulencov
Andrew Shipinsky
Kirill N. Joss
Stas Mechanoshin
Vladimir Kalashnikov
Alexey Podrezov
Marat Khalili
Keith Byers