1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
|
<html lang="en"><head>
<title>HT Editor Documentation</title>
<meta http-equiv="Content-Type" content="text/html">
<meta name=description content="HT Editor Documentation">
<meta name=generator content="makeinfo 4.0">
<link href="http://texinfo.org/" rel=generator-home>
</head><body>
<p><hr>
Node:<a name="Top">Top</a>,
Previous:<a rel=previous href="#(dir)">(dir)</a>,
Up:<a rel=up href="#(dir)">(dir)</a>
<br>
<h2>HT Editor</h2>
<p>This is HT 0.5.0, including HT-analyser;
please note that this is a beta version of the program.
Therefore HT is incomplete and sometimes buggy. Enjoy anyway<small>...</small>
<ul>
<li><a href="#About">About</a>:
<li><a href="#Key%20bindings">Key bindings</a>:
<li><a href="#Features">Features</a>:
<li><a href="#Authors">Authors</a>:
<li><a href="#Where%20to%20download%20%3f">Where to download ?</a>:
</ul>
<p><hr>
Node:<a name="About">About</a>,
Previous:<a rel=previous href="#Top">Top</a>,
Up:<a rel=up href="#Top">Top</a>
<br>
<h2>About</h2>
<p>This program is a file viewer, editor and analyzer (mostly)
for text, binary, and especially executable files.
<blockquote>
This program comes with ABSOLUTELY NO WARRANTY
This is free software, and you are welcome to
redistribute it under certain conditions
For more information please read the GNU General
Public License, contained in the file "copying"
If you do not have received a copy of this file along
with this program, please write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
</blockquote>
<p><hr>
Node:<a name="Key%20bindings">Key bindings</a>,
Previous:<a rel=previous href="#Top">Top</a>,
Up:<a rel=up href="#Top">Top</a>
<br>
<h2>Key bindings</h2>
<ul>
<li>General key bindings
<p><table><tr align="left"><td>Return
<td>follow link (if applicable)
<br></tr><tr align="left"><td>Backspace
<td>undo "follow link"
<br></tr><tr align="left"><td>Space/F6
<td>choose view mode
<br></tr><tr align="left"><td>Alt+[1-9]
<td>select window
<br></tr><tr align="left"><td>Alt+0
<td>select window list
<br></tr><tr align="left"><td>Ctrl+Left/Right
<td>scroll left/right
<br></tr><tr align="left"><td>Cursor keys
<td>move around
<br></tr><tr align="left"><td>Page Up/Down
<td>next/prev page
<br></tr><tr align="left"><td>Alt+S
<td>toggle select
<br></tr><tr align="left"><td>Ctrl+Ins/Alt+C
<td>copy
<br></tr><tr align="left"><td>Shift+Ins/Alt+V
<td>insert
<br></tr><tr align="left"><td>Ctrl+Del/Alt+D
<td>delete
<br></tr><tr align="left"><td>Shift+Del/Alt+X
<td>cut
<br></tr></table>
<li>Window key bindings
<p><table><tr align="left"><td>Alt+F3
<td>close window
<br></tr><tr align="left"><td>Ctrl+F5
<td>resize/move mode
<br></tr><tr align="left"><td><td>(in resize/move mode only:)
<br></tr><tr align="left"><td>Space
<td>toggle resize/move mode
<br></tr><tr align="left"><td>Cursor keys
<td>resize/move window
<br></tr><tr align="left"><td>Escape/Return/Ctrl+F5
<td>leave resize/move mode
<br></tr></table>
<li>Analyser key bindings
<p><table><tr align="left"><td>c
<td>continue code analysis at cursor
<br></tr><tr align="left"><td>f
<td>follow dword ptr at address
<br></tr><tr align="left"><td>n
<td>name current address
(empty string to delete)
<br></tr><tr align="left"><td>x
<td>show xrefs (search for xrefs)
<br></tr><tr align="left"><td>#
<td>edit comments
<br></tr><tr align="left"><td>Ctrl+A
<td>call assembler
<br></tr><tr align="left"><td>Ctrl+F
<td>goto start of current function<br>
(indicated in the 2nd line)
<br></tr><tr align="left"><td>Ctrl+L
<td>goto previous label
<br></tr><tr align="left"><td>Ctrl+T
<td>show recursive function references
<br></tr></table>
</ul>
<br><p>
<p>Note: Some keys don't work in HT-posix. Try using Escape
instead of Control or something...
<p><hr>
Node:<a name="Authors">Authors</a>,
Previous:<a rel=previous href="#Top">Top</a>,
Up:<a rel=up href="#Top">Top</a>
<br>
<h2>Authors</h2>
<p>Stefan Weyergraf <a href="mailto:stefan@weyergraf.de">stefan@weyergraf.de</a>
<p>Sebastian Biallas <a href="mailto:sb@biallas.net">sb@biallas.net</a>
<p><hr>
Node:<a name="Features">Features</a>,
Previous:<a rel=previous href="#Top">Top</a>,
Up:<a rel=up href="#Top">Top</a>
<br>
<h2>Features</h2>
<p>HT is beta software and should not always regarded as stable, but
nevertheless contains some very advanced and useful features:
<ul>
<li><a href="#General%20features">General features</a>:
<li><a href="#Configuration%20files">Configuration files</a>:
<li><a href="#Clipboard">Clipboard</a>:
<li><a href="#Global%20history">Global history</a>:
<li><a href="#Expression%20evaluation">Expression evaluation</a>:
<li><a href="#Block%20operations">Block operations</a>:
<li><a href="#Search%20and%20its%20different%20modes">Search and its different modes</a>:
</ul>
<p><hr>
Node:<a name="General%20features">General features</a>,
Previous:<a rel=previous href="#Features">Features</a>,
Up:<a rel=up href="#Features">Features</a>
<br>
<h2>General features</h2>
<ol type=1 start=1>
<li>Supported file formats
<ul>
<li>common object file format (COFF)
<ul>
<li>- header
</ul>
<li>executable and linkable format (ELF)
<ul>
<li>- header <br>
- section headers <br>
- program headers <br>
- symbol tables <br>
- image with code/data analyser (x86)
</ul>
<li>linear executables (LE)
<ul>
<li>- header <br>
- object table <br>
- page table <br>
- image (disassembly only)
</ul>
<li>standard dos executables (MZ)
<ul>
<li>- header <br>
- relocations <br>
- image (disassembly only)
</ul>
<li>new executables (NE)
<ul>
<li>- header <br>
- segments <br>
- names <br>
- entrypoints
</ul>
<li>portable executables (PE)
<ul>
<li>- header <br>
- import section <br>
- delay-import section <br>
- export section <br>
- resources <br>
- image with code/data analyser (x86 & alpha)
</ul>
<li>Still some to be implemented (M$-OBJ, ARCH, LX)
</ul>
<li>Code & Data Analyser
<ul>
- finds branch sources and destinations recursively <br>
- finds procedure entries <br>
- creates labels based on this information <br>
- creates xref information <br>
- allows to interactively analyse unexplored code (press 'c') <br>
- allows to create/rename/delete labels (press 'n') <br>
- allows to create/edit comments (press '#')
</ul>
<li>Target systems
<ul>
- DJGPP <br>
- GNU/Linux <br>
- FreeBSD <br>
- Win32
</ul>
</ol>
<p><hr>
Node:<a name="Configuration%20files">Configuration files</a>,
Previous:<a rel=previous href="#Features">Features</a>,
Up:<a rel=up href="#Features">Features</a>
<br>
<h2>Configuration files</h2>
<h3>Global configuration</h3>
<p>HT automatically creates a file to store its configuration.
It is called <code>~/.htcfg</code> on Unices and <code>ht.cfg</code> (where
ht.exe resides) on Windows. More specifically it contains HT's registry
and the See <a href="#Global%20history">Global history</a>.
<h3>Per file configuration</h3>
<p>The analyser (for analysable files) will be stored in an extra file called
<code>FILENAME.htcfg</code>, where FILENAME is the analysed file. This file contains
all information to restore the complete state of the analyser.
<p><hr>
Node:<a name="Clipboard">Clipboard</a>,
Previous:<a rel=previous href="#Features">Features</a>,
Up:<a rel=up href="#Features">Features</a>
<br>
<h2>Clipboard</h2>
<p>All open files and dialogs use the common clipboard, where all
copied and cut text or binary data is stored. Clipboard operations are
normally binary safe, that means you can copy some binary data out of a
file and paste it into an input line. Exceptions are only the \0 character
(binary null), it will be converted to a space in places where it would not
make sense (e.g. file open).
<p>Although the clipboard won't be saved between different HT sessions
(ie. you will loose it when exiting HT), you can either save and load it
or part of it manually (via Edit->paste into/copy from file) or rely on
the input lines' See <a href="#Global%20history">history</a>, which is stored and
retrieved from the config file automatically.
<p><hr>
Node:<a name="Global%20history">Global history</a>,
Previous:<a rel=previous href="#Features">Features</a>,
Up:<a rel=up href="#Features">Features</a>
<br>
<h2>Global history</h2>
<p>HTs history system is global, which means that you can use it for all open
files. Histories are also grouped by their context. I.e. file-related and
regex-search-related dialogs have their own history (who would want to
open "[0-9][0-9a-z]+" anyway ?).
<p>History entries are stored within the See <a href="#Configuration%20files">Configuration files</a>, so they
can be reused when you relaunch.
<p>You can delete a history entry by pressing DEL inside the history popup.
<p><hr>
Node:<a name="Expression%20evaluation">Expression evaluation</a>,
Previous:<a rel=previous href="#Features">Features</a>,
Up:<a rel=up href="#Features">Features</a>
<br>
<h2>Expression evaluation</h2>
<p>HT contains a very powerful expression evaluator which is used in all dialogs
where expressions are expected. These are mainly blockoperation, goto,
search and of course evaluate itself (Edit->Evaluate).
<p>You can use all standard math operators (+ - / * % **), logical operators
(! && || ^^), relational operators (== != < > <= >=),
bit operators (~ & | ^), string operators (. for concatenation),
parenthesis, the ternary operator (a?b:c), functions and symbols
(both depending on context).
<p>The evaluator uses integer, string and float types depending on context. You
can always convert a result via the <code>int()</code>, <code>string()</code> and <code>float()</code> functions
to appropriate type. Try Edit->Evaluate to see how it works<small>...</small>
<h3>Functions and symbols</h3>
<p>You can always use the standard buildin math (<code>round</code>, <code>sin</code>, <code>random</code>, etc.) and
string (<code>strcmp</code>, <code>strchr</code>, <code>sprintf</code>, etc.) functions, they work more or less like the corresponding
C functions (actually they ARE more or less wrappers for them); see <code>eval/eval.y</code> for
details (sorry but a detailed help would get outdated rather soon).
When using See <a href="#Block%20operations">Block operations</a>, or searching you have some
context depending functions and symbols; see these sections for explanation.
<p><hr>
Node:<a name="Block%20operations">Block operations</a>,
Previous:<a rel=previous href="#Features">Features</a>,
Up:<a rel=up href="#Features">Features</a>
<br>
<h2>Block operations</h2>
<p>Block operation (Blockop) is a very powerful tool to perform modifications
on binary files. It is available in hex viewer only.
<p>Blockop takes four parameters: <var>start</var>, <var>end</var>, <var>mode</var> and
<var>expression</var>. Blockop works as follows:
<ul>
<li>START: Start at the offset specified by <var>start</var>
<li>REPEAT: Evaluate <var>expression</var> and store n bytes (1 - byte, 2 - word,
4 - dword, variable - string) at the current offset. Increment current offset
by n. Stop if <var>end</var> has been reached.
</ul>
<p>Special variables/functions that can be used in <var>expression</var>:
<dl>
<dt><code>readbyte(ofs)</code>
<dd>read a byte from offset <var>ofs</var>, returns a number
<br><dt><code>readstring(ofs, size)</code>
<dd>read <var>size</var> bytes from offset <var>ofs</var>, returns a string
<br><dt><code>i</code>
<dd>contains the iteration count/index starting with 0
<br><dt><code>o</code>
<dd>contains the current offset
</dl>
<p><hr>
Node:<a name="Search%20and%20its%20different%20modes">Search and its different modes</a>,
Previous:<a rel=previous href="#Features">Features</a>,
Up:<a rel=up href="#Features">Features</a>
<br>
<h2>Search and its different modes</h2>
<p>The search function is one of the most advanced functions of HT.
It is invoked through F7, Shift-F7 continues a search from cursor.
Depending on context (ie. file type and mode) the following modes are enabled:
<h3>bin: ASCII / Hex</h3>
<p>Enter an exact search string either via ascii characters or via hexadecimal
interpretation. This is the fastest search mode. You may specify a
case-insensitive search.
<h3>bin: eval str</h3>
<p>Enter an expression, it will be evaluated ONCE (difference to the 4th mode),
and HT will then search for the result-string. This is pretty useful when
searching for intermixed text and control-chars/binary, e.g. <code>"hello world\n\0"</code>
<h3>display: regex</h3>
<p>As the prefix indicates, this search doesn't search in the binary file but
in the display on screen. HT searches for a regular expression so this can
be very powerful, e.g. in PE/Image you can search for <code>(add|sub).+?,[78]</code>.
This will find all add or sub instructions with second parameter 7 or 8.
<h3>expr nonzero</h3>
<p>This is the slowest but also most advanced search mode. Enter an expression
and the search stops if this expression evaluates to non-zero (it will be
evaluated on every byte). In this mode there are two predefined symbols
and some functions: <var>i</var> is always the number of current iteration and
<var>o</var> stands for the current offset in file. With the functions <code>readbyte(ofs)</code>
and <code>readstring(ofs, size)</code> you access the file's content.
<p>It's easier to understand this with examples:
<ol type=1 start=1>
</p><li>Searching for patterns:
<ol type=a start=1>
<li>Enter <code>readbyte(o) == readbyte(o+1)</code><br>
This will search for two equal bytes ("AA", "55", "!!", etc.).
<li>Enter <code>(readbyte(o) == readbyte(o+1)+1) && (readbyte(o)==readbyte(o+2)+2</code><br>
This will search for three ascending bytes ("ABC", "123", etc).
</ol>
<li>Search with special functions:
<p>With HT you can easily detect the RSA key in the <code>ADVAPI32.DLL</code>:
Search for <code>entropy(readstring(o, 64)) > 82</code> in expr!=0 mode, and you will
find it very quickly. How does it work? <code>readstring(o, 64)</code> reads a 64 byte string
from current offset and entropy calculates the entropy ("randomness") of a string (result is 0..100).
So the search stops if a entropy greater than 82% (guessed value)
is encountered, which normally indicates packed or encryted data.
<p>Note: the <code>entropy()</code> function is not the best of its kind, if you know of a better
one please let us know!
</ol>
<p><hr>
Node:<a name="Where%20to%20download%20%3f">Where to download ?</a>,
Previous:<a rel=previous href="#Top">Top</a>,
Up:<a rel=up href="#Top">Top</a>
<br>
<h2>Where to download ?</h2>
<p>The HT homepage is at
<a href="http://hte.sourceforge.net">http://hte.sourceforge.net</a>
<p>Downloads are available from the 'download' section.
Please also take a look at
<a href="http://sourceforge.net/projects/hte">http://sourceforge.net/projects/hte</a>
</body></html>
|
