Hiew Documentation Project

Mark/unmark a block, this is like visual mode in Vim, it selects a contiguous region of bytes. Press * to start a block under cursor, then use the cursor keys to move to extend the block. Press * again to mark the end. Only one block can be active at a time.

You can use most navigation shortcuts while marking a block, here are some common examples:

• Mark to the end of the file, use * then Ctrl End
• Mark to the beginning of the file, use * then CtrlHome
• Mark until search result, use * then F7, or CtrlEnter for next match
• Mark from here until offset, use * then F5.

Assign a color to the active block. You can change the colors asssigned to different fields to help differentiate them quickly, this is useful to mark header fields. Note that the color persists even if you start a new block.

To move around in the color selection dialog, use ←, ↑, ↓, and →.

When you use colors, hiew will ask if you want to save them when you exit. Colors are saved to a .cmarkers file that is automatically reloaded when you start hiew.

Enter a comment for the current instruction or location. Comments are displayed when the cursor is over the commented location. If you to search, browse or go to a previous comment, use the Names window, F12.

Comments can be saved and loaded between sessions, or imported from plain text files. The format for importing or exporting from text is simply offset *comment. Offset can be any hiew offset format, see F5. The * is required.

Enter edit mode. The cursor changes to a caret and the bookmark indicator displays "EDITMODE".

To exit from editmode, press Esc to exit and discard your changes, or F9 to exit and save them.

In hex mode, use Tab to switch between hex and character input. In code mode, Tab switches between opcodes (hex) and assembler mode.

Goto offset. You can enter a relative offset, absolute offset, or virtual address.

• To enter an offset relative to the current position, use +offset or -offset.
• To enter an absolute offset, use offset.
• To enter a virtual address, use .address.

Find code references to this location, use CtrlF6 to find the next match and BkSp to go back.

This is similar to xrefs in IDA, it will find the next location that calls or jmps to the current address. Therefore, this is mostly useful when the cursor is on a function entry point.

Search for a string, instruction, or sequence of bytes. To switch between string and hex entry, use Tab. Esc will cancel the search.
To repeat the last search, use CtrlEnter.

While in the search dialog, you can select:

• F2Search direction (backwards/forwards).
• F4Search scope (file, or active block).
• F6Toggle UTF-16 Even/Odd offset.
• F7Call assembler to search for an instruction.

View and edit PE, ELF, Mach-o etc headers. Hiew supports most common EXE formats. When applicable, many tables can be browsed and edited with F3. Some of the common tables are, imports F7, exports F9, sections F6, and so on.

If you want to go to the entry point, the quickest way is F8F5.

Insert bytes at the current position. The file is extended and the number of bytes requested are inserted. The new bytes will all be nuls.

Once the bytes are created them, you can edit them by pressing F3.

Displays a strings search dialog.

While in the strings dialog, you can use:

• -/+ change the minimum size of listed strings.
• F6 cycles through strings type (ASCII, Odd and Even Unicode).
• F2 displays the offsets in front of the strings.
• F9 gives the option to filter strings.

Hiew automatically assigns a shortcut key to every branch in code view, so you can easily follow jmp, call, or other control flow instruction.

The assigned shortcut is displayed next to the instruction with an arrow indicating the direction of the branch, either ↑ or ↓.

Change the opcode size, cycle between 16bit, 32bit and 64bit instruction set. This is useful if you're trying to extract the shellcode from an exploit and hiew used the wrong instruction set to decode it.

The current mode is displayed next to the bookmark indicator.

Opens the Crypt dialog. It's an editor for a tiny subset of x86 to manipulate data. Choose the data size it's operating with F2.

The rules:

• At the start of each loop iteration, AL/AX/EAX/RAX gets the data under the current pointer.
• The code loops automatically at position 1 if it's not specified.
• At the end of the loop, the current value in AL/AX/EAX/RAX gets written at the pointerbefore it's incremented.

For example, this code in Byte mode will fill the current block with 00 01 02 03 04...:

1 mov al, cl
2 add cl, 1


Explanation:

1. CL's current value is copied to AL (CL is initially set to 0).
2. CL value is incremented.
3. The code is finished, so AL's value will be copied to the start of the block, the pointer will be incremented by one, and the crypt interpreter loops to 1, which will load the next data value to AL.

Open the HEM menu, which allows you to load Hiew plugins. HEMs can extend Hiew to add additional functionality and features.

Press F6 to see information about each module.

Open the Names window, which allows you to browse symbols and comments. You can name any location in a file by moving the cursor there and pressing ShiftF12.

Each location can have a name and a comment, to add comments see ;.

Hiew uses a binary format for saving names by default. If you want to import names from another tool, use F12 instead. This can parse a simple text format, here is an example:

.00000001`40000050  Symbol

$ nm a.out | awk '{print "."$1,$3}' | sed 's/$/\r/'

Resynchronize disassembly from the current offset. If the disassembly was desynchronized because of mixed code and data, force it to resynchronize by moving the offset under the cursor to the top.

This is useful if you are analyzing some code embedded in a file, but hiew didn't know where the code starts. Move the cursor to the start of the first instruction, then press /.