Copyright: © 1998 Stefan Fleischmann


File menu

New: This command is used to create a file of a size you specify, which consists of bytes with the value 0.

Open: Lets you open one or more files.

Save: Saves the currently displayed file to the disk.

Save As: Saves the currently displayed file under a different name.

Create Backup: Use this command to create a backup of the current file resp. disk sector, which can be restored later by using "Undo" or "Restore File". The backup file is written as a file named "saved???.whx" to the folder specified in the options dialog.

Restore File: Displays a chronological list of previously created backups. Choose the file resp. sector to restore. When the function completed the original file resp. sector content is shown. The file resp. sector is not yet written to the disk until you use the command Save or Save As resp. Write Sector.

Delete Backup: If you do not need a backup any longer, you can use this function to delete it. Automatically created backups for the Undo command can be deleted by WinHex (see Undo Options).

Execute: Executes the current file resp. the associated program, if the current file is not a program file (EXE, COM).

Print

Properties: Lets you edit the time stamp and attributes of a file (A: archive, S: system, H: hidden, R: read-only). Under Windows 3.1x there are less options.

Open Folder [-]: This command is used open all files in a folder. Optionally you can specify a file mask (e. g. "w*.exe"). This functions is not available under Windows 3.1x.

Open Folder [+]: This command is used open all files in a folder and its subfolders.

Save Changed Files: All files which have been modified by you in any way are written to disk.

Save All Files: All files not opened in view mode are written to disk.

Exit: Use this command to end WinHex. You will gain the possibility to save modified files.


Edit menu

Undo: Reverses the last modification, if the corresponding option is activated.

Cut Block: Removes the current block from the file and puts it into the clipboard. The data behind the block is pulled to the former block position.

Copy Block: Copies the current block into the clipboard. The contents of the clipboard can be pasted or written later.

Paste Clipboard: Inserts the clipboard contents at the current position of a file. The file data behind this position is moved.

Write Clipboard: Copies the clipboard contents to the current file at the current position. The data behind this position is overwritten. If the end of the file is reached, the file size is increased so that the clipboard contents fits.

Paste Clipboard Into New File: Creates a new file using the clipboard contents.

Reserve Memory: Use this command to create clipboard data filled with zero bytes. Thus you can insert a defined number of bytes into a file.

Empty Clipboard: This command is used to free the memory used by the clipboard.

Remove Block: Deletes the current block from the file. The data begind the block is pulled to the former block position. The clipboard is not affected by this command.

Define Block: This function is accessible from the menu and the status bar. A dialog box lets you specify the desired block limits. You can also use the mouse buttons in normal edit mode to set the block limits.

Whole File As Block: Defines the beginning and the end of the current file as its current block limits.

Modify Data

Fill Block

• With Hex Values: Specify up to 5 two-character hex values, which will be copied repeatedly into the current block.
• Randomly: Specify a range from 0 to 255 (decimal) for random numbers, which will be copied repeatedly into the current block.

• Chaotically: Generates a chaotic number series from a (random) initial fraction using the Mixmaster algorithm, which will be copied into the current block.


Search Menue
Search menu

Find Text: This command is used to search for a specified string of up to 30 characters in the current file (cf. search options).

Find Hex Values: This command is used to search for a sequence of up to 30 two-character hex values (cf. search options).

Replace Text: Use this command to replace occurrences of a specified string with another string (each of up to 30 characters), cf. replace options.

Replace Hex Values: Functions exactly as Replace Text, but is applied to a sequence of hex values (cf. replace options).

Combined Search: Provides a complex search mechanism. In the current and a second file a common offset is searched, where each file contains the specified hex values.

Find Integer: Enter an integer (within the limits of a signed 32 bit number). This function searches data in the current file, which can be interpreted as this integer.

Find Text Passages: Use this command to look for a sequence of letters (a-z, A-Z), digits (0-9) and/or punctuation marks. This function is useful for instance if you intend to edit text passages hidden somewhere in file with executable code.

Set the sensitivity of the search by specifying how long a character sequence must be to be recognized. Use "Tolerate Unicode characters" in order to force the algorithm to accept zero bytes between two characters.

Continue Global Search: This command is used to continue a global search operation (i.e. a search operation applied to all opened files) in the next file.

Continue Search: Lets you continue a search operation in the current file at the current position.


Content
WinHex 7.49 (Hex Editor for Windows)

General information:

Using a hex editor	Registration

About WinHex	Integer formats

Technical hints	ANSI- / IBM-ASCII

Working with WinHex:

Explanation of all commands

Entering characters

Options

Useful hints	Routines

Status bar	Disk editor

• Please create a backup of each file you want to edit!

• The author assumes no liability for direct or consequential damages, which may result from the use of WinHex.


Extra menu

Options: see Options

Undo Options: see Undo Options

Use As Viewer: If you use WinHex simply for viewing files and you do not need the possibility to edit them, you should switch on this menu option. Files can be opened much faster in view mode.

Use ANSI-ASCII: Lets you decide whether the ANSI-ASCII or the IBM-ASCII character set shall be used for display.

Hex Converter: This command provides a dialog box, which enables you to convert hexadecimal numbers into decimal numbers and vice versa. Decimal numbers may consist of up to 9 digits, hexadecimal numbers of up to 7.

Calculator: Starts the Windows calculator "calc.exe".

Tables: Provides three conversion tables (cf. character set).

Analyze Block: Scans the current block data and counts the occurrences of each byte value (0...255). The result is graphically displayed by proportional vertical lines.

The title bar of the windows provides you with information about any byte value depending on the mouse-cursor position. Use the system menu of the window to switch zero byte consideration on or off.

You will probably gain optically nice results by applying this command for instance to uncompressed wave files.

Disk Editor, Write Sector: cf. "Disk editor"


File Manager menu

Execute: Lets you select a file to execute. If the file itself is not executable, it is opened by the application it is associated with.

ANSI=>IBM / IBM=>ANSI: Use these commands to convert the letters in a text file from one character set to the other. The result is stored in a new file.

Split: This command create several destination files using the content of a single source file. Specify a split offset for each destination file. The source file is not affected by this function.

Concatenate: Select several source files, which will be copied into one destination file. The source files are not affected by this function.

Compare: This command is used to compare two files byte per byte. Decide whether different or identical bytes shall be reported. If desired the operation terminates itself when having found a certain number of differences resp. coincidences. The report is stored as a text file, whose size might otherwise increase dramatically.

The command can be applied to a limited block in the files. WinHex specifies automatically the end of the shorter file as the end of the block.

Copy: Simply copies a file.

Move: Use this command to move and/or rename an existing file. The source file is deleted.

Delete Irreversibly: This command is used to erase the content of a file definitively, so that it cannot be restored by special undelete programs. Each selected file is filled with zero bytes, shortened to a length of zero and then deleted. The name entry of the file is deleted as well. Even professional attempts to restore the file will be futile. Therefore this command should be applied to files with confidential contents, which shall be destroyed. However, the absolute effectiveness of this function cannot be guaranteed, especially when conflicting with resident security utilites, which use elaborate mechanisms to maintain data integrity.


Position menu

Goto Offset: Moves the current position to the specified offset.

Goto Page: Browses to the specified page.

Beginning Of File: Display the first page of the current file and moves the current position to offset 0.

End Of File: Displays the last page of the current file and moves the current position to the last byte (offset=file size-1).

Beginning Of Block: Moves the current position to the beginning of the current block.

End Of Block: Moves the current position to the end of the current block.

Mark Position: Marks the current position and thus enables you to find it again later.

Delete Marker: Deletes the marker from the screen.

Goto Marker: Moves the current position to the marker set by Mark Position.


Explanation of all commands

• File menu

• Edit menu

• Search menu

• Position menu

• Window menu
• Extra menu

• File Manager menu

• Routine menu
• Help menu

• 	Switches between hexadecimal and text entry mode (as the TAB key).

• 	Resizes the editor window (adds one line).
• 	Resizes the editor window (removes one line).


Search options

Case sensitive: If this option is enabled, "Option" is not found in the word "optionally".

Unicode character set: The specified text is searched using the 256 ANSI-ASCII equivalent Unicode characters, where the high-order byte is 0.

You may specify a wildcard (one character or a two-digit hex value), which can replace one byte. E. g. this option can be used to find "Speck" as well as "Spock" when searching for "Sp?ck" with the question mark as the wildcard.

Only whole words: The searched string is recognized only, if it is separated from other words e. g. by punctuation marks or space characters. If this option is enabled, "tomato" is not found in "automaton".

Search in block only: The search operation is limited to the current block.

Search in all opened files: The search operation is applied to all opened files. Press F4 to continue the search in the next file. If "Search in block only" is enabled, the search operation is limited to the current block of each file.

Count occurrences: Forces WinHex not to show all occurrences, but to count them.

Search menu

Replace options

Technical hints


Replace options

Prompt when found: WinHex awaits your decision when found an occurence, whether to replace, to continue or to abort.

Replace all occurrences: All occurrences are replaced automatically.

Case sensitive: The characters, which are to be replaced, are searched using this option (cf. Search options).

Unicode character set: The specified characters are used in the Unicode format (cf. Search options).

You may specify one character resp. a two-digit hex value as a wildcard (cf. Search options).

If the substitute contains a wildcard, the character at the relative position in an occurrence will not be changed. Thus "black" and "block" can be replaced simultaneously by "crack" and "crock" (corresponding entries: replace "bl?ck" by "cr?ck").

Only whole words: The searched string is recognized only, if it is separated from other words e. g. by punctuation marks or space characters. If this option is enabled, "tomato" is not replaced in "automaton".

Replace in block only: The replace operation is limited to the current block.

Replace in all opened files: The replace operation is applied to all files not opened in view mode. If "Replace in block only" is enabled, the replace operation is limited to the current block of each file.

WinHex is able to replace one string resp. hex value sequence by another, which has a different length. You will be prompted, which of the following methods shall be applied:

1st method: The data behind the occurrence is moved due to length difference. Thus the file size is changed. This method must not be applied to certain file types, such as executable files. It is even possible to specify nothing as the substitute, which means all occurrences will be removed from the file!

2nd method: The substitute is written into the file at the position of the occurrence. If the substitute is shorter than the searched character sequence, the exceeding characters will remain in the file. Otherwise even the bytes behind the occurrence will be overwritten (as far as the end of the file is not reached). The file size remains the same.

Search menu

Search options

Technical hints


Windows menu
Window menu

Close: Closes the current editor window.

Close All: Closes all opened windows and thus all opened files.

Close All Without Prompting: Closes all opened windows and thus all opened files without giving you the opportunity to save your modifications.

Minimize: Minimizes the current window.

Arrange Icons: This command arranges all minimized windows.


Help menu

Contents: Displays the contents of this help file.

About: Displays the program version and some hotkeys.

Switch Language: Defines either English or German as the current language.

Initialize: Use this command to restore the default settings of this program.

Register: Allows you to enter the registration codes you obtain in exchange for the registration fee (cf. registration). (This menu entry disappears in the registered version.)

Exit Windows: This command is used to restart Windows 95, switch into the MS DOS mode, reboot the system and to shut down the system.


Status bar

The status bar displays the following information about a file:

1. number of current page and total number of pages

2. current position (file offset)

3. decimal translation of the hex values at the current position
4. beginning and end of the current block

5. size of current block in bytes

With a mouse click you can...

1. move to another page,

2. move to another offset,

3. define the format for the decimal translation and

4. define the block.


Block

You can mark a part of an opened file as a "block". This part can be manipulated

by several function in the edit menu just as selections in other Windows programs.

The current position and size of the block are displayed in the status bar.


Routine menu

Create: Use this command to compile a new routine.

Edit: Lets you modify an existing routine.

Copy: Lets you copy existing routines.

Delete: If an existing routine becomes obsolete, you can delete it from the list. The following routines move upward in the list and thus receive a new ID number. References to those routines as "next routines" will be updated.

Apply: Starts the edit operation defined in the selected routine.


Printing

Use the "print" command to print one or more pages of a file. You can select and setup a printer.

Please choose the character set for printing and accept or change the suggested font size. If desired you may enter a comment which will be printed at the end.


Routines

Try to create a routine instead of making the same changes to file over and over again. WinHex is capable of managing up to 100 routines. They are stored in a file called routines.dat. The commands of the Routine menu allow you to create, edit, copy, delete and apply routines.

1. In order to create a routine you must specify, to which file(s) the routine shall apply to. Either the routine applies to the current file, to all opened files or to an existing file on a disk. A routine cannot be applied to a file opened in view mode.

2. You can directly address up to 5 bytes. For each specify a two-digit hex value and the offset.

3. A routine can be used to replace text or hex values just as the corresponding menu commands (cf. replace options).

4. Beside other options you can specify a "next routine", which will be executed when the current routine has completed. For the next routine the current file is the one to which the previous routine applies. The next routine of a routine, which applies to all opened files, must not apply to a "current" file, as it is unknown, which file is meant.

Hints:

• WinHex executes routines, whose ID numbers are specified as parameters.

• Such routines may apply to "all opened files", if WinHex is already running or the filenames are first specified as parameters.

• If you execute several routines applying to "all opened files", only the last one needs to run with the option "save changes automatically" enabled (if desired at all).

• If the last parameter is "auto", WinHex terminates automatically after executing the specified routines.

Example:

The command line "winhex c:\file1.dat 1 d:\file2.dat 4 auto" has the following result: At first the file "c:\file1.dat" is opened. Then the routine with the ID number 1 is applied to this file. After that "d:\file2.dat" is opened and routine No. 4 is applied to both files. Finally, WinHex is terminated.

It is assumed that both routines apply to "all opened files" and that routine No. 4 saves the changes automatically.


Disk editor

The command Disk Editor in the Extra menu enables you to access a floppy or hard disk ignoring the file structure. On each page one sector is displayed. You may access a disk logically (ie controlled by the operating system) or physically (controlled by the BIOS).

The following functions are supported depending on your Windows version.

Please note the following limitations:

• The sector size must be 512 bytes.

• The editor window should contain at least 32 lines (512 bytes/16 bytes per line) because otherwise a sector does not fit on one page. A screen resolution of 800×600 or higher is required.

• The disk editor is able to access only 2 GB of a logical FAT32 drive.
• Clipboard operations are limited, replace functions are not available.

Write Sector: Use this command to write the current sector to the disk. Please note that this may severely damage the integrity of the disk data. The command cannot only be applied to hard disks until you register.


Modify data

Use this command to modify the block data of a file. Specify a positive or negative, decimal or hexadecimal number, which will be added to each element of the current block. An integer format defines size (1, 2 or 4 bytes) and type (signed or unsigned) of an element.

There are two ways how to proceed if the result of the addition is out of the range of the selected integer format. Either the range limit is assumed to be the new value or the carry is ignored.

Example: unsigned 8 bit format

I.	FF + 1 -> FF	(255 + 1 -> 255)

II.	FF + 1 -> 00	(255 + 1 -> 0)

Example: signed 8 bit format

I.	80 - 1 -> 80	(-128 - 1 -> -128)

II.	80 - 1 -> 7F	(-128 - 1 -> +127)

• If you decide to use the first method, WinHex will tell you, how often the range limit has been assumed to be the new value.

• The second method makes sure the operation is reversible. Simply add -x instead of x based the same integer format to recreate the original data.

• When using the second method it does not make a difference whether you choose a signed or an unsigned format.


Options

1st column:

• When selecting "WinHex as default association", the registry key HKEY_CLASSES_ROOT\Unknown\shell\Open\Command is modified. This enables you to open a file of an unregistered file type in WinHex by double-clicking on it in the explorer windows. This works as well with unregistered and even executable files if you press the shift-key. This option is not available for Windows 3.1x.

• Do not update file time means that WinHex will not change the creation and last write time when a file is saved.

• The option "Restrictive drive control" is only available for Windows 9x. Use it to make sure the disk editor of WinHex locks a disk before accessing it, even if it is not really necessary. This may result in a loss of speed.

• Normally double-clicking the left mouse button is required to set the beginning of the block. Clicking once only affects the current position.

• The ENTER key can be used to enter up four two-digit hex values. It is useful to specify 0x0D0A, which is interpreted as an end-of-line marker.

• Decide whether you want to use the TAB key to switch from text to hexadecimal mode and vice versa or to enter the TAB  character (0x09). In any case the menu button [image] or TAB+SHIFT can be used to switch the current mode.

• Undo keyboard input allows you to reverse your file editing step by step by using then Undo command.

2nd column:

• Specify the folder in which to create temporary files.

• Specify the folder in which to create backup files.

• Specify a path to your favorite text editor. WinHex offers you to view the report of file comparisons using this program. The standard Windows editor Notepad is not capable of opening files larger than 64 KB.

• Decide whether the Open File dialog shall be shown when WinHex is started.

• Perhaps you want to get rid of the backup and restore hints, which are displayed after creating a backup and restoring.

3rd column:

• Offsets can be presented and prompted for in a decimal or hexadecimal notation. This setting is valid for the entire program.

• If you choose "Show 0x01-0x1F as points", hex values in the range from 01 to 1F will be displayed as a dot in text mode when using the ANSI-ASCII character set.

• If you select "Show Icons", the icons stored in a file are shown in the "information edge". This will increase memory requirements and delays the opening of files. If a file contains no icons, the icon of the file type is shown, except this option is not "fully" selected.

• Use all Windows default colors should be self-explaining.

• Decide whether WinHex shall Play message sounds when showing a hints or questions.

• Specify the number of recently opend files to be listed at the end of the File menu.

• Select one of two different ANSI-ASCII fonts.

• Select a color used as the background of the current block.

• You may select a dialog window style.


Registration

If you want to use the registered version on a single (stand-alone) computer the registration fee is DM 29 / US $ 17. For each additional computer add DM 18 / $ 10.

• If possible, transfer the money directly into my account (see below) and notify me of this.	or

• Send me a Eurocheque.	or

• Send me a U.S. check. As this is quite expensive for me, add $ 5.	or

• Send cash money (on your own risk).

Please specify "WINHEX 7.49" and your address!

After having received the registration fee I will send you the codes which enable you to save files larger than 250 KB, to write sectors on hard disks (disk editor) and to get rid of the shareware hints.

Stefan Fleischmann

Carl-Diem-Str. 32

D-32257 Buende

Germany

Homepage: www.muenster.de/~sf

Please visit my homepage if you would like to E-mail me.

Account No.: 1208127686

Bank: Sparkasse Herford, Code No. 494 501 20

Thank you very much!


About WinHex
WinHex 7.49

Author: Stefan Fleischmann

First released 1995, last updated July 1998.

These operating systems are supported:

• Windows 95/98 (preferably)

• Windows NT 4.0
• Windows 3.1x

Homepage: www.muenster.de/~sf

You will find the latest version of this program at my homepage or at www.winsite.com/search by specifying the keyword "winhex".

The Oak Ridge National Laboratory in Tennessee, the "Institut für Informatik der Technischen Universität München" and many enterprises are already registered users. Interested? Click here!


Using a Hex Editor

A hex editor is capable of completely displaying the contents of each file type. Contrary to a text editor, a  hex editor even displays control codes (e. g. linefeed and carriage return characters) and executable code using a two-digit number based on the hexadecimal system.

Consider one byte to be a sequence of 8 bits. Each bit is either 0 or 1, it assumes one of two possible states. Therefore one byte can have one of 2•2•2•2•2•2•2•2 = 2^8 = 256 different values. As 256 is the square of 16, a byte value can be described by a two-digit number based on hexadecimal system, where each digit represents a tetrade/nibble of a byte, ie 4 bits. The sixteen digits used in the hexadecimal system are 0-9, A-F.

You can change the value of a byte by changing these digits in the hexadecimal mode. It is also possible to enter the character, which is assigned to a certain byte value by a character set (cf. Entering characters). All kinds of characters are allowed (e.g. letters and punctuation marks). Example: A byte with the decimal value of 65 is displayed as 41 in the hexadecimal notation (4•16+1=65) and as the letter A in text mode. The ASCII character set defines the capital letter A to have the decimal value of 65.

It is important to know, that the size of files belonging to certain file types (for instance executable files) must not be changed. Moving the addresses of executable code and crucial data results in severely damaging such files. Please note that changing the content of a file generally may be the reason for the corresponding application to behave anomalously. It is quite safe to edit text passages in a file. Anyway, you should create backup files before editing.

The command "Combined search" was especially designed for editing files which computer games create to save the game state. If you know the value of a variable in two of such files, you can find out the offset, ie the position, at which this data is saved. Example: If two files hold the information that you have 5 resp. 7 points/lives/..., search simultaneously for the hex value 05 in the first and 07 in the second file.


Entering characters

In hex mode only hexadecimal characters are to be entered ('0'...'9', 'A'...'F').

In text mode you can enter all kinds of characters: letters, numbers, punctuaction marks and special characters (e. g. '»', ']' and '^'). Please use the Windows program Charmap to find out key combinations for such characters (e. g. Alt-1-7-5 for '»').


Useful hints

• WinHex accepts filenames specifies in the command line and is drag-and-drop capable.

• Use "routines" to make your work with WinHex more efficient.

• You can specify the ID number of a routine as a parameter.

• If you only use WinHex as a viewing utility for binary files, check the menu option "Use as viewer". This accelerates opening files.

• You can insert a certain number of bytes into a file (thus increase the file size) by using the commands "Edit | Clipboard Data | Reserve Memory" and "Clipboard Data | Paste".

• Use hotkeys such as:

• PAGE UP/DOWN

• TAB

• Strg+L (closes all windows)

• ESC (aborts)

• Use the mouse buttons to define the block limits.

• Switch from hexadecimal to decimal offset presentation by clicking the offset numbers.

• If a screen resolution of 800×600 or more is provided you can increase or decrease the editor window and the "information edge" by clicking and pulling the bottom borders. The editor window can also be resized using the menu buttons [image] and {bmc 3.BMP}.

• Try clicking the status bar and the area below the "information edge".


Integer formats

format/type	range	example

signed 8 bit	-128...127 	FF = -1

unsigned 8 bit	0...255     	FF = 255

signed 16 bit	-32,768...3,2767	00 80 = -32,768

unsigned 16 bit	0...65,535	00 80 = 32,768

signed 32 bit	-2,147,483,648...2,147,483,647	00 00 00 80 = -2,147,483,648

unsigned 32 bit	0...4,294,967,295	00 00 00 80 = 2,147,483,648

It is important to know that the low-order byte of numerical 16 bit data is stored before the high-order byte in a file (except in Motorola systems). Analogously the low-order word (2 bytes) of 32 bit data is stored before the high-order word.

The hexadecimal values 10 27 in a file can be interpreted as the hexadecimal number 2710 (which means 10,000 converted into the decimal system).


Technical hints

Min. amount of memory used:	235 KB
~ per opened file:	1 KB

~ per routine:	1/2 KB
Maximum number of opened files:	500

Simultaneous program instances:	1

Maximum number of parameters:	10
Maximum size of clipboard data:	64 MB

Character sets supported:	ANSI- / IBM-ASCII

Offset presentation:	hexadezimal/dezimal

Screen resolutions supported:	640×480, 800×600, 1024×768 und 1152×864

• The progress display normally shows the completed percentage of an operation. However, during search and replace operations it indicates the relative position in the current file.

• It is recommended to use no extra large fonts in your Windows system.

• Search and replace operations generally will run faster, if you neither use wildcards nor the option "case sensitive".

• When searching with the option "count occurrences" activated or when replacing without prompting, for a search algorithm there are generally two ways to behave when found an occurrence, which in some cases may have different results. This is explained by the following example:

The letters "ana" are search in the word "banana". The first occurrence has already been found at the second character.

1st alternative: The algorithm continues the search at the third character. So "ana" is found again at the fourth character.

2nd alternative: The three letters found in the word "banana" are skipped. The remaining letters "na" do not contain "ana" any more.

WinHex is programmed in the second manner, as this delivers the more reasonable results when counting or replacing occurences. (If you continue a search using the F3 key or you choose the replace option "prompt when found", the algorithm behaves according to the first alternative.)


ANSI- / IBM-ASCII

ANSI-ASCII is the character set used in Windows applications. It is standardized by the American National Standards Institute. MS-DOS uses the IBM-ASCII character set (also called OEM character set). These character sets differ in the second half, which contains characters with a ASCII values greater than 127.

Thus it is recommended to switch the menu option "Use ANSI-ASCII" off when viewing or editing files belonging to a DOS program.

Use the file manager commands to convert text files from one character set to the other.


Undo Options

The usage of the "Undo" command depends on the following options:

• Specify how many sequential actions are to be reversed by the Undo command. This option does not influence the number of reversable keyboard inputs.

• In order to save time and space on your hard disk, you can specify a file size limit. If a file is larger than this limit, backups will not be created and the Undo command is not available.

• Automatically created backups for the internal use with the Undo command are deleted by WinHex when closing the file, if the corresponding option is fully activated. If it is partially activated, they are deleted when WinHex terminates.

• Choose for eight different functions if they shall reversible.