</ul>          <li>Still some to be implemented (M$-OBJ, ARCH, LX)</ul>     <li>Code &amp; Data Analyser          <ul>- finds branch sources and destinations recursively <br>- finds procedure entries <br>- creates labels based on this information <br>- creates xref information <br>- allows to interactively analyse unexplored code (press 'c') <br>- allows to create/rename/delete labels (press 'n') <br>- allows to create/edit comments (press '#')</ul>     <li>Target systems          <ul>- DJGPP <br>- GNU/Linux <br>- FreeBSD <br>- Win32</ul>     </ol><div class="node"><p><hr><a name="Configuration-files"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Features">Features</a>,Up:&nbsp;<a rel="up" accesskey="u" href="#Features">Features</a></div><h3 class="unnumberedsec">Configuration files</h3><h4 class="unnumberedsubsec">Global configuration</h4><p>HT automatically creates a file to store its configuration. It is called <samp><span class="file">~/.htcfg2</span></samp> on Unices and <samp><span class="file">ht.cfg2</span></samp> (whereht.exe resides) on Windows. More specifically it contains HT's registryand the See <a href="#Global-history">Global history</a>.<h4 class="unnumberedsubsec">Per file configuration</h4><p>The analyser (for analysable files) will be stored in an extra file called<samp><span class="file">FILENAME.htcfg</span></samp>, where FILENAME is the analysed file. This file containsall information to restore the complete state of the analyser.<div class="node"><p><hr><a name="Clipboard"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Features">Features</a>,Up:&nbsp;<a rel="up" accesskey="u" href="#Features">Features</a></div><h3 class="unnumberedsec">Clipboard</h3><p>All open files and dialogs use the common clipboard, where allcopied and cut text or binary data is stored. Clipboard operations arenormally binary safe, that means you can copy some binary data out of afile and paste it into an input line. Exceptions are only the \0 character(binary null), it will be converted to a space in places where it would notmake sense (e.g. file open).   <p>Although the clipboard won't be saved between different HT sessions(ie. you will loose it when exiting HT), you can either save and load itor part of it manually (via Edit-&gt;paste into/copy from file) or rely onthe input lines' See <a href="#Global-history">history</a>, which is stored andretrieved from the config file automatically.<div class="node"><p><hr><a name="Global-history"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Features">Features</a>,Up:&nbsp;<a rel="up" accesskey="u" href="#Features">Features</a></div><h3 class="unnumberedsec">Global history</h3><p>HTs history system is global, which means that you can use it for all openfiles. Histories are also grouped by their context. I.e. file-related andregex-search-related dialogs have their own history (who would want toopen "[0-9][0-9a-z]+" anyway?).   <p>History entries are stored within the See <a href="#Configuration-files">Configuration files</a>, so theycan be reused when you relaunch.   <p>You can delete a history entry by pressing DEL inside the history popup.<div class="node"><p><hr><a name="Expression-evaluation"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Features">Features</a>,Up:&nbsp;<a rel="up" accesskey="u" href="#Features">Features</a></div><h3 class="unnumberedsec">Expression evaluation</h3><p>HT contains a very powerful expression evaluator which is used in all dialogswhere expressions are expected. These are mainly blockoperation, goto,search and of course evaluate itself (Edit-&gt;Evaluate).   <p>You can use all standard math operators (+ - / * % **), logical operators(! &amp;&amp; || ^^), relational operators (== != &lt; &gt; &lt;= &gt;=),bit operators (~ &amp; | ^), string operators (. for concatenation),parenthesis, the ternary operator (a?b:c), functions and symbols(both depending on context).   <p>The evaluator uses integer, string and float types depending on context. Youcan always convert a result via the <code>int()</code>, <code>string()</code> and <code>float()</code> functionsto appropriate type. Try Edit-&gt;Evaluate to see how it works<small class="dots">...</small><h4 class="unnumberedsubsec">Functions and symbols</h4><p>You can always use the standard built-in math (<code>round</code>, <code>sin</code>, <code>random</code>, etc.) andstring (<code>strcmp</code>, <code>strchr</code>, <code>sprintf</code>, etc.) functions, they work more or less like the correspondingC functions (actually they ARE more or less wrappers for them); see <samp><span class="file">eval/eval.y</span></samp> fordetails (sorry but a detailed help would get outdated rather soon).   <p>The symbol _ always refers to the last result.   <p>When using See <a href="#Block-operations">Block operations</a>, or searching you have somecontext depending functions and symbols; see these sections for explanation.<div class="node"><p><hr><a name="Block-operations"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Features">Features</a>,Up:&nbsp;<a rel="up" accesskey="u" href="#Features">Features</a></div><h3 class="unnumberedsec">Block operations</h3><p>Block operation (Blockop) is a very powerful tool to perform modificationson binary files. It is available in hex viewer only.   <p>Blockop takes four parameters: <var>start</var>, <var>end</var>, <var>mode</var> and<var>expression</var>. Blockop works as follows:     <ul><li>START: Start at the offset specified by <var>start</var><li>REPEAT: Evaluate <var>expression</var> and store n bytes (1 - byte, 2 - word,4 - dword, variable - string) at the current offset. Increment current offsetby n. Stop if <var>end</var> has been reached. </ul><p class="noindent">Special variables/functions that can be used in <var>expression</var>:     <dl><dt><code>readbyte(ofs)</code><dd>read a byte from offset <var>ofs</var>, returns a number<br><dt><code>readstring(ofs, size)</code><dd>read <var>size</var> bytes from offset <var>ofs</var>, returns a string<br><dt><code>i</code><dd>contains the iteration count/index starting with 0<br><dt><code>o</code><dd>contains the current offset</dl><div class="node"><p><hr><a name="Search-and-its-different-modes"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Features">Features</a>,Up:&nbsp;<a rel="up" accesskey="u" href="#Features">Features</a></div><h3 class="unnumberedsec">Search and its different modes</h3><p>The search function is one of the most advanced functions of HT. It is invoked through F7, Shift-F7 continues a search from cursor. Depending on context (ie. file type and mode) the following modes are enabled:<h4 class="unnumberedsubsec">bin: ASCII / Hex</h4><p>Enter an exact search string either via ascii characters or via hexadecimalinterpretation. This is the fastest search mode. You may specify acase-insensitive search.<h4 class="unnumberedsubsec">bin: eval str</h4><p>Enter an expression, it will be evaluated ONCE (difference to the 4th mode),and HT will then search for the result-string. This is pretty useful whensearching for intermixed text and control-chars/binary, e.g. <code>"hello world\n\0"</code><h4 class="unnumberedsubsec">display: regex</h4><p>As the prefix indicates, this search doesn't search in the binary file butin the display on screen. HT searches for a regular expression so this canbe very powerful, e.g. in PE/Image you can search for <code>(add|sub).+?,\ [78]$</code>. This will find all add or sub instructions with second parameter 7 or 8.<h4 class="unnumberedsubsec">expr nonzero</h4><p>This is the slowest but also most advanced search mode. Enter an expressionand the search stops if this expression evaluates to non-zero (it will beevaluated on every byte). In this mode there are two predefined symbolsand some functions: <var>i</var> is always the number of current iteration and<var>o</var> stands for the current offset in file. With the functions <code>readbyte(ofs)</code>and <code>readstring(ofs, size)</code> you access the file's content.   <p>It's easier to understand this with examples:     <ol type=1 start=1><li>Searching for patterns:          <ol type=a start=1><li>Enter <code>readbyte(o) == readbyte(o+1)</code><br>This will search for two equal bytes ("AA", "55", "!!", etc.). <li>Enter <code>(readbyte(o) == readbyte(o+1)+1) &amp;&amp; ((readbyte(o)==readbyte(o+2)+2)</code><br>This will search for three ascending bytes ("ABC", "123", etc).          </ol>     <li>Search with special functions:     <p>With HT you can easily detect the RSA key in the <samp><span class="file">ADVAPI32.DLL</span></samp>:Search for <code>entropy(readstring(o, 64)) &gt; 82</code> in expr!=0 mode, and you willfind it very quickly. How does it work? <code>readstring(o, 64)</code> reads a 64 byte stringfrom current offset and entropy calculates the entropy ("randomness") of a string (result is 0..100). So the search stops if a entropy greater than 82% (guessed value)is encountered, which normally indicates packed or encryted data.     <p>Note: the <code>entropy()</code> function is not the best of its kind, if you know of a betterone please let us know!        </ol><div class="node"><p><hr><a name="Command-line-options"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Features">Features</a>,Up:&nbsp;<a rel="up" accesskey="u" href="#Features">Features</a></div><h3 class="unnumberedsec">Command line options</h3><p><table summary=""><tr align="left"><td valign="top" width="10%"><code>--</code></td><td valign="top" width="20%"><p></td><td valign="top" width="70%">treat all additional parameters as file names<p><br></td></tr><tr align="left"><td valign="top" width="10%"><code>-v</code></td><td valign="top" width="20%"><code>--version</code></td><td valign="top" width="70%">show version and copyright on console<p><br></td></tr><tr align="left"><td valign="top" width="10%"><code>-h</code></td><td valign="top" width="20%"><code>--help</code></td><td valign="top" width="70%">show help<p><br></td></tr><tr align="left"><td valign="top" width="10%"><code>-t</code></td><td valign="top" width="20%"><code>--text</code></td><td valign="top" width="70%">load file(s) in text editor mode<p><br></td></tr><tr align="left"><td valign="top" width="10%"><code>-b</code></td><td valign="top" width="20%"><code>--bin</code></td><td valign="top" width="70%">load file(s) in hex editor mode<p><br></td></tr><tr align="left"><td valign="top" width="10%"><code>-a</code></td><td valign="top" width="20%"><code>--auto</code></td><td valign="top" width="70%">try to guess file type<br></td></tr></table><div class="node"><p><hr><a name="Where-to-download%3f"></a><a name="Where-to-download_003f"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Top">Top</a>,Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a></div><h3 class="unnumberedsec">Where to download?</h3><p class="noindent">The HT homepage is at<a href="http://hte.sourceforge.net">http://hte.sourceforge.net</a><p class="noindent">Downloads are available from the 'download' section. Please also take a look at<a href="http://sourceforge.net/projects/hte">http://sourceforge.net/projects/hte</a></body></html>