# ICY Hexplorer Help

#### v.2.4 (C)2002-2004

1. What is this program for
Hexplorer is a program used to edit files. Contrary to text editors, or graphic editors, Hexplorer doesn't format file content, but it displays it as it is, that is as binary data, allowing you to edit it hexadecimally or like text editor does, so it gives you low level access to each kind of file, providing many tools to operate on data. Main goal while developing this editor was innovative visualisation and interpretation of binary data and that is what distinguishes it from other similar programs. This program was created as an answer to my needs, I hope you'll find it useful too. I would be very pleased if you wrote to me and send suggestions and bug reports, I could improve and debug this program better then.
2. How to use it
File opened with Hexplorer is seen in two panels. On left hand in hexadecimal form, and on the right hand as text interpretation of bytes. Their color corresponds with values of bytes, however this can be disabled if you don't like it (Select Options dialog from View menu). Clicking on hexadecimal or text panel places cursor in desired position and panel. Dragging mouse or clicking with [Shift] pressed makes a selection of bytes. You enter data in hexadecimal panel by entering digits 0 to 9 and letters A to F, and in text panel by entering all alfanumerical signs. Some special signs can be also entered in text mode if they are not reserved for program commands, for example [Ctrl+X] is 18h byte, but [Ctrl+Z] is reserved for Undo command. Pressing [Insert] button switches data enterance mode from insert to overwrite. Unlike to other programs this mode affects also Paste function. It inserts or writes over data depending on current mode. Some standard viewing keys are available. These are [PgUp], [PgDn], [Home] - jumps to begining of file, [End] - jumps to end of file. Pressing [Tab] switches panel. Right mouse button pops up context menu with some instant functions available. In the status bar you can see whether editor is in insert or overwrite mode, current position in a file, size of selection, value of byte, word, double word, quad (depending on selection), size of file and whether the file has been saved or not.
3. Program functions
Almost every program option is accessible from menu and some of them are replicated on tool bar and in the context menus. Some commands are also accessible with keyboard shortcuts. Take a look at the program's main menu to find out these shortcuts. Note that some toolbar buttons also react to right mouse button click, what pops up context menu with functions somewhat related to the buttons main function. For example right clicking on Open button pops up menu with recently edited files. Here is a description of program functions which differ to other applications. I'll skip some obvious functions like Open or Save. File: New - Creates new, empty file. If you want to fill it at startup (with zeros for example), use Paste Chain from Edit menu. Open... Reload - Reload actually edited file. All changes are immediatelly discarded. Save Save As... Execute - Creates temporary image of the file in Hexplorer directory and executes it. If it's image, sound, www page, then default application associated with this file will open the file, an executalbe file (EXE) will be executed. Recent - clicking one of these recently edited files opens it. Print... - In a standard print dialog you can choose to print entire file or selected bytes only. Date, Time and Attributes - Opens dialog window, where you can change attributes, dates and times of currently edited file. Changes on disk are made right after pressing OK button. Import - Imports binary data saved in various formats: Ascii Hex Atmel Generic DEC Binary (XXDP) Elektor Monitor (EMON52) LSI Logic Fast Load Four Packed Code (FPC) Intel Hex MOS Technologies Motorola S-Record OS65V Loader Signetics SPASM Tektronix hexadecimal Tektronix Extended hexadecimal Texas Instruments Tagged Wilson RCA Cosmac Fairchild Fairbug Formatted Binary Needham Spectrum This impressive list of accepted formats is thanks to great library Srecord made by Peter Miller. Export - data can be exported to as much file formats as it can be imported, see the list for Import function. Exit Disk: (...) - List of disks available to access. After selecting one of them choose starting sector and number of sectors to read into memory. Disk access is available in fully 32-bit operating systems like Windows(R) NT/2000/XP. Additionally you must have administator privileges to access a disk. Next sector(s) - Reads following sector(s) into memory. Previous sector(s) - Reads preceding sector(s) into memory. Write sector(s) - Writes sectors from memory back to disk. If you changed size of edited data it won't affect number of bytes that is to be written which is equal to the number that has been read. Edit: Undo Cut Copy Copy As - formates and copies selection of bytes to text clipboard. Data can be formated to a C/C++ data, hexadecimal numbers, assembler source or data or text filtered from selection. The selection can also be copied to a new file. Paste/Writeover - this function is affected by insert/overwrite mode. Paste MRU - Pops up context menu with most recently used hex strings, so you can choose one of them to paste it. Paste external text As Is - Sometimes you may want to copy text from other editor to Hexplorer. Use this function then. As hex numbers - Interpretes text in the text clipboard as hexadecimal numbers and pastes interpreted this way bytes. Sample usage of this function is when you have C or assembler source with bytes typed as text like "0x345a, (...)" or "db 71h, a2h, (...)" and you want to paste them into currently edited file as normal bytes, not as text. Note that these sample languages have big-endian numbers parser, so 0x345a is 5a34 word in computers memory. This cause problems if you convert not single bytes, but words or double words. Use Swap Bytes functions to fix this. As floats - This is very like above. It parses text clipboard for floating point numbers and pastes it into binary file as single precision floating point IEEE encoded number. As doubles - Just like above except it pastes data as doubles. As bytes - Converts decimal numbers in clipboard to bytes. For example such sentence "5, 16 255 anything 5.34" will be interpreted as bytes "05 10 FF 05" and pasted into file. Functions below differ only in size reserved for each number being parsed. As words As double words Delete Select All Paste Chain... - Pastes byte string many times. In dialog, which opens after you select this command you can enter bytes in text form or as hexadecimal string. Similar way of entering data appears in Find, Replace, Highlight String and many other dialogs in this program. When you choose number of reapeats and press OK, string will be pasted starting from cursor position. For example, entering text string "kitty." what corresponds to byte string "6B697474792E" and choosing to repeat it 3 times, will paste into cursor string "kitty.kitty.kitty". Operation Reset Selection - Fills selection with zeros. Fill Selection... - Eradicates selection by filling it with byte string. It is somewhat similar to Paste Chain command, but it overwrites selected bytes by new string, instead of inserting new bytes. Pseudo Random Numbers - Fills selection with pseudo random bytes. Uses fast Lagged Fibonacci RNG algorithm. XOR Selection... - This is very like Fill Selection but it performs XOR (exclusive or) operation on selection and source pattern. OR Selection... - This performs OR operation. There is many applications for this function. For example to set the least significant bit of bytes in selection OR it with byte 1. AND Selection... - This performs AND operation. AND is often used to put bit masks. Example: to reset every other byte in selection AND it with word FF00h. Increment Byte(s) - Increments selected bytes by 1. Decrement Byte(s) - Decrements selected bytes by 1. Negate Selection - reverses bits in selection. Swap Bytes (16 bits) Swap Bytes (32 bits) - All Swap Bytes functions are usually used to convert integer numbers from big-endian to little-endian and vice versa. Swap Bytes (64 bits) Flip Bytes - Flips bytes in selection. For example "12345" will be changed to "54321". Find... - Standard find dialog, except for Find All function whitch places all results in Navigator tool window, where you can quickly find out their positions, number and jump through them. Uses fast Boyer Moore algorithm. Replace... - Another standard dialog. The only difference to other applications is that, as in almost every dialog in Hexplorer, you can enter data as text or as hexadecimal number. Find Next Find Previous View: Go To Address... - Jumps to hexadecimally or decimally entered position. Additionally you can save choosen position to quickly access it with Go To Position #n commands and you can add a comment which appears by the address when you right click on it and in the Navigator window. Jump may be relative to cursor, begining or end of file. You may capture address cursor is pointing at by ckicking button From cursor. Go To - Position #n - Jumps to selected position. Use Remember As function or Go To Address dialog to set these bookmarks. Use Ctrl+#n to quickly jump to bookmark #n. Remember As - Position #n - Saves actual cursor position in selected bookmark. Highlight String - Lets you choose up to three (named: alpha, beta and gamma) hex strings that will be highlighted while editing. To disable highlight, select string from combo box, type nothing and press OK. Simple Data Types - In a tool window displays numerical interpretation of bytes as simple data types such as integer or float. Double clicking on selected type allows to change its value. Pixel View - Displays grafical interpretations of bytes in a tool window. It can be useful for finding data patterns or images in a file. First button lets you set the bits per pixel value. You can also set the column width to adjust view - enter new value and press Set button. Disassembler - Tries to disassemble bytes interpreting them as Intel opcodes. Clicking on instruction highlights it's code and double-clicking jumps to that instruction. The disassembler code is from libdisasm library. If you wish to copy disassembled code to clipboard, select the machine code and use function Edit/Copy As/Disassembled code. Navigator - Opens tool window displaying all remembered positions in a file. It displays its global address, address relative to cursor and comment. Double clicking on a position causes jump to it. Upper button changes base of values of addresses. Lower button resets selected position. Windows Calculator - runs MS Windows(R) Calculator, you can make simple calculations and base convertions with it. Options - In options dialog you can adjust fonts and colors (six color schemes available) the program uses, set the number of columns, set number by which columns are grouped together or enable automatic column number option, which adjust column number to current window size, and a number of minor options. Structures: (List of structures) - Clicking one of them opens new Structure Viewer window displaying that structure. Structure is a conglomerate of simple data types in memory or in file. (well, that is structure in this program, in programming languages structures may also contain other structures.) If you know structure, meaning of its members and it's position in a file you can quickly access it with this tool. Structures are stored in file structures.dat in program directory. In the left upper corner of the tool window from a combo box you can choose other structure from the list of available structures. On the right of the combo size of a structure is displayed. In the right upper corner there are 5 buttons: 1-st deletes current structure. 2-nd adds new member to the structure. In a dialog you can choose its name, type and count. If count is other than 1, it will be an array of the choosen type. The member is inserted at the selected position, if no member is selected, new member is inserted at the end of members list. 3-rd removes selected structure member. 4-th clones(duplicates) selected member. 5-th changes the base of displayed values. Below there is a list of structure members. Clicking a member highlights its position in a file, double clicking it, allows to change its value. Add New... - Creates new structure. Crypto Encryption - Encrypts or decrypts selected data with password. Programs pseudo random number generator is seeded with passwords crc and its output is xored to data. Encryption is very fast. Find Pattern - Find repeating data patterns in selected fragment of file. In a tool dialog you can set minimal and maximal length of analised strings, difference between these numbers is significant to calculation time, except for analised data size of course. Listbox below displays results with least entropy. Entropy is in bytes, and it is difference between strings whith analised lengths. Example: entropy is zero for 3 bytes long strings in "tektektektektektektek", it is two for 5 bytes long strings in "aaaa.aaab.aaac.". Fourier transform - generates frequency domain of a function. To do this, it decomposes function into sinusoids (cosinusoids) of different frequency, which sum to the original input. The frequency visualisation you see in Winamp is discrete Fourier transform of sound wave you are listening to. For more information see Fourier transform related links. In the listbox of this tool the sinusoids with greatest amplitude are shown sorted with their frequency described as bytes, words, floating-points or anything you want the data to be treatened as (adjustable from the combo-box above the list). The first button selects all file to calculate and the second saves all transform, including points not shown in the list, in a text file, which you can draw as charts in MS(R) Excel or gnuplot. File Type - Tries to recognize file type by its header. Checksum - Counts checksum of selected bytes, to count whole file checksum - press [Ctrl+A] in editor. Checksums are generated by xoring following bytes to a 8, 16, 32 or 64 bit number. Two CRC16 checksums and CRC32 are also generated. Intialization value for all CRC generators is 0xff(ff). SHA1, RD5 and RIPEMD hash functions are calculated. Double clicking on selected value copies it to clipboard. Byte occurence - counts occurences of bytes in selection. Double clicking on selected byte highlights it in whole file. Macros: (...) - List of hem files containing macros in Hexplorer directory. Choosing one of them runs a macro selected times number. Macro is a series of key presses saved in a file. Warning: macro may work different with different column number set. This is because when you press for example down button, it increases position in a file by column number. If you want to make macro more flexible avoid using up/down and pgup/pdgn keys while recording. Record - After choosing a file, begins recording of keys pressed. Mouse events are not saved. Stop - Stops macro recording. Help: Help Go To Homepage Report a bug Check for newer version - this tries to download the newest version of Hexplorer, however this might be a problem when the server is down, and this will happen some day... About...
4. FAQ
How to install and uninstall the program - Program is available as self-installing file. The installer will perform all operations automatically. It won't mess in registry or system directories, only directory selected to install is affected, so you don't have to reinstall program every time you install windows or you can copy the program to other media - it will work without installation. To uninstall it, use Add/Remove Programs in Control Panel, or just delete all files manually - program's directory and links. How to find a number - There's no direct way to find encoded decimal or floating point number in data. Three simple steps can be done to achieve this. First open Simple Data Types toolbox, second select type of number you are looking for, double click to enter value to be searched. You will get hex representation of the value highlighted. Copy it and find. How to search entire disk - Open disk and use standard find command and answer yes when the program asks if it should search entire disk. Then if program won't find phrase in currently loaded sectors it will open following or preceding sectors to search further. Loading more sectors of disk shall make this time consuming procedure faster. How to recompile the program - First you have to get the sources. The newest sources are on my homepage they shall be also available on sourceforge as well as some older ones. There's makefile with the sources, so it will be easy to compile it with a gnu c/c++ compiler for windows. I use Mingw compiler. You need to compile resouce scripts too, but the Mingw compiler propably won't handle it. I use Borland Resource Compiler available with free Borland C++ compiler. Microsoft(R) Visual C++ should be able to compile everything but I have never tried it and there's no project file. Since you can compile the program, you can make any changes you want by modifying the sources. Why can't I edit very large files - Hexplorer performes all operations in computers RAM, so they are fast, but if you want to edit large files, you need a huge amount of RAM. On modern operating systems (for instance Windows NT) memory is allocated on hard disk if there isn't enough RAM, in that case you can edit very large files, but performance is lower.
5. License
This program is free. It's licensed under GNU General Public License. The newest version and source code is available on my homepage.