-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathindex.htm
More file actions
1144 lines (1137 loc) · 48 KB
/
index.htm
File metadata and controls
1144 lines (1137 loc) · 48 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<html>
<head>
<title>Hiew Documentation</title>
<link rel="stylesheet" href="hiewdoc.css">
<script type="text/javascript" src="hiewdoc.js">
</script>
</head>
<body onload="init()">
<h1>Hiew Documentation Project</h1>
<p>
This page is an easy-to-use list of Hiew documentation.
</br>
<br/>
Help find that shortcut you've forgotten, or remind yourself how a feature works.
<br/>
<br/>
<i>If you'ld like to help contribute corrections, demos or documents, click
<a href="https://github.com/taviso/hiewdocs/">here</a>.</i>
<br/>
<div class="note">
If you have javascript enabled, clicking most shortcuts will load a demo
image, showing how the feature works.
</div>
</p>
<p></p>
<p></p>
<p></p>
<div id="search">
<input type="text" id="query" onkeyup="filter()" placeholder="Search for keys...">
<p></p>
<p></p>
<input class="filter" type="checkbox" id="block" onchange="filter()" checked=true>
<label for="block">Working with blocks.</label>
<br/>
<input class="filter" type="checkbox" id="hex" onchange="filter()" checked=true>
<label for="hex">Can be used in hex mode.</label>
<br/>
<input class="filter" type="checkbox" id="code" onchange="filter()" checked=true>
<label for="code">Can be used in code mode.</label>
<br/>
<input class="filter" type="checkbox" id="text" onchange="filter()" checked=true>
<label for="text">Can be used in text mode.</label>
<br/>
<input class="filter" type="checkbox" id="navigate" onchange="filter()" checked=true>
<label for="navigate">Navigating around files.</label>
<br/>
<input class="filter" type="checkbox" id="edit" onchange="filter()" checked=true>
<label for="edit">Can be used in editmode.</label>
<br/>
<input class="filter" type="checkbox" id="exe" onchange="filter()" checked=true>
<label for="edit">Features specific to executables.</label>
<br/>
</div>
<p></p>
<p></p>
<p></p>
<table>
<tbody id="topics">
<tr class="header">
<th width="150px">Key</th>
<th>Description</th>
</tr>
<tr data-tags="block hex code">
<a name="mark"></a>
<td class="shortcut"><span>*</span></td>
<td data-demo="select-block" class="description">
<div>
<p>
Mark/unmark a block, this is like visual mode in Vim, it selects a
contiguous region of bytes. Press <span class="inline key">*</span>
to start a block under cursor, then use the cursor keys to move to
extend the block. Press <span class="inline key">*</span> again to
mark the end. Only one block can be active at a time.
</p>
<p>
You can use most navigation shortcuts while marking a block, here
are some common examples:
<ul>
<li>Mark to the end of the file, use <span class="inline
key">*</span> then <span class="inline key">Ctrl</span> <span
class="inline key">End</span></li>
<li>Mark to the beginning of the file, use <span class="inline
key">*</span> then <span class="inline key">Ctrl</span><span
class="inline key">Home</span></li>
<li>Mark until search result, use <span class="inline
key">*</span> then <span class="inline key">F7</span>, or <span
class="inline key">Ctrl</span><span
class="inline key">Enter</span> for next match</li>
<li>Mark from here until offset, use <span class="inline
key">*</span> then <span class="inline key">F5</span>.</li>
</ul>
Press <span class="inline key">*</span> again when the cursor is
over the position you want the block to end.
</p>
<div class="note">
See <span class="inline key">Alt</span><span class="inline
key">*</span> if you need to resize an existing block, you don't
have to start again if you made a mistake!
</div>
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>ctrl</span><span>*</span></td>
<td data-demo="block-all" class="description">
<div>
Add the whole file to the current block, this is useful if you want
to remove everything except the section you're working on. To do
that, type <span class="inline key">Ctrl</span><span class="inline key">*</span>,
move to the new end, and type <span class="inline key">Alt</span>
<span class="inline key">*</span>.
<div class="note">
You can also use this to exclude a section from a search, by
changing the search scope to block.
</div>
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>alt</span><span>*</span></td>
<td data-demo="block-all" class="description">
<div>
Resize block to current offset. Move the start of the current block
to the current cursor position.
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>alt</span><span>m</span></td>
<td data-demo="assign-color" class="description">
<div>
<p>
Assign a color to the active block. You can change the colors
asssigned to different fields to help differentiate them quickly,
this is useful to mark header fields. Note that the color persists
even if you start a new block.
</p>
<p>
To move around in the color selection dialog, use <span
class="inline key">←</span>, <span class="inline
key">↑</span>, <span class="inline key">↓</span>, and
<span class="inline key">→</span>.
</p>
<p>
When you use colors, hiew will ask if you want to save them when
you exit. Colors are saved to a <code>.cmarkers</code> file
that is automatically reloaded when you start hiew.
</p>
<div class="note">
I like to group similar fields together with the same color, but
sometimes you just want to differentiate a field and don't care
which color is used, use <span class="inline key">Shift</span>
<span class="inline key">Alt</span><span class="inline
key">M</span>, which assigns a random color.
</div>
<div class="note">
<span class="inline key">Alt</span><span class="inline
key">N</span> jumps to the next marked block,
which is very handy to skim through a file that was already colored
by <a href="https://github.com/taviso/kiewtai">kiewtai</a> for example
(use <span class="inline key">Shift</span>
to jump to the previous marked block).
</div>
</td>
</tr>
<tr data-tags="block hex code navigate">
<td class="shortcut"><span>[</span></td>
<td data-demo="navigate-block" class="description">
<div>
Move to the start of the current block.
</div>
</td>
</tr>
<tr data-tags="block hex code navigate">
<td class="shortcut"><span>]</span></td>
<td data-demo="navigate-block" class="description">
<div>
Move to the end of the current block.
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>ins</span></td>
<td data-demo="read-block" class="description">
<div>
Toggle insert/overwrite block mode, the current mode is displayed
in the status indicator.
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>f2</span></td>
<td data-demo="write-block" class="description">
<div>
Write block, save the current block to a file.
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>ctrl</span><span>f2</span></td>
<td data-demo="read-block" class="description">
<div>
Read block, insert or overwrite data with contents from a file. Use
<span class="inline key">Ins</span> to toggle insert or overwrite
mode.
<div class="note">
The block is inserted at the current cursor location, so
position it at the start of the block with <span class="inline
key">[</span> if necessary.
</div>
<div class="keywords">
Include, Source, Incbin, Load, Insert
</div>
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>alt</span><span>f2</span></td>
<td data-demo="fill-block edit-code" class="description">
<div>
Fill block, fill the selected block with a repeating pattern. This
is usually used with a single byte, e.g. <code>nop</code>, but you
can insert a pattern of any length.
<br/>
If you use this shortcut in code view without an active block, the
current instruction will be <code>nop</code>ped, this is handy if
you want to eliminate an unwanted <code>call</code>.
<div class="keywords">
Replace, Fill, Initialize, Pattern, Nop
</div>
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>shift</span><span>f2</span></td>
<td data-demo="delete-block" class="description">
<div>
Delete marked block, the block is removed and the file truncated.
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>shift</span><span>f5</span></td>
<td data-demo="copy-block" class="description">
<div>
Copy marked block, this duplicates the active block at the current
cursor position. This operation can use insert or overwrite mode,
use <span class="inline key">Ins</span> to toggle it.
</div>
</td>
</tr>
<tr data-tags="block hex code">
<td class="shortcut"><span>shift</span><span>f6</span></td>
<td data-demo="move-block" class="description">
<div>
Move marked block, this is a copy and delete operation in one.
This operation can use insert or overwrite mode, use <span
class="inline key">Ins</span> to toggle it.
</div>
</td>
</tr>
<tr data-tags="text hex code navigate">
<td class="shortcut"><span>+</span></td>
<td data-demo="bookmark-state" class="description">
<div>
Save the current location to the bookmarks stack. Bookmarks
are quick and easy ways to jump around and explore, but only
a limited number are available.
<div class="note">
Hiew can only save 8 bookmarks. If you need more than that you
should use comments instead with <span class="inline
key">;</span>. You can add an unlimited number of comments, which
are added to the Names window. You can also name a location with
<span class="inline key">Shift</span> <span class="inline
key">F12</span>.
</div>
<div class="note">
Each view (hex, text, code) has it's own bookmark stack. Changing
view will not discard bookmarks.
</span>
</div>
</div>
</td>
</tr>
<tr data-tags="text hex code navigate">
<td class="shortcut"><span>-</span></td>
<td data-demo="bookmark-state" class="description">
<div>
Restore the last bookmarks state. The last state is indicated
by a diamond symbol in the bookmark indicator. See also <span
class="inline key">BkSp</span> and <span class="inline
key">0</span>.
</div>
</td>
</tr>
<tr data-tags="text hex code navigate">
<td class="shortcut"><span>alt</span><span>-</span></td>
<td data-demo="state-indicator" class="description">
<div>
Delete current bookmark, the current bookmark is indicated
by a diamond symbol in the bookmark indicator.
</div>
</td>
</tr>
<tr data-tags="text hex code navigate">
<td class="shortcut"><span>alt</span><span>0</span></td>
<td data-demo="bookmark-state" class="description">
<div>
Clear all bookmarks.
</div>
</td>
</tr>
<tr data-tags="text hex code navigate">
<td class="shortcut"><span>bksp</span></td>
<td data-demo="backspace" class="description">
<div>
Return to the previous location. For example, if you use <span
class="inline key">F5</span> to jump to an offset and change your
mind, use this to return quickly.
<br/>
This is also useful if you want to follow a <code>call</code> or
<code>jmp</code> in code view, then want to return. Following
branches uses the number keys in code view, see e.g. <span
class="inline key">1</span>, <span class="inline key">2</span>, etc.
<br/>
For following offsets or references, see e.g. <span
class="inline key">F6</span>, <span class="inline
key">Shift</span><span class="inline key">F9</span>, <span
class="inline key">Shift</span><span class="inline key">F10</span>,
<span class="inline key">Shift</span><span class="inline
key">F11</span>, and others.
</div>
</td>
</tr>
<tr data-tags="text hex code navigate">
<td class="shortcut">
<span>Alt</span><span>1</span><br/><br/><br/>
<span>Alt</span><span>2</span><br/><br/><br/>
<span>Alt</span><span>3</span><br/><br/><br/>
<span>Alt</span><span>4</span><br/><br/><br/>
<span>Alt</span><span>5</span><br/><br/><br/>
<span>Alt</span><span>6</span><br/><br/><br/>
<span>Alt</span><span>7</span><br/><br/><br/>
<span>Alt</span><span>8</span><br/><br/><br/>
</td>
<td data-demo="state-indicator" class="description">
<div>
Restore a saved bookmark by number. Bookmarks are saved with <span
class="inline key">+</span>.
</div>
</td>
</tr>
<tr data-tags="text hex code">
<td class="shortcut"><span>ctrl</span><span>.</span></td>
<td data-demo="record-macro" class="description">
<div>
Start or stop recording a macro. An 'R' is displayed in the title
bar, and all actions are recorded. Macros can be saved, loaded,
organized, played and configured from the macro manager, <span
class="inline key">Ctrl</span><span class="inline key">-</span>.
</div>
</td>
</tr>
<tr data-tags="text hex code">
<td class="shortcut">
<span>ctrl</span><span>0</span><br/><br/><br/>
<span>ctrl</span><span>1</span><br/><br/><br/>
<span>ctrl</span><span>2</span><br/><br/><br/>
<span>ctrl</span><span>3</span><br/><br/><br/>
<span>ctrl</span><span>4</span><br/><br/><br/>
<span>ctrl</span><span>5</span><br/><br/><br/>
<span>ctrl</span><span>6</span><br/><br/><br/>
<span>ctrl</span><span>7</span><br/><br/><br/>
<span>ctrl</span><span>8</span><br/><br/><br/>
</td>
<td class="description">
<div>
Play a saved macro by number. Macros can be saved, loaded,
organized, played and configured from the macro manager, <span
class="inline key">Ctrl</span><span class="inline key">-</span>.
</div>
</td>
</tr>
<!-- Hex View -->
<tr data-tags="hex code text">
<td class="shortcut"><span>Enter</span></td>
<td data-demo="mode-switch" class="description">
<div>
Switch to Hex, Code, or Text mode. You can safely switch modes
without losing any context. I'm used to quickly switching through
modes if I'm not sure what the data I'm looking at is.
<br/>
See also, <span class="inline key">F4</span>.
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>Ctrl</span><span>End</span></td>
<td data-demo="read-block" class="description">
<div>
Move the cursor to the end of the file.
<br/>
See also, <span class="inline key">Ctrl</span><span class="inline key">Home</span>.
</br>
<div class="note">
Here is an example workflow, I wanted to replace the last few bytes of a file with
another file...
<p>
<ol>
<li>
First move to the end of the file,
<span class="inline key">Ctrl</span><span class="inline key">End</span>.
</li>
<li>Start a new selection with <span class="inline key">*</span>.</li>
<li>
Move backwards, or enter a relative number of bytes with
<span class="inline key">F5</span>.
</br>
For example, to move backwards 123 bytes use
<span class="inline key">F5</span>
-123t
<span class="inline key">Enter</span>.
</br>
The 't' suffix means decimal, the default input base is hex.
</li>
<li>End the slection with <span class="inline key">*</span>.</li>
<li>
Make sure you're in overwrite mode, hit
<span class="inline key">Insert</span> to toggle.
</li>
<li>
Press <span class="inline key">Ctrl</span><span class="inline key">F2</span>
to open the ReadBlk dialog, you will be prompted to enter the
filename and other parameters.
</li>
</ol>
</p>
<p>
What should you do if the section you're replacing and the new file are different sizes?
<ul>
<li>
If you wanted to initialize the selection first
because the new file is smaller, just use
<span class="inline key">Alt</span><span class="inline key">F2</span>.
</li>
<li>
If you wanted to shrink or grow the selection, delete it with
<span class="inline key">Shift</span><span class="inline key">F2</span>
and then switch to insert mode with <span class="inline key">Insert</span>.
</li>
<li>
The default settings will simply truncate the new file and warn you. That
means unused parts of the new file will be unread, and old bytes will
be left as they were.
</li>
</ul>
</p>
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>Ctrl</span><span>Home</span></td>
<td class="description">
<div>
Move the cursor to the start of the file.
<br/>
See also, <span class="inline key">Ctrl</span><span class="inline key">End</span>.
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>Esc</span></td>
<td data-demo="exit-hiew" class="description">
<div>
In hex, code or text mode, <span class="inline key">Esc</span> will
exit hiew without updating the timestamp of the file. If you do
want to update the timestamp, use <span class="inline key">F10</span>.
<div class="note">
The <span class="inline key">Esc</span> key usually cancels or
exits the current mode, it only exits Hiew if there is no other
operation to cancel.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>Tab</span></td>
<td data-demo="next-file" class="description">
<div>
Open the next file from file history. From within Hiew, you can
open a new file with <span class="inline key">F9</span>, then
quickly switch between open files with <span class="inline
key">Tab</span>. This is the equivalent of <code>:tabnew</code>
then <code>:tabnext</code> in vim, or buffers in emacs.
<div class="note">
Use the file history manager to manage open files, <span
class="inline key">Ctrl</span><span class="inline key">BkSp</span>.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut">
<span>Ctrl</span><span>F11</span><br/><br/><br/>
<span>Ctrl</span><span>F12</span><br/><br/><br/>
</td>
<td class="description">
<div>
Open the previous/next file in command line arguments.
<div class="note">
Also works when used with a wildcard parameter like <code>*.exe</code>.
</div>
<div class="note">
Even more useful when opened with a specific opening parameter such as
<code>/oc=oep</code> for example, which directly show disassembly
at the entry point of every file in the command line.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>alt</span><span>b</span></td>
<td class="description">
<div>
Enable or disable beeps.
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>alt</span><span>p</span></td>
<td data-demo="screenshot" class="description">
<div>
Save a (text) screenshot of the current screen for future
reference. The screen can be saved to a file, or to the clipboard.
<div class="note">
The <span class="inline key">Shift</span> <span class="inline key">F4</span>
Print Block command does the same with the currently selected block,
which can be as small or as big as needed.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>alt</span><span>=</span></td>
<td data-demo="calculator" class="description">
<div>
Start calculator. The calculator is a 64bit programming calculator,
supports the standard C logical, bitwise, and comparison operators.
<br/>
You can enter numbers using C notation, or masm-like suffixes
(0fffh), octal, binary, decimal and hex are supported.
<br/>
The most useful feature is reading data from the cursor to use in
calculations, to do this use <code>@</code> followed by a type
code.
<br/>
For example, to multiply the QWORD under the cursor by two, use
<code>@Q*2</code>.
<br/>
The calculator remembers it's state, so it's safe to close it and
look around, then return to it when you need to.
</br>
<div class="note">
The calculator is the best way to see what a value is
in other bases, simply open the calculator and type
<code>@D</code><span class="inline key">Enter</span> to see the
<code>DWORD</code> under the cursor in binary, hex and decimal.
</div>
<table>
<tr><th>Operator</th><th>Meaning</th></tr>
<tr><td>+</td><td>Sum</td></tr>
<tr><td>-</td><td>Difference</td></tr>
<tr><td>*</td><td>Product</td></tr>
<tr><td>/</td><td>Quotient</td></tr>
<tr><td>%</td><td>Remainder</td></tr>
<tr><td>~</td><td>Bitwise Not</td></tr>
<tr><td>&</td><td>Bitwise And</td></tr>
<tr><td>^</td><td>Bitwise Xor</td></tr>
<tr><td>|</td><td>Bitwise Or</td></tr>
<tr><td>!</td><td>Logical Not</td></tr>
<tr><td>&&</td><td>Logical And</td></tr>
<tr><td>||</td><td>Logical Or</td></tr>
<tr><td><</td><td>Less than</td></tr>
<tr><td>></td><td>Greater than</td></tr>
<tr><td>>=</td><td>Greater than or Equal</td></tr>
<tr><td><=</td><td>Less than or Equal</td></tr>
<tr><td><<</td><td>Shift Left</td></tr>
<tr><td>>></td><td>Shift Right</td></tr>
<tr><td>==</td><td>Equal</td></tr>
<tr><td>!=</td><td>Not Equal</td></tr>
</table>
</br>
<table>
<tr><th>Prefix / Suffix</th><th>Base</th></tr>
<tr><td>0..</td><td>octal</td></tr>
<tr><td>0x..</td><td>hexadecimal</td></tr>
<tr><td>..i</td><td>binary</td></tr>
<tr><td>..o</td><td>octal</td></tr>
<tr><td>..t</td><td>decimal</td></tr>
<tr><td>..h</td><td>hex</td></tr>
</table>
</br>
<table>
<tr><th>@code</th><th>Meaning</th></tr>
<tr><td>@b</td><td>signed char</td></tr>
<tr><td>@B</td><td>unsigned char</td></tr>
<tr><td>@w</td><td>signed short</td></tr>
<tr><td>@W</td><td>unsigned short</td></tr>
<tr><td>@d</td><td>signed long</td></tr>
<tr><td>@D</td><td>unsigned long</td></tr>
<tr><td>@q</td><td>signed long long</td></tr>
<tr><td>@Q</td><td>unsigned long long</td></tr>
<tr><td>@o</td><td>local offset</td></tr>
<tr><td>@O</td><td>global offset</td></tr>
</table>
<div class="note">
As far as I'm aware there is no way to use the <code>@</code>
syntax in anything other than little endian byte order. If you need
big endian i.e. network byte order, then you will have to shift the
bytes around with <code><<</code> and <code>|</code>.
If you need that a lot, make a macro with <span class="inline
key">Ctrl</span><span class="inline key">.</span>.
</div>
<div class="note">
The default input base is hex, this won't be surprising if you've
used windbg, but might be surprising if you're used to gdb. Append
a <code>t</code> to decimal numbers.
</div>
<div class="note">
Use the <span class="inline key">Up</span>/<span class="inline key">Down</span>
keys to move the calculator around.
</div>
</div>
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>ctrl</span><span>alt</span></td>
<td class="description">
<div>
Show some information about the current file, hiew, and the system.
Includes full path, file size, free memory, the last error message
displayed, and so on.
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>ctrl</span><span>BkSp</span></td>
<td data-demo="file-history" class="description">
<div>
Shows a list of all opened files, and allows you to switch between
them, or close them.
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>ctrl</span><span>enter</span></td>
<td data-demo="search-next" class="description">
<div>
If a previous search exists, find the next match. If you don't have
a previous search, hiew will prompt you for one.
See also <span class="inline key">F7</span>.
<div class="note">
If you want to change the string encoding (e.g. unicode), see <span
class="inline key">Alt</span><span class="inline key">F8</span>.
</div>
<div class="note">
<span
class="inline key">Shift</span><span class="inline key">F7</span> does the same thing.
</div>
<div class="note">
<span
class="inline key">Alt</span><span class="inline key">F7</span> changes the next search
direction. It displays the direction in the status.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code">
<td class="shortcut"><span>;</span></td>
<td data-demo="add-comment add-code-comment" class="description">
<div>
<p>
Enter a comment for the current instruction or location. Comments
are displayed when the cursor is over the commented location. If
you to search, browse or go to a previous comment, use the Names
window, <span class="inline key">F12</span>.
</p>
<p>
Comments can be saved and loaded between sessions, or imported from
plain text files. The format for importing or exporting from text
is simply <code>offset *comment</code>.
Offset can be any hiew offset format, see <span class="inline
key">F5</span>. The <code>*</code> is required.
</p>
<div class="note">
A location can have a name and a comment.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code">
<td class="shortcut"><span>F3</span></td>
<td data-demo="edit-hex edit-code" class="description">
<div>
<p>
Enter edit mode. The cursor changes to a caret and the bookmark
indicator displays "EDITMODE".
</p>
<p>
To exit from editmode, press <span class="inline key">Esc</span> to
exit and discard your changes, or <span class="inline
key">F9</span> to exit and save them.
</p>
<p>
In hex mode, use <span class="inline key">Tab</span> to switch
between hex and character input. In code mode, <span class="inline
key">Tab</span> switches between opcodes (hex) and assembler mode.
</p>
<div class="note">
The default cursor is a block █, and the edit cursor is a
caret |.
</div>
<div class="note">
In hex mode, you can choose what character set to use, you don't
have to manually enter NULs for UTF-16 strings! Use the translation
table, which is <span class="inline key">Alt</span><span
class="inline key">F8</span>.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>F4</span></td>
<td data-demo="select-mode" class="description">
<div>
Switch directly to Hex, Code, or Text mode by selecting the mode you
want from a menu. See also, <span class="inline key">Enter</span>.
</div>
</td>
</tr>
<tr data-tags="hex code text navigate">
<td class="shortcut"><span>F5</span></td>
<td data-demo="goto" class="description">
<div>
<p>
Goto offset. You can enter a relative offset, absolute offset, or
virtual address.
</p>
<div class="note">
The default input base is hexadecimal. If you want decimal, use the
<code>t</code> suffix, e.g. <code>189t</code>. See the notes on
the calculator for more number format information, <span
class="inline key">Alt</span><span class="inline key">=</span>.
</div>
<p>
<ul>
<li>To enter an offset relative to the current position, use
<code>+offset</code> or <code>-offset</code>.</li>
<li>To enter an absolute offset, use <code>offset</code>.
<li>To enter a virtual address, use <code>.address</code>.
</ul>
</p>
<div class="note">
If you're navigating around a file, you probably want something
like <span class="inline key">Shift</span><span class="inline
key">F9</span> to follow the offset under the cursor, there are
many variants of this operation.
</div>
<div class="note">
Use <span class="inline key">PgDn</span> to show the entry history.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code navigate">
<td class="shortcut"><span>F6</span></td>
<td data-demo="datref" class="description">
<div>
<p>
Find code references to this location, use <span class="inline
key">Ctrl</span><span class="inline key">F6</span> to find the next
match and <span class="inline key">BkSp</span> to go back.
</p>
<p>
This is similar to xrefs in IDA, it will find the next location
that <code>call</code>s or <code>jmp</code>s to the current
address. Therefore, this is mostly useful when the cursor is on a
function entry point.
</p>
<div class="note">
This works well for quickly navigating, but use IDA if you need
this to be reliable.
</div>
<div class="note">
If you want to find all references to an import, select the import
from the import view, <span class="inline key">F8</span><span
class="inline key">F7</span>, then choose one with <span
class="inline key">Enter</span>, then keep pressing <span
class="inline key">Ctrl</span><span class="inline key">Enter</span>
to cycle through them. You can also filter by DLL, ordinal, and so
on.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code text navigate block">
<td class="shortcut"><span>f7</span></td>
<td data-demo="search-next" class="description">
<div>
<p>
Search for a string, instruction, or sequence of bytes. To switch
between string and hex entry, use <span class="inline
key">Tab</span>. <span class="inline key">Esc</span> will cancel
the search.
</br>
To repeat the last search, use <span class="inline
key">Ctrl</span><span class="inline key">Enter</span>.
</p>
<p>
While in the search dialog, you can select:
</p>
<ul>
<li><span class="inline key">F2</span>Search direction (backwards/forwards).</li>
<li><span class="inline key">F4</span>Search scope (file, or active block).</li>
<li><span class="inline key">F6</span>Toggle UTF-16 Even/Odd offset.</li>
<li><span class="inline key">F7</span>Call assembler to search for an instruction.</li>
</ul>
<div class="note">
You can't toggle between unicode/ascii searches from within the search
dialog, do that first with <span class="inline key">Alt</span><span
class="inline key">F8</span>.
</div>
<div class="note">
If you type more than 3 non-Hex characters in the Hex entry (which is the default one),
it will automagically switch to ASCII and remember what you typed so far.
</div>
<div class="note">
You can type single-char wildcards in your search with
<span class="inline key">Alt</span><span class="inline key">?</span>.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code exe">
<td class="shortcut"><span>f8</span></td>
<td data-demo="exe-headers" class="description">
<div>
<p>
View and edit PE, ELF, Mach-o etc headers. Hiew supports most
common EXE formats. When applicable, many tables can be browsed and
edited with <span class="inline key">F3</span>. Some of the common
tables are, imports <span class="inline key">F7</span>,
exports <span class="inline key">F9</span>, sections <span
class="inline key">F6</span>, and so on.
</p>
<p>
If you want to go to the entry point, the quickest way is <span
class="inline key">F8</span><span class="inline key">F5</span>.
</p>
<div class="note">
If you are not editing an executable file, then this view will
show some minimal com header.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code">
<td class="shortcut"><span>shift</span><span>f3</span></td>
<td data-demo="insert-bytes" class="description">
<div>
<p>
Insert bytes at the current position. The file is extended and
the number of bytes requested are inserted. The new bytes will
all be nuls.
</p>
<p>
Once the bytes are created them, you can edit them by pressing
<span class="inline key">F3</span>.
<div class="note">
If you want the new bytes to contain a value pattern, create the
bytes and then use <span class="inline
key">Alt</span><span class="inline key">F2</span>.
</div>
<div class="note">
If you want to insert the contents of a file instead, see <span
class="inline key">Ctrl</span><span class="inline key">F2</span>.
You don't need to create the bytes first, simply switch to insert
mode.
</div>
</div>
</td>
</tr>
<tr data-tags="hex code text">
<td class="shortcut"><span>Alt</span><span>F6</span></td>
<td data-demo="strings-view" class="description">
<div>
<p>
Displays a <code>strings</code> search dialog.
</p>
<p>
While in the strings dialog, you can use:
</p>
<ul>
<li>
<span
class="inline key">-</span>/<span class="inline key">+</span>
change the minimum size of listed strings.
</li>
<li>
<span
class="inline key">F6</span> cycles through strings type (ASCII, Odd and Even Unicode).
</li>
<li>
<span
class="inline key">F2</span> displays the offsets in front of the strings.
</li>
<li>
<span
class="inline key">F9</span> gives the option to filter strings.
</li>
</div>
</td>
</tr>
<tr data-tags="code navigate">
<td class="shortcut">
<span>1</span>
<span>2</span>
<span>3</span>
<span>4</span>
<span>5</span>
<span>6</span>
<span>7</span>
<span>8</span>
<span>9</span>
<span>A</span>
</td>
<td data-demo="code-refs" class="description">
<div>
<p>
Hiew automatically assigns a shortcut key to every branch in code
view, so you can easily follow <code>jmp</code>, <code>call</code>,
or other control flow instruction.
</p>
<p>The assigned shortcut is displayed next to the instruction with
an arrow indicating the direction of the branch, either ↑ or
↓.
</p>
<div class="note">
If you change your mind, press <span class="inline key">BkSp</span>
to return to the previous location.
</div>
</div>
</td>
</tr>
<tr data-tags="code">
<td class="shortcut">
<span>ctrl</span><span>f1</span>
</td>
<td data-demo="code-width" class="description">
<div>
<p>
Change the opcode size, cycle between 16bit, 32bit and 64bit
instruction set. This is useful if you're trying to extract
the shellcode from an exploit and hiew used the wrong instruction
set to decode it.
</p>
<p>
The current mode is displayed next to the bookmark indicator.
</p>
<div class="note">
If you want to change the architecture, not the size (e.g. ARM
instead of x86_64), use <span class="inline key">Shift</span><span
class="inline key">F1</span>.
</div>
</div>
</td>
</tr>
<tr data-tags="block hex code edit">
<td class="shortcut">
<span>alt</span><span>f3</span>
</td>
<td data-demo="crypt" class="description">
<div>
<p>
Opens the Crypt dialog.
It's an editor for a tiny subset of x86 to manipulate data.
Choose the data size it's operating with <span class="inline key">F2</span>.
</p>
<p>
The rules:
<ul>
<li>