Cream of the Crop 22/Cream of the Crop 22.iso/os2/hed151b.zip/hed.doc

Text File | 1996-10-18 | 13KB | 424 lines

                           Hed version 1.51 beta

                        Brief manual (in beta also)





                           HED KEY REFERENCE


 Alt-O          Open file. A wildcard will open all the matching
                files. Logical drives (partitions) can be opened
                as well by specifying the drive letter followed
                by a semicolon (e.g. 'D:').

 Alt-Q          Quit file.

 Alt-N          Next file.

 Alt-P          Previous file. Hed can open multiple files. Use
                Alt-N, Alt-P to browse through these files.

 F3             Abort changes in file.

 F2             Save file (write changes).

 Alt-F2         Save as under a different filename.



 F9             Shell to command prompt.

 Alt-F9         Execute program.

 Alt-X          Exit.



 Home           Move at the beginning of the file.

 End            Move at the end of the file. An additional right
                arrow is required to move past the end of the
                file.

 Ctrl-RArrow    Slide the panel to the right.

 Ctrl-LArrow    Slide the panel to the left.

                NOTE: When in disassembly mode, hed will always
                try to find the original stream of code so as
                to avoid placing the panel's start in between
                instructions. Sliding the panel left or right
                is useful when needed to go to an exact location
                (e.g. in the middle of an instruction).

 Alt-G          Go to offset.

                NOTE: Hed accepts arithmetic expressions in any
                number requester. So, instead of a number you can
                enter complex expressions. For example:
                0x100+345*(1<<8).

 Ctrl-B         Go back to previous position (undo last goto).

 Alt-Shf[0...9] Save position.

 Alt-[0...9]    Return to position.

 Alt-PgDwn      Go to next change. Will jump to the next byte that has
                been previously changed. This is useful to keep track
                of changed data in various places of a large file.

 Alt-PgUp       Go to previous change.




 Tab            Switch between ascii and hex panels in normal
                mode. Switch between hex and instructions while
                in disassembly mode.

 Alt-V          Toggle between hexadecimal and disassembly mode.

 Alt-D          Toggle between hexadecimal and decimal offset
                representation.

 Alt-F          Select text filter.

 Alt-U          Toggle segment size (16bits or 32bits). This will change
                the mode the internal assembler and disassembler works.
                For more information look at "Assembling and Disassembling"
                section.


 +              Increase number at cursor location.

 -              Decrease number.

 Del            Undo byte.

 Backspace      Move backwards and undo.

 Alt-Enter      Insert number at cursor location. The inserted
                expression will be evaluated and will be placed
                at the cursor location as a 8, 16 or 32bit number.

 F11            Insert character. Selects a character from the
                ascii character table.

 Ctrl-Ins       Copy to Hed's internal clipboard. To select data
                for copying hold down the Shift key while moving.
                Data from the clipboard can be pasted into the
                data panel or in the dialog boxes.

 Shift-Ins      Paste from internal clipboard.

 Alt-Ctrl-Ins   Copy selection to file. Data can be saved as
                binary, hex or disassembly.

 Shift-Ctrl-Ins Paste file into current location.

 Ctrl-Del       Undo all changes within selection.


 F5             Find number.

 F6             Find text string.

 F7             Find hexadecimal data.

 F8             Super find. For details about finding look at
                'Finding & Replacing' section of this documentation.

 Alt-F5         Find number and replace.

 Alt-F6         Find text and replace.

 Alt-F7         Find hex and replace.

 Alt-F8         Super find and replace.


 Shift-F7       Redo last search.


 Ctrl-F4        Calculator.

 Ctrl-M         Record Macro.








                         FINDING & REPLACING


 Find hex:

 Finds hex data in the file. Enter the hex data to search for or
paste it from the internal clipboard. The keystroke Alt-? will
insert a wildcard. A wildcard in the search pattern matches any
data. A wildcard in the replace pattern will leave anafected the
replaced byte.


 Finds texts:

 Finds text in the file. Case sensitive or insensitive searches
can be specified. Wildcards can be used in a similar way.


 Find number:

 Finds a number in the file. Dword words or byte sizes may be
specified. HeD uses the little endian notation of the x86 chips.
That is, the bytes are written in memory in order of significance.
For example the number 0x1344 is encoded as 44 13. A number or
an expression can be inserted here.


 Super find:

 Superfind is an advanced more flexible way of searching for
data. The search expression consists of a series of wildcards,
each for every byte, separated by a space character.

 Wildcards use the ? - [ ] , ! symbols much in the same way used
by the unix shell. The following examples will clarify the use of
these wildcards.

  1? 3E 44

   This expression will match a string that has the first
  hex number of the first byte equal to 1 and a second and
  third byte of 3E and 44.

   E8 [0-100d]

   The first byte should equal E8 (hex) and the second must
  be in the range of 0 to 100 (decimal).

   90 !90

   The first byte should equal 90h while the second must
  not equal 90h

   1B

   Search for 01, not 1B ! The trailing b indicates the
  number is binary.

   ???????0b ???????1b

   Search for an even number immediately followed by an
  odd number.

     1?1d

   Matches all decimal numbers having a first and last
  digit of 1.

   ![3,5,[10-34]]

   Number should not be 3, 5 or in the range of 10 (hex)
  to 34 (hex)


  NOTE: Replace data in super find is simple hex data.



  Find Reference:

 Searches the file for branch reference to a specified offset
or to the current location if no offset is specified (use this
if the cursor is at the beginning of a function). The first
call to Find Reference will always start from the beginning of
the file. Subsequent calls (Shift-F7) will continue the search
from the last found reference.

 The algorithm Find Reference is using is quite simple and it
is based on two simple rules of 386 assembly: the branch offset
is always the last data encoded in a x86 instruction and that
the branch offset is added to the offset of the _next_ instruction.
So Find Reference simply searches for numbers (of the specified
size) whose value added to the offset of the byte following the
number sums up to the requested offset.

 In addition find reference can check if the previous byte of
the number found is a valid opcode of a branch instruction (jmp,
call etc).





                              LX PARSING

 One of the most powerful features of hed is its ability to read
the OS/2's executables headers thus providing a much more flexible
debugging and code tracing environment. To parse an executable
headers simply select 'load LX fixup' from the 'Fixups' menu or
enable the autoloadfixups directive in hed.cfg.

 Hed will use the information obtained from the LX tables to
resolve and correctly display instruction containing fixups while
in disassembly. In addition, lists of all the fixups, exports and
imports can be browsed from the 'Fixups' menus. These are:

      Imported names:

    A list of data (or function entry points) imported by name. Each
  entry has the following form:

    <offset>  <modulename>.<entryname>+<offset>.

   <offset> is the offset within the current file where the import
  is requested. <modulename> is the internal name of the module
  containing the requested data.  <entryname> is the name used
  to export the data and <offset> is optional offset from the
  beggining of the data.


      Imported ordinals:

    A list of data imported by ordinal. Each entry in the listing has
  the following form:

    <offset>  <modulename>.<ordinal>

   <offset> is the offset of the import. <modulename> is the internal
  name of the module containing the imported data. <ordinal> is a number
  (unique within the specified module) that selects a specific export.


      Internal references:

    A list of internal fixups. This usually for cross-object branches
  and global data referencing. The format of the entries is

    <offset>  <target>

   <offset> as usual is the offset of the fixup and <target> is the
  actual number used in this location.


      Internal references by ordinal:

    The same as 'internal references' only that this time the target
  is selected using an index into the exported ordinal table of the
  current module instead of an offset.


      Exported ordinals:

    A table of exported entry points labeled by a unique number (ordinal).
  Entries in this table have the following form:

    <ordinal>  <offset>

   <ordinal> is the ordinal number of this export and <offset> is the
  offset of this export from the beggining of the file.


      Exported names:

    A table of entry points exported by name. Instead of ordinal numbers
   a complete ascii string is used. Note however that this export do
   have an ordinal number as well.


 While browsing any of this menus pressing enter will jump to the
appropriate offset. If any of this menus is not available then the
corresponding table is not present in the LX header of the binary.






                    DISASSEMBLING & ASSEMBLING


 Hed has build in assembling and Disassembling capabilities. Pressing
Alt-V at any time will switch between hex and disassembling mode.

 Hed uses tasms and masm opcode representation. That is the target goes
first and sizes are denoted using 'byte ptr', 'word ptr' and 'dword ptr'
prefixes. A thorough explanation of the 386 instruction encodings is
beyond the scope of this documentation. It is assumed that the user will
have some experience with TD, tasm or masm.

 Some additional explanation is required on branches (jumps, calls, jump
under conditions etc). Relative branch targets are calculated and shown as
file offsets. That is the offset shown in a jump statement is not the
actual number that will appear when the module is loaded but it is the
offset within the file where the instruction points to. Effectively,
pressing enter on a branch statement will jump to the target location.
In addition hed can also follow far inter-object fixed branches using
the information in the LX header (of course LX fixups must first be
loaded).

 To enter instructions press space or simply start typing the
instruction and the appropriate dialog will pop up. Hex data can be
entered as well by pressing tab.





                   KNOWN BUGS / KNOWN LIMITATIONS


 Limitations and bugs known to the author. Most of these will be
corrected in feature versions:


- Hed's hex panel is hardwired to 16*16.

- Hed's disassembly panel is hardwired to 16 chars height.

- Hed can't assemble floating point instructions.

- Replacing routines aren't really optimized. Mass replaces of
very frequent appearing data can take quite a long time.

- Hed can't execute files that are currently being edited. This
really happens because hed opens all files with deny-both sharings.

- Copying to a file as disassembly text will not include fixup
informations.

- Opcode checking in find reference will not match long conditional
jumps . Only short (8bit) conditional jumps will be mathced.



                           ACKNOWLEDGMENTS


 Panagiotis Malakoudis. The official hed beta tester :). Cracking
programs has never been more inspiring.

 Peter Fitzsimmons for helping me on a OS/2 programming issue.

 All the guys in Team OS/2 Greece for their support.

 All of you out there in the internet who send me bug reports
and requests for new features.


.



 Dimitris Kotsonis
 [e-mail]