RE FORUM

[REVERSE ENGINEERING] => Tools => Topic started by: llAmElliK on June 29, 2005, 05:14:57 PM

Title: Hiew 7.xx
Post by: llAmElliK on June 29, 2005, 05:14:57 PM: <> (http://t4c.fbi.cz/tools/hiev710.zip)
Title: Hiew 7.xx
Post by: llAmElliK on June 29, 2005, 05:15:24 PM: Hiew 7.10 Retail YAG:
Title: Hiew 7.xx
Post by: llAmElliK on July 09, 2005, 11:58:52 PM: Hiew 7.21

FIX: found no code-reference for PE with code sections above one
FIX: crash with sav-file, if last file saved into unicode
FIX: PE export table without names do not processing
-show device name into list of flist change drive
-horizontal scroll for names import/export tables
-show unicode-string for links
-HEM SDK version 0.21: HEM keys line

http://webhost.kemtel.ru/~sen/files/hiew721.zip
Title: Hiew 7.xx
Post by: DARKER on July 12, 2005, 07:54:48 AM: Pre fanusikov HIEW:
Urcite ste si vsimli novej funkcionality HEM. Pre tych ktory by sa chceli dozvediet viac o HEM (na domovskej stranke vela toho nie je) :

HEM je plugin system pre HIEW. Je to DLL ktore si nahrava HIEW a vracia/nastavuje niektore hodnoty editora (mode, offset, block info, filename, ...) a vracia niektore hiew-interface funkcie ako Window(), Menu(), Read(), Write(),... Bude k tomu uvolnene aj SDK takze uzivatel si bude moct niektore veci prisposobit podla gusta ...

Verzia 7.2x a HEM SDK nie je zatial k dispoziici pre novych uzivatelov po nejaky cas. (Je to pravdepodobne urcity sposob karanteny, asi preto lebo poslednu verziu mu niekto z novych uzivatelov spristupnil pre verejnost)
Title: Hiew 7.xx
Post by: llAmElliK on July 29, 2005, 05:23:27 PM: HIEW 7.21 - :cool:
Title: Hiew 7.26
Post by: llAmElliK on January 21, 2006, 08:10:25 PM: Hiew 7.26
- FIX: targetJump is different for code and data
- FIX MZ: invalid far call/jmp target (since 7.11)
- FIX NE: crash for entry export without name
- FIX PE: more correct use file alignment - NE: segfix entry export

http://webhost.kemtel.ru/~sen/#hiew
Title: Hiew 7.26 retail
Post by: llAmElliK on January 30, 2006, 02:37:45 PM: Hiew 7.26 retail

- a je to jako temer vzdycky pokud se jedna o Hiew - je treba si dat pozor na skryte check-y (buhvi co tam je a buhvi co to je za retail) - cili predesle verze ktere jsou jiz odzkousene doporucuji zatim ponechat.

[Edit - no prave jsem cetl prvni "recenze" na exetools - je to presne jak jsem myslel - zrejmne lamersky udelany pouze zamenen vypocet KEY na ten pro AHTeam a prejmenovan .reg soubor. - no nic uvidite sami - llAmElliK]
Title: Posledny free Hiew
Post by: DARKER on March 05, 2006, 04:47:12 PM: Tak ma este napadlo, ze do tejto sekcie hodim poslednu verziu Hiew (6.11), ktora bola zadarmo a je plne funkcna ...
Title: Re: Hiew 7.xx
Post by: DARKER on April 01, 2006, 06:07:08 PM: Vysiel novy Hiew 7.27 ( 31 Mar 2006 )

- FIX: multimedia keyboards scancode ignore
- FIX: assemble far conditional jump to backward
- FIX: (Import) search for ordinal
- 'Goto offset' in text mode
- 'Goto offset' understands % at end (e.g. 50%, -10%, +5%)
- 'Strings' in text mode
- Code edit: Alt-F2: nops
- Strings: all types (ansi,unicode) at once
- Strings & resource strings: Filter as F9 (was: F10)

na plnu verziu si zase chvilu asi pockame ...
Title: Re: Hiew 7.xx
Post by: DARKER on September 26, 2006, 06:59:57 PM: 7.28 ( 26 Sep 2006 )
- FIX: PE overlay calculate from last physical section
- FIX: assembling 'rep strings'
- FIX(7.27): '%' in calculator as syntax error
- FIX: PE with section locate trick
- PE: show forwarded export
- Export: Stay cursor after sort/filter
- Type of StringCollections offset store depend on global/local
- "StringsShowOffset=" in ini-file
- "ColorCodeRet=" in ini-file
- HEM: SEH for load/call
- HEM FIX: memory leak
- HEM FIX: return current choise from Hiew_Menu() for Fn-press:

http://webhost.kemtel.ru/~sen/
Title: Re: Hiew 7.xx
Post by: bLaCk-bytE on October 02, 2006, 11:13:20 AM: Hiew 7.26 *FULL* + Plug-ins

Download : http://cracklab.ru/_dl2/centner/Hiew_v7.26.zip

427~kb
Title: Re: Hiew 7.xx
Post by: DARKER on October 02, 2006, 11:36:31 AM: Hore spomenuta verzia nie je az tak *FULL*, je to cra*knuta verzia od typka menom X-Wing Top Ace.
Pluginy su officialne a daju sa stiahnut z autorovej stranky:
http://webhost.kemtel.ru/~sen/hem.html + je tam teraz este jeden novy.

oproti ostatnym cra*knutym verziam kt su na webe ma vyhodu v tom ze je tam pridany oddelovat DWordov , a je tam aj fixnuty "bug" pri vybere bloku. V kazdom pripade je to asi najlepsia posledna "free" verzia na trhu :-)
Title: Re: Hiew 7.xx
Post by: Conflict on October 02, 2006, 08:20:25 PM: mam jeden dotazek. v cem je ten hiew dobrej? co ma jinyho nez jiny disassemblery a editory? me se ten dosovskej vzhled nak moc nelibi.
Title: Re: Hiew 7.xx
Post by: Master on October 02, 2006, 09:21:47 PM: Mezi hlavní výhody patří jeho rychlost.V nem se ti v?e disassembluje behem momentu i mnohem vět?í soubor.
Title: Re: Hiew 7.xx
Post by: DARKER on October 02, 2006, 10:57:47 PM: ... a hlavne je to old school tool, mlada generacia ho sice nema velmi v oblube pre jeho vzhlad ale je to velmi silny nastroj, ma fcie kt bezne editory nemaju ...
Title: Re: Hiew 7.xx
Post by: Conflict on October 03, 2006, 05:46:45 AM: ... napriklad?
Title: Re: Hiew 7.xx
Post by: DARKER on October 03, 2006, 08:23:15 AM: napr:
- vyhladavanie asm instrukcii:
chceme vyhladat sekvenciu
cmp nieco, 001
jne niekam

v ASM mode stlacime F7, znova F7 a zadame cmp *,001;jne *
program najde kazdu sekvenciu kodu ktora vyhovuje danej podmienke, nadupana vec v pripade ked robite na novych verziach toho isteho softu a author nemenil algo, staci si najist danu seqvenciu a "vua la"

- dost dobra fcia kt som casto vyuzival je posun offsetu - zmena base
nastavim sa na danu poziciu Ctrl+F5 a npisem si hodnotu o kt chcem zmenit offset, napr - 1000. Od teraz ked sa budem dotazovat na offset tak bude vsade posunuty o -1000. To plati aj pre skoky na offset (F5)

- v Edit mode podporuje XOR cryptovanie podla masky, nemusis si to robit niekde bokom hned to spravis v editore, je tam dokonca moznost naprogramovat si vlastnu Crypt rutinu

- Truncate file, viem mozno tato fcia je aj v ostatnych editorox ale tu je to podla mna najryxlejsie, nastavim sa na offset F3(edit) F10(truncate) a je to ..

- Disasm a Editor v jednom, velmi dobra vec je disasmeblovanie on the fly podla offsetu, nespracuje cely file ale iba kde skocis, dobra vec, v ASM edit mode ti pise hned z bytov asm instrukcie takze hned vidis co prepisujes, v novsej verzii mas fciu Instrukcia to NOP - postavis sa na instrukciu a on ju celu vyNOPuje, (uz ziadne manualne pisanie 90 :-)))

- skakanie na adresu (DWORD) pod cursorom (Shift + F10), tiez velmi dobra fcia kt som pomerne casto pouzival (pokial sa daky offset vyskytoval v dakom zhluku dat kt normalne nemaju zmyusel)

- v poslednej verzii moznost vytvarania vlastnych plugs, pre verejnost zatial nedostupne

- ja ho mam zaintegrovany priamo do Total Commandera, takze natiahnutie ktorehokolvek suboru do tohoto editoru je zalezitost zlomku sekundy (aj preto ze ma rychly start)

- je tam moznost vytvaranioa makier atd, atd

Hiew presiel velkymi zmenami a vylepseniami od svojho pociatku. Kto si pamata DOS casy a venoval sa vtedy RE - je zrejme ze HIEW bude pouzivat aj teraz. Mladsia generation ho odsudi hned kvoli svojmu vzhladu, ze ma DOSacke okno - aj ked aplikacia je full 32bit, len ma console look. Je to aj o zvyku, pokial si ho raz oblubite tak verte ze vas nesklame, chce si to proste precitat help co to vsetko dokaze. je tam toho dost, ja som vam vypisal iba moje najoblubenejsie fcie ktore pouzivam najcastejsie a ine editory ich proste nemaju alebo by to bolo mozne vykonat iba komplikovanejsie. niektore veci sice nie su popisane ani v helpe a prisiel som na ne iba nahodou, popripade ked som kecal z autorom tak mi niektore veci prezradil aj on sam ...
Title: Re: Hiew 7.xx
Post by: Conflict on October 03, 2006, 02:01:03 PM: no konecne taky zkusenosti, aby to z vas tady clovek lamal. help nectu.
Title: Re: Hiew 7.xx
Post by: DARKER on February 27, 2007, 08:05:13 PM: Vysiel novy Hiew 7.40 ( 22 Feb 2007 )

- 64bit dis/assembler x86-64
- 64bit crypt
- Crypt trace (F11)
- Pe32+ support for machine 8664h
- TLS callback for PE/PE32+ (F8-F11)
- fast search by pattern for assembler
- choice of the command under ambiguous assemblering (F4)
- hexedit: dword/qword edit under cursor (AltF3/AltF4)
- find next start from find length (was: next byte)
- remove XOR-string (was: F8 for edit)
Title: Re: Hiew 7.xx
Post by: eraser on February 28, 2007, 05:12:41 PM: Keď som sa začínal zoznamovať s RE, ale to je dávno a veľmi chabo :) tak som Hiew pou?íval. Ono je pravda, ?e CRT look dosť odrádza, no fintičky a nadupané funkcie zabezpečia, ?e starí borci ho budú pou?ívať i naďalej.

Inak, keby sa spísalo pár dobrých tutoriálov, potom by mo?no oslovil i mladú generáciu. To by sa zi?lo i mne.

A keby ho autor prerobil do GUI, tak si myslím, ?e by nemal konkurenciu.
Title: Re: Hiew 7.xx
Post by: Z!L0G80 on March 01, 2007, 02:35:04 PM: Quote from: eraser

A keby ho autor prerobil do GUI, tak si myslím, ?e by nemal konkurenciu.

hm tak to bych radsi zustal u starsi verze ,bo GUI suux!
Title: Re: Hiew 7.xx
Post by: FaTaLiTeR on March 04, 2007, 11:19:06 PM: suhlas... ludia pomaly zabudaju ze aj konzolove aplikacie su aplikacie!
Title: Re: Hiew 7.xx
Post by: NeptuN on March 06, 2007, 09:35:41 PM: presne tak, s GUI uz existuje plno programku, ale bez, tech je min, a priznejme si, uz jsme si nan zvykli, graficke prostredi by se mi nelibilo - bylo by takove ... obycejne. Skoda jen, ze wokna nemaj vychozi konzoli - tak jako unix :) Kez by bylo graficke prostredi jen nastavbou ... a ne jak ted :( a krom toho, pokud clovek hodnoti program jenom podle vzhledu ... nezaslouzi si pouzivat lepsi programky.
Title: Re: Hiew 7.xx
Post by: llAmElliK on March 06, 2007, 10:05:36 PM: Hahaaaaaaaaa - at zije stara dobra NUMEGA SoftICE..:)
Title: Re: Hiew 7.xx
Post by: Master on March 07, 2007, 08:32:29 AM: HIEW sem pouzil kdysi davno,kdyz sem zacinal.Porad uvazuju,ze bych zkusil tu novou verzi,ale nejak sem se k ni nedokopal.

Jinak se softice sem vzdycky zapasil jak o zivot :D Obcas sem ji dal,obcas ona me,kdyz mi zamrzl kompl :D
Title: Re: Hiew 7.xx
Post by: Z!L0G80 on March 07, 2007, 02:16:46 PM: hiew sem pouzil naposled na newbie crackme 20 a pohodicka .. :)
Title: Re: Hiew 7.xx
Post by: CZerezpiCZkin on March 07, 2007, 02:37:15 PM: Ja osobne mam celkom rad HIEW, nie preto, ze to je uz v podstate legenda (alebo RE dinosaurus? ;) ), ale preto, ze je to velmi rychly softik a jednoduchy na ovladanie.

2 llAmElliK:
SoftIce je sice velmi silny nastroj este aj v dnesnej dobe (hlavne pri potrebe debuggovania v roznych Ring modoch), ale nikdy som mu neprisiel na chut. Na moje gusto prilis zlozite ovladanie a dost problemov uz pri samotnej instalacii. Ten problem je vsak na mojej strane, debugger ako taky je bez debat velmi dobry.
Title: Re: Hiew 7.xx
Post by: eraser on March 07, 2007, 03:33:58 PM: Ja si zase neviem predstaviť debugging nejakej hry, ktorá nahodí grafický mód. V tomto som sa s OllyDbg nechytal. Preto som viac ne? polovičku no-cd crackov spravil naslepo, len?e pri be?ných technikách a s postupujúcimi skúsenosťami to nebol problém. Na komerčáky a nové ochrany by som sa v?ak u? vôbec nechytal, tam je SoftIce nutnosťou.
Title: Free replacement ?
Post by: DARKER on May 18, 2007, 12:05:37 PM: Celkom zaujimava nahrada za HIEW, dokonca to zacali updatovat po 3 rokoch :) Niektore funkcie su tam zaujimave ... Kuva len ked je uz clovek zvyknuty na urcite skratky :-)

http://biew.sourceforge.net/en/biew.html

Download v5.6.4 (2007-04-14 03:05)
http://downloads.sourceforge.net/biew/biew-564w.zip
Title: Re: Hiew 7.xx
Post by: Z!L0G80 on May 18, 2007, 12:48:58 PM: tak ja bych este pridal Ht Editor pouzivam ho pod mac os-x na macho binarky
http://hte.sourceforge.net/
Title: Re: Hiew 7.xx
Post by: FaTaLiTeR on May 24, 2007, 12:19:19 PM: Ja si radsej stlacim dajake Fx, ako by som mal chodit s mysou po menu, a hladat to tam... podla mna je to celkom dobry nastroj... Ale proste treba ho vediet aj ovladat, zatial co som pouzival tak bezne staci, napr. to xorovanie je celkom zaujimave, to sa da aj vyuzit...
Title: Hiew 7.45
Post by: DARKER on July 31, 2007, 06:39:20 AM: 7.45 ( 26 Jul 2007 )
- HEM SDK 0.35: SetErrorMsg(), GetStringDual()
- HemKeys.ini
- FIX: crash if the file 'hiew.key' is encrypted
- relative jump under cursor (hex mode/Shift-F11)
- CryptBlock in code mode too (Alt-F3)
Title: Re: Hiew 7.xx
Post by: MiLA on January 14, 2008, 11:48:54 AM: Hiew 7.47( 26 Sep 2007 )
- FIX: crash if hiew7.ini is empty or only-comment lines
- FIX: crash if print into existed file and press esc
- Code lighting
- HEM 0.40
- "SignImmediate = On/Off" in ini-file
- "SignDisplacement = On/Off" in ini-file
- OpcodeShowBytes up to 15
Title: Re: Hiew 7.xx
Post by: DARKER on February 07, 2008, 08:47:27 AM: 7.50 ( 29 Jan 2008 )
- name (ShiftF12/F12) for address in hex-, decode modes
- comment (;/F12) for address in hex-, decode modes
- HEM SDK 0.42
- "NamesAutosave = On/Off" in ini-file
- "DllNameInComment = On/Off" in ini-file
- show negative offset for basing
- FIX: input string history has reset for empty string adding
- FIX: PE image size calculation has incorrect for last section virtsize = 0
- FIX: PE overlay calculation more accurate
Title: Hiew CodePage 1250
Post by: DARKER on September 04, 2008, 07:04:51 AM: Popis:
Upravil som pre vas subor hiew.xlt pre HIEW. Pridava podporu konverzie code page 1250, takze teraz bude spravne zobrazovat diakritiku suborov napisanych v tejto kodovej stranke.

Pouzitie:
Zazalohovat original a prepisat stary hiew.xlt v Hiew adresary. Pouzite F8 v textovom mode alebo Alt-F8 v inych modoch.

Teoria:
Windows-1250 is a code page used under Microsoft Windows to represent texts in Central European and Eastern European languages that use Latin script, such as Polish, Czech, Slovak, Hungarian, Slovene, Croatian, Serbian (Latin script), Romanian and Albanian. It may also be used with the German language. German language texts encoded with Windows-1250 and Windows-1252 are identical.
Title: Xlat Table for Hiew (Added 1250 support)
Post by: DARKER on January 07, 2009, 08:46:43 PM: Popis:
Upravil som pre vas subor hiew.xlt pre HIEW. Pridava podporu konverzie code page 1250, takze teraz bude spravne zobrazovat diakritiku suborov napisanych v tejto kodovej stranke.

Pouzitie:
Zazalohovat original a prepisat stary hiew.xlt v Hiew adresary. Pouzite F8 v textovom mode alebo Alt-F8 v inych modoch.

Teoria:
Windows-1250 is a code page used under Microsoft Windows to represent texts in Central European and Eastern European languages that use Latin script, such as Polish, Czech, Slovak, Hungarian, Slovene, Croatian, Serbian (Latin script), Romanian and Albanian. It may also be used with the German language. German language texts encoded with Windows-1250 and Windows-1252 are identical.

UPDATE v1.1 (07.01.2009)
- Updated to latest version of hiew.xlt (before used template from 7.10)
Title: Re: Hiew 7.xx
Post by: DARKER on April 08, 2010, 11:21:10 AM: Virus kt nakazi Hiew, existuje aj nieco podobne ale pre IDA :-) Zdrojaky:

http://vx.netlux.org/src_view.php?file=hiewg.zip&view=HIEWG%2FHIEWG.ASM
Title: PyHiew
Post by: DARKER on August 26, 2010, 06:46:58 AM: PyHiew (open source project) is a Hiew external module (HEM) that allows users to write Python scripts that can interface with Hiew.

Code: [Select]
http://0xeb.wordpress.com/2010/08/21/introducing-pyhiew/