hexworks manual

Table of Contents

1General Information ............................................................................................................................................................................1Product Overview ...............................................................................................................................................................................6License Agreement ............................................................................................................................................................................7How to Contact the BreakPoint Software .................................................................................................................................8Comments and Suggestions ..........................................................................................................................................................9Technical Support and Questions ................................................................................................................................................

10Lost Registration Keys ...................................................................................................................................................................11Ordering and Activating Hex Workshop ..........................................................................................................................11How to Register ................................................................................................................................................................................12Upgrade and Maintenance Policy ............................................................................................................................................13Product Activation Wizard ...........................................................................................................................................................15Layout and Editing ...........................................................................................................................................................................15Hex Workshop Layout ...................................................................................................................................................................18Editor Window ...................................................................................................................................................................................21General Hex Editing .......................................................................................................................................................................22Toolbars ...............................................................................................................................................................................................25Status Bar ...........................................................................................................................................................................................27Output Results Window ................................................................................................................................................................28Drive (Sector) Editing ....................................................................................................................................................................29Tools and Features ..........................................................................................................................................................................29Bookmarks ..........................................................................................................................................................................................29Bookmark Overview ..................................................................................................................................................................31Adding a Bookmark ...................................................................................................................................................................32Editing a Bookmark ...................................................................................................................................................................35Opening and Saving Bookmarks ...........................................................................................................................................36Bookmark Properties ................................................................................................................................................................37Color Highlighting Overview .......................................................................................................................................................38Character Distributions ..................................................................................................................................................................40Checksum Generator .....................................................................................................................................................................43Color Mapping ...................................................................................................................................................................................43Color Mapping Overview ..........................................................................................................................................................44Adding a Color Map ...................................................................................................................................................................46Editing Color Maps ....................................................................................................................................................................49Opening and Saving Color Maps ...........................................................................................................................................50Compare ..............................................................................................................................................................................................50Compare Tool ..............................................................................................................................................................................51Compare Tool: Simple Compare ............................................................................................................................................52Compare Tool: Resynchronizing Compare ..........................................................................................................................53Advanced Compare Options ...................................................................................................................................................54Data Inspector ...................................................................................................................................................................................55Data Visualizer ..................................................................................................................................................................................58Expression Calc ...............................................................................................................................................................................60Data Operations ...............................................................................................................................................................................64Export and Clipboard Formats ...................................................................................................................................................67Find ........................................................................................................................................................................................................67Find Utility ....................................................................................................................................................................................69Find Results Window ................................................................................................................................................................71Replace Utility .............................................................................................................................................................................72Find Strings .................................................................................................................................................................................73Goto Utility ..........................................................................................................................................................................................

74Goto Toolbar Overview .................................................................................................................................................................75Structure Viewer ...............................................................................................................................................................................75Structure Viewer Overview ......................................................................................................................................................77Adding a Structure .....................................................................................................................................................................79Removing a Structure ...............................................................................................................................................................80Structure Libraries .....................................................................................................................................................................81Structure Definitions ..................................................................................................................................................................81Structure Definition Overview .................................................................................................................................................84Data Types .............................................................................................................................................................................87Enumerated Types .................................................................................................................................................................89Arrays .....................................................................................................................................................................................90Strings ....................................................................................................................................................................................91Bitfields ..................................................................................................................................................................................92Expressions ...........................................................................................................................................................................93Conditionals ...........................................................................................................................................................................95Functions ...............................................................................................................................................................................96Verification ..............................................................................................................................................................................98Library Settings ......................................................................................................................................................................

101Structure Settings ...............................................................................................................................................................103Reserved Words and Symbols ............................................................................................................................................104User Tools ........................................................................................................................................................................................105Expressions ........................................................................................................................................................................................105Expressions Overview ................................................................................................................................................................106Arithmetic Operations .................................................................................................................................................................107Bitwise Operations .......................................................................................................................................................................108Logical Operations .......................................................................................................................................................................109Arithmetic Functions ...................................................................................................................................................................110Document Functions ....................................................................................................................................................................112Conditionals and Loops ..............................................................................................................................................................114Variables ...........................................................................................................................................................................................116Expression Data Types ...............................................................................................................................................................117Operator Precedence ..................................................................................................................................................................118Preferences .........................................................................................................................................................................................118Display Options ..............................................................................................................................................................................118General Display Options Preferences ................................................................................................................................120Font & Filter Display Options Preferences .......................................................................................................................121Color Settings Display Options Preferences ....................................................................................................................124Color Priority Display Options Preferences ......................................................................................................................125Precision Display Options Preferences .............................................................................................................................126Theme Display Option Preferences ...................................................................................................................................128Character Filter Editor ...........................................................................................................................................................130Configuration ..................................................................................................................................................................................130General Configuration Preferences ....................................................................................................................................132Paths Configuration Preferences ........................................................................................................................................134Advanced Configuration Preferences ................................................................................................................................136Page Setup ...............................................................................................................................................................................137Keyboard Shortcuts ................................................................................................................................................................140Tool Options ....................................................................................................................................................................................140Bookmarks Tool Options Preferences ...............................................................................................................................141Char Distributions Tool Options Preferences ...................................................................................................................142Color Maps Tool Options Preferences ...............................................................................................................................143Compare Tool Options Preferences ...................................................................................................................................145Find Tool Options Preferences ............................................................................................................................................146Structure Viewer Tool Options Preferences ......................................................................................................................

147Import/Export ..................................................................................................................................................................................147C Source Import/Export Preferences .................................................................................................................................148HTML Import/Export Preferences .......................................................................................................................................149Intel Hex Code Import/Export Preferences .......................................................................................................................150Java Source Import/Export Preferences ...........................................................................................................................151Motorola S-Records Import/Export Preferences .............................................................................................................152RTF Import/Export Preferences ..........................................................................................................................................153Text Import/Export Preferences ...........................................................................................................................................154Mini Applications .............................................................................................................................................................................154Base Converter .............................................................................................................................................................................155Hex Calculator ...............................................................................................................................................................................156Reference .............................................................................................................................................................................................156Command Line Usage ................................................................................................................................................................158Data Types ......................................................................................................................................................................................159Understanding Byte Ordering ..................................................................................................................................................

The Hex Workshop Hex Editor by BreakPoint Software is a complete set of hexadecimal development tools forMicrosoft Windows 2000 and later. Hex Workshop integrates advanced binary editing and data interpretation andvisualization with the ease and flexibility of a modern word processor. With the Hex Workshop, you can edit, cut, copy,paste, insert, fill and delete binary data. You can also work with data in its native structure and data types using ourintegrated structure viewer and smart bookmarks. Data editing is quick and easy with our extensive features that allowyou to: jump to file or sector location, find or replace data, perform arithmetic, bitwise, and logical operations, binarycompare files, generate checksums and digests, view character distributions and export data to RTF or HTML forpublishing.

Hex Workshop includes a Sector Editor with disk imaging tools, a Base Converter for converting between hex, decimaland binary data types, a Hex Calculator supporting arithmetic and bitwise operations, an expression calculatorsupporting variables, conditionals, iteration and arithmetic and bitwise operations, and a data visualizer designed tohelp you visually identify patterns and interesting data from rendered images. Also included is our Data Inspector thatallows you to quickly edit and view data in decimal, floating point or time and date representations.

The Hex Workshop Hex Editor v6.6 or lower is available at a retail price of $89.95 (with volume and academic discountsand site licenses available). For more information, visit the Hex Workshop web site at http://www.hexworkshop.com orsend e-mail inquiries to [email protected].

Key Features:

Rich Feature SetHighly Customizable User InterfaceData Interpretation, Visualization and ParsingIntegrated Binary Comparison

Rich Feature SetHex Workshop features a broad and powerful set of features ranging from the ability to color map data sequences to theinterpretation of data though our integrated structure viewer and smart bookmarks. Our many features include: binarydata editing, importing and exporting blocks of data, searching for data by hex strings, text, Unicode, bitmasks, ordecimal values, viewing character distributions, sector editing, embedded data operations, binary file comparison, andimport/export capabilities.

Highly Customizable User InterfaceHex Workshop allows users to customize the look of the main editor window through user definable color settings for thedata and backgrounds and also through the ability to define how and what data will be displayed. Users can adjust thegrouping of hex data, the number of bytes display per line, offset lengths, offset bases, etc. Panels can be docked orpinned to maximize your editing workspace.

Integrated tools allow users to color code and tag data within the editor. For example, while viewing a structure in HexWorkshop, users are able to color graphically see the data ranges of structure members. All color coding is userdefinable.

Data Interpretation, Visualization and ParsingFour integrated tools are available to help parse and combine data within Hex Workshop.

1. The Structure Viewer applies C-style structures to data within the editor and allows the user to visually view andedit that data.

2. Smart Bookmarks allow users to add bookmarks to a file with functions, mathematical operations, and data types. Users can view and edit both the bookmark and the bookmark’s value.

3. Color maps allow users to apply color attributes to hex sequences or character ranges to help identify data within afile.

4. The Data Visualizer allows users to apply color palettes to their data to help identify patterns.

Integrated Binary ComparisonIntegrated resynchronizing binary comparisons allow users to compare binary files and review each difference. Startingoffsets, lengths, and compare parameters, and color renderings are all user-definable.

Technical SpecificationsSoftware Requirements:

Microsoft Windows 2000 or later

Product Overview

Hex Workshop v6.6 Product Overview

[email protected] 1 / 159

Administrative access for installation, registration, and sector editing

Hardware Requirements:

1 GHz x86 processor512 MB of system memory35 MB of available disk space

Full Feature SetBasic Editing

Cut, Copy, Paste, Insert, Fill and Delete HexASCII, DOS, EBCDIC, Macintosh, Window, Unicode or custom character set filtersMultilevel Undo and RedoDrag and Drop files onto Hex Workshop for quick editingHighlight hex and text sequences using Color MapsView modified bytes in user defined colorsSelect by offset/length or Select AllPaste Special (any format on the clipboard)Insert File a file or replace selection with the contexts of a fileSave a selection as a new fileSelect "Hex Edit" from Windows Right-Click Context Menu to view and edit filesContext sensitive helpView character distributions of a document or selectionCopy document or selection as: C Source Array, Java Source Array, Hex String, HTML, RTF, Text, Base64 orUUEncodingView offsets and lengths in hex or decimalIntegration with 3rd party applicationsUser customizable keyboard shortcut key sequences for common operations

Highly Customizable User Interface

Hex values can be grouped by 1, 2, 4, 8 or 16 bytesSpecify the bytes per line (1-128) or let Hex Workshop fit to window sizeUser-definable font and character mappingSpecify significant digits for floating point/double presentationEnable/Disable warnings and notification messagesWorkbook mode allows ability to switch between open documents quicklyUser-definable colors for the offset area, odd hex columns, even hex column, separators and text areaIntegrated color and border rectangle tagging for integration tools: Structure Viewer, Bookmarks, Data Inspector,Compare Results, Find Results and Color MapsImport/Export support for Preferences and display themes

Find

Search using Hex Strings (including wildcards)Search using Text Strings (ASCII, Unicode or either; match or ignore case)Search using BitmasksSearch using 8 bit, 16 bit, 32 bit or 64 bit signed/unsigned values (Big Endian, Little Endian or either)Search using floating point values (Big Endian, Little Endian or either)Search using double precision floating point values (Big Endian, Little Endian or either)Find All instances or instance by instanceSearch from top down or bottom upFind all strings within a document (ASCII, Uncode or Either)Find next or previous matching selectionFind next or previous not matching selectionFind across entire document, selection, or manually entered rangeApply bookmarks or structures based on Find Results

Replace

Find and replace by Hex Strings, Text, Strings or valuesPad text strings with nulls if the replacement string is shorter than the original string



Replace All instances or instance by instanceReplace from top down or bottom upReplace across entire document, selection, or manually entered range

Disk/Drive Sector Editing

Sector edit partitions or physical disksCopy sectors between disks and partitionsSave Sector range to a fileRestore Sector range from a file

Goto

Jump to specified addressJump to address relative to start of documentJump to address relative from end of documentJump to selected addressJump to current offset + selected addressJump to current offset - selected addressJump to last goto + selected addressJump to last goto - selected addressRepeat last jump (relative from current offset)Jump backwards (relative from current offset)

Printing

Print and Print PreviewHeader and footer are highly customizablePage Setup allows configuration of: font, header, footer, margins and bytes per line

Bookmarks

View and edit data rendered as natural data type (byte, word, half float, double, string, Unicode string, time_t,time64_t, structure reference, etc.)Integrated with Structure ViewerArray support (add multiple bookmarks with single definition)Calculations supported for address, length, and count (array) definitions: +, -, *, /, %, &, |, ^, <<, >>Functions supported for address, length, and count (array) definitions: UByteAt(), UShortAt(), ULongAt(),UQuadAt, byteflip16(), byteflip32(), and byteflip64()Constants supported for address, length, and count (array) definitions: last (bookmark), start (first bookmark),arrayindex, filelength

Structure Viewer

View and edit data in its natural structure and formFile format resembles C/C++ style structure definitionEmbedded, nested and reference other structures in your definitionsMany atomic data types supported: char, wchar, byte, ubyte, word, uword, long, ulong, longlong, half float, float,double, OLE Date/Time, DOSTIME, DOSDATE, FILETIME, time_t, and time64_tConditional structure elements (if and switch)Big Endian or Little Endian renderingAdd floating structures that re-renders on caret position changesAdd locked structures which stick to a document and offsetVerify expected byte sequences in a document against the structure definition's expected valuesIntegrated Functions enable automatic file format parsing and data manipulation

Compare

Use either a Simple or Resynchronizing binary compareResynchronizing Compare color codes the differencesAbility to specify Resync Window (how far to look for insert/delete) and match bytes (how many bytes must match)for resynchronizing comparesSet starting comparison offset independently for source and target filesSet comparison length independently for source and target files

Checksum Generation

Checksum either entire document or a selection8-bit, 16-bit, 32-bit, and 64-bit checksums (sum)CRC-16CRC-16/CCITTCRC-32Custom CRC-16Custom CRC-32MD2, MD4, MD5SHA1, SHA-224, SHA-256, SHA-384, SHA-512RIPEMD-128, RIPEMD-160, RIPEMD-256, RIPEMD-320TigerWhirlpoolView checksums and CRCs as 1s or 2s Complement

Data Visualizer

Includes 3 palettes and the ability to use user-defined palettes (Microsoft .PAL file format)Zoom visualizer width and height independentlyAutomatic scaling to match editor viewDisplays editor selectionAllows selection of data within the editor

Import/Export

Import and Export 8, 16 or 32 bit Intel Hex CodeImport and Export Motorola S19, S28 or S37 recordsExport document data as HTMLExport document data as RTFExport document data as C sourceExport document data as Java sourceExport document data as TextExport document data as a Hex stringExport document data as UUEncodingExport document data as Base64Export Structure Views, Compare Results, Find Results, Bookmark Views, Checksum Results, and CharacterDistributions as Tabbed Text, CSV, RTF, XML, and HTML.

Data Operations

Modify your data in-place using embedded operationsOperations can be applied to a selection or an entire documentOperations include: set floor value, set ceiling value, lower case, upper case, swap case, byte flip, block shift, ~,<<, >>, ~, |, &, +/-, +, -, *, /, %

Data Inspector

Interpret data at current caret position and edit that data as a more user-friendly sensible data typeBig Endian or Little Endian byte orderingView and edit 8 bit signed/unsigned valuesView and edit 16 bit signed/unsigned valuesView and edit 32 bit signed/unsigned valuesView and edit 64 bit signed/unsigned valuesView and edit half float (16 bit), floats (32 bit) and double precision floats (64 bit)View and edit DATE, DOS Date, DOS Time, FILETIME, time_t, and time64_t valuesView and edit binary representations

Expression Calc

Arithmetic operations: +, -, *, /, %, ()Logical operations: ==, !=, ||, &&, <, <=, >, >=Bitwise operations: &, |, ^, <<, >>, ~Arithmetic functions: min, max, byteflip16, byteflip32, byteflip64Document functions: get/set caret position and selection, add structure, get document size, getValueAt,

setValueAt, insertValueAtConditional statements: if, switchLooping constructs: for, whileCreation and manipulation of integer variables (signed/unsigned 8, 16, 32, and 64 bit variations)Big Endian or Little Endian byte orderingOption to automatically place results on clipboard

Plug-in API

C/C++ Plug-in APIAllow data manipulation of active documentCreate new documentsGenerate checksums and digestsCreate and manipulate smart bookmarksManipulate caret position and selectionProgress and user-cancel supportIntegration with output window for loggingAbility to auto-exec plug-ins on document open

Base Converter

Convert 8 bit, 16 bit, and 32 bit values between hex, decimal and binary

Hex Calculator

Hex/Decimal calculator supporting: +,-,*,/,|,&,^,<<,>>, ~

Copyright (c) 1995-2011 BreakPoint Software, Inc. All Right Reservedhttp://www.bpsoft.com

http://www.hexworkshop.com

Hex Workshop Copyright © 1995-2011, BreakPoint Software, Inc. All Rights Reserved.

License AgreementYou should carefully read the following terms and conditions before using this software.

DISCLAIMERUsers of Hex Workshop must accept this disclaimer of warranty: "Hex Workshop is supplied as is. BreakPoint Software,Inc. disclaims all warranties, expressed or implied, including, without limitation, the warranties of merchantability and offitness for any purpose. The author assumes no liability for damages, direct or consequential, which may result from theuse of Hex Workshop."

DISTRIBUTIONThe registered version of Hex Workshop cannot be distributed without the expressed written permission of BreakPointSoftware, Inc.

You may copy and distribute the unmodified demonstration version of this software in electronic form. You are prohibitedfrom charging for or distributing this software with other products (commercial or otherwise) without the expressedpermission of BreakPoint Software, Inc.

INTELLECTUAL PROPERTYThis program is owned by BreakPoint Software, Inc. and is protected by U.S. and international copyright laws. Violationof this copyright is a serious offense VIOLATION OF COPYRIGHT IS A SERIOUS OFFENSE.

DEMONSTRATION VERSIONYou have the non-exclusive right to use Hex Workshop for 30 days for the purpose of evaluation. After the 30 days trailperiod, you must purchase the registered version, or discontinue using the product by removing it completely from yourcomputer.

NO DISASSEMBLY OR DECRYPTIONYou may not disassemble, decompile or decrypt the Software without the expressed permission of BreakPointSoftware, Inc.

USER LICENSEYou may either use this program on 1) a single computer with multiple users or 2) multiple computers with the samesingle user. This program is the property of BreakPoint Software, Inc., and is protected by U.S. and internationalcopyright laws. VIOLATION OF THIS COPYRIGHT IS A SERIOUS OFFENSE, PUNISHABLE BY THE UNITEDSTATES GOVERNMENT.

License Agreement



Hex Workshop v6.6 License Agreement


You can find BreakPoint Software, Inc. and Hex Workshop online at:

http://www.bpsoft.com http://www.hexworkshop.com

From our web sites you can most up-to-date information on Hex Workshop, download evaluations of the latestBreakPoint Software products, and learn about our plans for future releases.

E-Mail Addresses:

[email protected]@[email protected]

For further information see Lost Registration Keys, Technical Support and Questions, and Comments and Suggestions.

How to Contact the BreakPoint Software



Hex Workshop v6.6 How to Contact the BreakPoint Software


We are continually planning for future software releases and welcome all feedback.

If you have comments on the current version, suggestions for future release, or suggestions for new products please donot hesitate to contact us via e-mail at [email protected].

Online forms are also available on our web site for bug reports and suggestions:

http://www.hexworkshop.com/support.

For additional information, see Contacting the BreakPoint Software .

Comments and Suggestions



Hex Workshop v6.6 Comments and Suggestions


Please visit the Hex Workshop support pages for common support issues and answers to frequently asked questions.

http://www.hexworkshop.com/support

Technical Support for Hex Workshop is also available by e-mail for registered users. If you require technical support orhave found a problem with Hex Workshop please submit an e-mail to [email protected]. Please be as descriptive aspossible and title the message appropriately. We make every possible effort to answer all inquiries and problemsreported in a timely manner.

Please specify the version information located in the About Box (i.e.: version 6.0.0.4132) and the operating system thatyou are using (i.e. Vista Business 64 bit).

For additional information, see Contacting the BreakPoint Software.

Technical Support and Questions



Hex Workshop v6.6 Technical Support and Questions


If you misplaced or lost your registration number, please visit:


We provide online forms to help users locate lost registration keys, download license files, and update their contact e-mail address online.

If you are unable to use the online tools, please e-mail [email protected] with the product name, approximate orderdate, name, company, address, phone number, and the e-mail address used when ordered.

Lost Registration Keys



Hex Workshop v6.6 Lost Registration Keys


Hex Workshop can be purchased for $89.95* or upgraded for $34.95* and includes 12 months of maintenance. Toorder, please visit:

http://www.hexworkshop.com/ordering/

After ordering, customers receive an registration key by e-mail. The registration key is used to unlock Hex Workshopand disable the evaluation period.

Unlocking an expired evaluationIf the Hex Workshop evaluation has expired, an "Unlock" or "Register" button is presented where customers can entertheir Name, E-mail address, and Registration Key to download a license. Alternatively, users can select a pre-downloaded license file from their file system.

Unlocking a non-expired evaluationIf an evaluation has not expired, customers may activate their license by pressing the "Register" button on the HexWorkshop About Box (Select "About Hex Workshop..." from the "Help" menu). Users have the option of entering theirName, E-mail address, and Registration key to download a license or select a pre-downloaded license file from their filesystem.

See Product Activation Wizard for more information on the activation process.

For the latest information on Hex Workshop, please visit our web sites:

http://www.bpsoft.com http://www.hexworkshop.com

How to Register



Hex Workshop v6.6 How to Register


BreakPoint Software customers are entitled to 12 months of maintenance upon purchase or upgrade of a product. Maintenance includes all major and minor upgrades release during the period.

Customers can extend their maintenance period at any time prior to its expiration for 20%* of the original purchaseprice. If a customer is outside their maintenance period, they must purchase an upgrade at a higher cost.

Customers can review their license information and maintenance expiration date in Hex Workshop About Box (Select"About Hex Workshop..." from the "Help" menu.

For more information, please visit:

http://www.hexworkshop.com/ordering

Upgrade and Maintenance Policy



Hex Workshop v6.6 Upgrade and Maintenance Policy


The Product Activation Wizard is used to unlock Hex Workshop or update the existing Hex Workshop License. Thewizard is started when users press the "Register" button from the Hex Workshop About Box (Select "About HexWorkshop..." from the "Help" menu) or by selecting the "Register" or "Unlock" button from an evaluation expirationnotice.

Like many software products, Hex Workshop requires a license file to operate beyond its evaluation period. TheActivation Wizard can download the license file directly from BreakPoint Software or customers can download thelicense file from our Web Site and install it using the Activation Wizard.

Select the first radio button, "Download your Hex Workshop License over the Internet", to automatically download alicense file.

Select the second radio button, "Select a Hex Workshop License from the File System", to select a pre-downloaded license file.

Automatically downloading the license file

Customers must enter their name, e-mail address, and registration key to download their license file. If the customerpurchased a single license, the e-mail address must match the e-mail address used when ordering. If the customerpurchased multiple licenses, the e-mail address domain must match the e-mail address used when ordering. In thisexample, the domain is "example.com".

By default, the Activation Wizard will use the http/https proxy settings configured for Internet Explorer. If you require aproxy server and Internet Explorer is not configured, please press the "Proxy Settings..." button to manually provisionyour http/https proxy server.

Proxy Settings Dialog:

Product Activation Wizard

Hex Workshop v6.6 Product Activation Wizard


Manually downloading the license file

The manual download process allows customers to select a license file from their file system. This may be required dueto firewalls and/or corporate IT policies. To obtain your license file from our web site, please visit:


Please visit our web site for common problems or e-mail [email protected] for assistance.



Hex Workshop v6.6 Product Activation Wizard


Hex Workshop includes 8 distinct components or window:

1. Tool Bar2. Data Visualizer3. Editor Window4. Data Inspector5. Expression Calc6. Structure View7. Results Window8. Status Bar

All window (except Editor Window) can be hidden/shown or moved around the editor. The tool component windows(Structure Viewer, Results Window, and Data Inspector) can be pinned to a Hex Workshop edge to the maximizeviewing size of other windows. Pinned Window enlarge when the mouse cursor is placed over them. Right clicking on the Data Visualizer, Data Inspector, Expression Calc, Structure Viewer, or Results Window includes theability to pin, hide/show, or dock the components within the Editor:

Hex Workshop Layout

Hex Workshop v6.6 Hex Workshop Layout


Tool BarThe Tool bar includes buttons for commonly used features and operations. It is organized as 8 separate Tool bars thatcan be reordered, show/hidden, floated outside the editor or docked on the edges of Hex Workshop.

See Toolbars for more information.

Data VisualizerThe Data Visualizer helps identify patterns with document data.

See Data Visualizer for additional information.

Editor WindowThe Editor allows users to edit files or sectors in Hex Workshop.

See Editor Window for information on the Editor Window.

Data InspectorThe Data Inspector allows users to quickly view and edit editor data as an atomic data type.

By default, the Keyboard Shortcut Ctrl+I will show and hide the Data Inspector.

See the Data Inspector for more information.

Expression CalcThe Expression Calc allow users to perform C style operations and document manipulation.

See Expression Calc for additional information.

Structure ViewerThe Structure Viewer allows users to apply C-Style structure definitions in the editor and view and edit data in its naturalstructured form.

By default, the Keyboard Shortcut Ctrl+T will show and hide the Structure Viewer.

See the Structure Viewer for more information.

Results WindowThe Results Window includes tabs for various Hex Workshop tools and operations:

By default, the Keyboard Shortcut Ctrl+W will show and hide the Results Window.

Compare ResultsDisplays the results of a Re-synchronizing compare operation.

See Compare Tool: Resynchronizing Compare for more information.

Checksum ResultsDisplays the results of a checksum/digest operations.

See Checksum Generator for more information.



Find ResultsDisplays the results of a Find Strings operation or a Search with the "Find All Instances" option selected.

See Find Strings or Find/Replace for more information.

BookmarksDisplay user-created smart bookmarks.

See Bookmarks for more information.

OutputDisplay Hex Workshop diagnostic information, errors, and warnings. The output window is mostly commonly used whencreating structure definitions to view errors.

For more information, please see the Output Results Window.

Status BarThe Status Bar displays context sensitive information for the current document and progress information.

See Status Bar for more information.





The Hex Workshop Editing Window includes 4 areas:

1. Offset Header2. Offset Area3. Hex Area4. Text Area

Offset HeaderThe Offset Header shows the address offset of each of the columns for the Hex Area and Text Area. When combinedwith the address from the Offset Area, users can quickly identify the address of a specific byte of data.

Caret Location HighlightThe Caret location is highlighted using the Offset Caret Highlight and shows the location of the editing caret. In theexample above, this is shown as blue on dark gray.

Mouse Location HighlightThe Mouse location is highlighted using the Offset Cursor Highlight and shows the location of the mouse cursor. In theexample above, this is shown as the default foreground color with a dark gray background.

Showing/Hiding the Offset HeaderThe offset header can be hidden through the General Display Options Preferences.

Clicking on Offset HeaderClicking on one of the offset labels adjust the caret position to that offset. Only the column position of the caret isadjusted -- not the row.

Adjusting Address WidthThe Address width (how many digits are displayed in the Offset Area) can be adjusted by dragging the separatorbetween the Offset Area and Hex Area to the left or right.

Editor Window

Hex Workshop v6.6 Editor Window


NOTE: Settings are only applied for the current document. See General Display Options Preferences to set the defaultused when opening new files.

Adjusting Group Byte ByThe Group Byte By width (how many bytes are grouped together in each column) can be adjusted by dragging theseparator between columns.


Adjusting Bytes Per RowThe Bytes Per Line (how many bytes are displayed per row) can be adjusted by dragging the separator between theHex Area and Text Area to the left or right.


Offset AreaThe Offset Area displays the offset for the current row in the editor. Right clicking on the offset area displays a popupcontext menu.

Switching between Hex and Decimal addressUsers can switch between Hex and Decimal address presentation using the Offset Area right-click popup context menuor the Environment Toolbar.

Setting the Starting OffsetUsers can adjust the starting offset (what is display in the offset area) by selecting "Starting Offset..." from the OffsetArea right-click context menu. The starting offset is used for display purposes and when exporting data as Intel HexCode and Motorola S-Records.

Setting the Offset/Address Width



Users can adjust the offset/address width by dragging the separator between the Offset Area and Hex Area or byselecting "Address Width" from the Offset Area right-click context menu.

Jumping to a specific OffsetClicking on an address in the Offset Area moves the caret position to that location. Alternatively, users can select"Goto..." from the Offset Area right-click context menu to invoke the Goto Tool.

Hex AreaThe Hex Area displays the users data in a tabular form where users can adjust the bytes per row and group byte bywidth.

Users can switch between the Hex and Text areas by clicking on each area or by pressing the Tab key.

For more information on editing files, please see General Hex Editing.

Text AreaThe Text area displays the text associate with the user's data. The text may be displayed using a character filter,unfiltered, or in Unicode.

Users can switch between the Hex and Text areas by clicking on each area or by pressing the Tab key.

For more information on editing files, please see General Hex Editing.

Caret FormsHex Workshop displays carets in the Hex Area and the Text area simultaneously. The Vertical Caret in the form of an "I"is the Active Caret. The horizontal caret in the form of an "_" is the Inactive Caret.

The Inactive Caret is shown to help correlate the editing position between the Hex Area and Text Area and does notimpact editing.





Hex Workshop includes a professional hex editor with the power and ease of a Word Processor allowing cut, copy,paste, insert, delete, undo, redo and more.

Hex/ASCII Editing:A file can be edited from either the Hex Area or Text Area. The cursor can be toggled between hex and ASCII with thetab key or hex/ASCII can be chosen by clicking the mouse in the particular region.

You can tell what area you are editing by looking at the caret shape. A vertical blinking caret (I) is displayed in the activearea and a solid underline caret (_) is displayed in the inactive area.

You can use the arrow keys to navigate around the document in either the hex or ASCII display. You will notice that the leftand right arrow keys will move one byte (2 hex digits) at a time in the hex display. Pressing the Ctrl+Left or Ctrl+Right willallow you to navigate within bytes (1 hex digit at a time).

Clipboard Functionality:Cut (Ctrl+X), Copy (Ctrl+C), and Paste (Ctrl+V) operate in a similar manner to other editors. Paste Special allows youchoose from and paste any of the standard Windows Clipboard formats currently available into a file.

Undo & RedoUndo (Ctrl+Z) and Redo (Ctrl+Y) allows you to reverse the most recent editing operation(s). The size of the undo buffer(which determines how many operations are saved) can be set in the General Configuration Preferences.

Inserting/FillingAutomated Inserting and Fill (Ctrl+Ins) allows a specified number of bytes to be inserted at the cursor position with anyhex fill value. If data is selected in the editor, Hex Workshop will fill the selection region with the specified hex fill value.

Deleting DataDeleting (Del) simply deletes the highlighted bytes.

Insert/Overwrite ModeNormal editing can be done in either insert or overwrite (OVR) mode. Insert mode with automatically insert hex valuesentered at the cursor position, while overwrite mode will overwrite existing bytes at the cursor position with hex valuesentered. The current mode is shown in the status bar and is toggled with the Insert key or by double clicking the "OVR" inthe status bar.

Insert FileThe contents of a file can be inserted into the document at the caret location by selecting "Insert File" from the "File"menu.

Select Block/Select All:A block of hex can be automatically selected at the cursor position using the Select Block feature and specifying eitherthe size of the block or the ending position. In either case the block starts at the cursor position. Select All (Ctrl+A)automatically selects the entire file.

File/Disk Properties:File/Disk Properties (Alt+Enter or Right Mouse Button) displays information on the current file or disk being edited.

Window Operations:Open windows can be tiled Horizontally (F2), Vertically (Alt+F2), or Cascaded (Ctrl+F2) from the Window Menu or usingkeycuts.

General Hex Editing



Hex Workshop v6.6 General Hex Editing


Toolbar buttonsFile Operations:

From left to right:

Open FileOpen Drive or SectorSave File or SectorPrint current documentOpen Preferences Dialog

Edit Operations:

From left to right:

CutCopyPastePaste Special

UndoRedo

Find/Goto:

FindFind PreviousFind NextReplace

Goto AddressQuick Goto Edit BarGoto PreviousGoto Next

Environment Settings:

Show addresses in decimalShow addresses in Hexadecimal

Assume Big Endian byte orderingAssume Little Endian byte ordering

Tools:

Data Operations drop-down

Compare FilesJump to next comparisonJump to previous comparison

Launch Checksum and Digest CalculatorAdd BookmarkAdd Color mapAdd StructureView Character Distribution

Launch Base ConverterLaunch Calculator

Character Filter:

Switch the character filter used to filter charactersin the text area of the editor

Drive Operations:

First SectorPrevious SectorNext SectorLast Sector

Toolbars

Hex Workshop v6.6 Toolbars


See Drive (Sector) Editing for more information.

Data Operations:

Byte FlipInverse BitsShift LeftShfit RightRotate LeftRotate RightBlock Shift LeftBlock Shift RightXORORAND

Change SignAddSubtractMultipleDivideMOD

Set Floor ValueSet Ceiling ValueMake upper caseMake lower caseSwap case

See Data Operations for more information.

Showing/Hiding toolbarsHex Workshop's toolbars can be shown and removed by selecting "Toolbars..." from the options menu or by right-clicking on any toolbar. Users can also drag toolbars to reorganize the toobar layout.

Selecting "Toolbars..." from the Options Menu

Right-clicking on a shown toolbar:



The Status Bar displays context sensitive information and status for the active document. It is divided into seven panes(from left to right):

1. Status Information2. Cursor Location3. Caret Location4. File Size or Selection Length5. Insert/Overwrite Mode (OVR)6. Document Modification Status (MOD)7. Read-Only/Write Status (READ)

Status InformationThe first status bar pane displays information for the current operation (or menu item). This area also display feedbackto the user during editing and in some cases displays a progress bar for length operations.

Cursor LocationThe second status bar pane displays the current mouse location in either hex or decimal depending on the hex/decimalenvironment setting. The mouse location is where the user's mouse cursor is located and updated on mousemovement.

The hex/decimal setting can be changed using the Environment Toolbar, by selecting "File Offset" from the "Options"menu, or by right-clicking on the address area within the editor.

Double-clicking the cursor location places the address on the clipboard.

Caret LocationThe third status bar pane displays the current caret location in either hex or decimal depending on the hex/decimalenvironment setting. The caret location is where the edit cursor is located within the active document and is updatedwhen the user clicks within the hex or text areas within the editor, uses the keyboard arrow keys to move the caret, orperforms and operation that changes the caret location.


Double-clicking the caret location places the address on the clipboard.

File Size or Selection LengthThe forth status bar pane contains either the file size in decimal or the current selection size in hex or decimal. If the useris editing a drive or disk, the file size is replaced with the sector size.


Double-clicking the file size or selection length places the address or length on the clipboard.

Insert/Overwrite Mode (OVR)The fifth status bar pane indicates whether the user is entering data in Insert or Overwrite mode. Black text indicatesenabled and grey text indicates disabled.

Double-clicking on the OVR toggles the input mode between Insert and Overwrite. Users can also press the Insert keyto toggle modes.

Document Modification Status (MOD)The sixth status bar pane indicates whether the current document has been modified and not yet saved. Black textindicates enabled (modified document) and grey text indicates disabled (not modifications)

Read-Only/Write Status (READ)The seventh status bar pane indicates whether the current document is read-only or editable. Black text indicatesenabled and grey text indicates disabled. Document can be opened read-only or the user may not have writepermissions for the file. Black text indicates enabled (Read-Only) and grey text indicates disabled (Editable).

Status Bar

Hex Workshop v6.6 Status Bar


If a file is opened using Direct File Editing (See Advanced Configuration Preferences), a "DIR" is displayed to indicateDirect File Editing Mode.



Hex Workshop v6.6 Status Bar


The Output Window is located on a tab the Results Window and displays Hex Workshop diagnostics information. Bydefault, the output window includes the last 16K of output information. Output Information ranges for Hex Workshopdiagnostics and debugging information to errors and warning found in user-defined structure definitions, color mapdefinitions, and bookmark collections.

In the example below, Hex Workshop is reporting an error parsing a unknown data type "DDWORD" on Line 207 of astructure definition.

Ouput LevelThe output level can be adjusted by selecting a new level in the drop-down box ("Info" is selected in the above example). Users must select a new output level prior to performing an operation to view more information. Output Levels includeDebug, Info, Warn, and Error.

Clear ResultsThe Red "X" button clears the Output Results Window.

Output Results Window



Hex Workshop v6.6 Output Results Window


In addition to editing files, Hex Workshop can also edit Drive (Disk) Sectors. By selecting "Open Drive" from under theDisk menu, clicking the open drive Toolbar button, or using the Ctrl+D keycut both Logical and Physical Drives can beedited under Windows 95, 98, NT, Windows 2000, XP, and Vista.

NOTE: You must run Hex Workshop under Administrator Mode to sector edit under Vista. This can be accomplished byright-clicking on the launch shortcut and selecting "Run as administrator".

Disk Editing Modes:Logical Drives are drives mounted by the operating system and are given drive letters like "A:", "C:", "D:", etc. HexWorkshop can edit local drives, some CD-ROM drives, most removable media and floppy drives. You must have properpermission to edit these drives on Windows NT.

Physical Drives are the drives installed in your computer and are labeled as 0x80 for the first hard disk, 0x81 for thesecond, etc. You should edit physical drives when the operating system cannot mount your logical drive or you need toview and/or modify partition tables or unallocated space.

Sector Editing:Disk Editing information is supplied to the user including sector number currently being edited and total number ofsectors on the disk in the title bar, and sector size, cursor position (within the sector), and hex data interpretation in thestatus bar. The toolbar contains buttons to increment or decrement the current sector.

Drive Editing is accomplished in the same manner as file editing, with a few exceptions. Since the sector size is fixed,data cannot be inserted or deleted, only overwritten. The Goto utility becomes a Goto Sector Utility allowing movementforward or backward in sectors from the beginning, end, or current sector of the drive/disk. The Find Utility now operateson a range of sectors specified in the Find dialog, and Replace is disabled for sector editing.

Because of the slightly different nature of Drive Editing additional keycuts are available to help quickly move throughoutthe sectors of a disk.

Drive (Sector) Editing



Hex Workshop v6.6 Drive (Sector) Editing


DefinitionBookmarks are user defined shortcuts to selected data within a document. Each bookmark is defined by a description,offset, length, array count, and an optional data type. The offset, length and array count components support arithmeticoperations and functions (e.g. the value at a particular offset). Bookmarks can also reference Structure Definitions. Structure references combined with the ability to calculate offsets and sizes within the bookmark definition enablescomplete parsing of many file formats.

Bookmarks are tied to a single document as opposed to being shared across multiple documents. This design allowsyou to maintain distinct bookmark collection for each document. Bookmarks can also be associated with file extensionsand automatically applied when a document is opened. File associates are defined in the Bookmark Properties orthrough Preferences.

Viewing BookmarksBookmarks are displayed within the "Bookmarks" tab of the Results Window. The example below demonstrates a settest bookmarks. Whenever document focus changes, the bookmark results window will repopulate with the bookmarksfor the active document.

Bookmark SelectionSelecting a bookmark does four things within the editor.

1. It applies any highlight coloring to the editor window.

2. Starts in-place editing if clicked on the description column or the value column. In-place editing is only enabled forvalues if the bookmark was defined with an editable value type (as opposed to a "blob").

3. If the bookmark references a structure definition, that structure is added to the structure viewer. Likewise, whenbookmark selection changes, the bookmark structure is removed from the structure viewer.

4. Last, the bookmark selection preference is applied.

Scroll Data Into View Scrolls the bookmark data into view, but does notmove or adjust the caret position.

Set Caret Position in Editor Scrolls the bookmark data into view and moves thecaret position to the start of the bookmark.

Select Data In Editor Scrolls the bookmark data into view and sets theeditor selection to match the bookmark data.

This behavior can be changed from the Hex Workshop Preferences.

Bookmark ToolbarOpen a new bookmark collection

Bookmark Overview

Hex Workshop v6.6 Bookmark Overview


Save the bookmark collection

Clear all bookmarks (unsaved bookmarks will be lost)

Set the editor caret to the start of the bookmark data

Select the bookmark data within the editor

Add a new bookmark

Remove the selected bookmark

Edit the bookmark definition

Refresh the bookmarks.

Refreshing the bookmark list will re-apply any functions within the bookmark data. This isoften needed if bookmarks reference data at fixed locations and that has been changedwithin the editor.

For additional information, please view the following topics:

Adding a BookmarkEditing a BookmarkOpening and Saving BookmarksBookmark Properties



Hex Workshop v6.6 Bookmark Overview


Bookmarks are document specific. Therefore, when adding a bookmark, make sure that the destination document isactive and in focus. If no documents are open, you will not be able to add a bookmark. Please see Editing a Bookmarkfor detailed instructions on the bookmark editor.

As a convenience, the bookmark editor will initialize with the current caret offset position and selection. To takeadvantage of this feature, we recommended selecting the desired bookmark data within the editor before being thebookmark addition process.

There are 4 methods for adding a new bookmark:

KeycutThe keyboard shortcut Ctrl+B is the default keystroke sequence that will add a new bookmark. These keystrokesequence can be remapped by selecting "Define Shortcuts" from the Options menu.

Tools MenuSelect "Bookmarks" from the "Tools" menu. This will display a popup menu in which you should select "Add Bookmark".

Bookmark Results WindowRight click within the Bookmark Results Window and select "Add Bookmark".

Document WindowRight click within the document view and select "Add Bookmark".

Adding a Bookmark



Hex Workshop v6.6 Adding a Bookmark


The Bookmark Editor show above is used to both add new and edit existing bookmarks. To edit a bookmark, select thebookmark in the bookmark results window and then either:

1. Select the Edit bookmark icon from the bookmark toolbar

2. Right click within the bookmark results window and select "Edit Bookmark" from the popup menu.

3. Select "Bookmarks" from the "Tools" menu and then select "Edit Bookmark" from the popup menu.

Once the bookmark editor is displayed, specify your desired setting, and press the OK button.

NOTE: If you edit a bookmark, you must Refresh the bookmark results window by pressing the Refresh button in theupper right corner of the bookmark results window.

Bookmark AttributesDescription Describes this bookmark. This is string identifies the

bookmark entry in the bookmark results window.

Location Address Identifies the starting address (offset) of the bookmark.The value can be entered in hex or decimal asdesignated by the Location Base drop down choicebox. Additionally, there are a number of functions andoperators available for use in this field. A list offunctions and operators are listed in the section below.

Location Length Identifies the length of the bookmark (in bytes). Thevalue can be entered in hex or decimal as designatedby the Location Base drop down choice box.Additionally, there are a number of functions andoperators available for use in this field. A list offunctions and operators are listed in the section below.

Location Base Specifies the base for both the address and lengthfields. Data can be entered in either decimal orhexadecimal.

Count Defines the count or repetition for this bookmark. Thedefault value is 1, however, you can define a repetition(or array) of bookmarks. The location address andlocation length is used for the first bookmark, however,the Count Sequential Address and Count Fixed Lengthparameters define how addresses and lengths arecalculated for subsequent bookmarks.

Count SequentialAddress

Determines whether array bookmarks beginimmediately after the end of the last array bookmark orif the location address is re-evaluated for each

Editing a Bookmark

Hex Workshop v6.6 Editing a Bookmark


bookmark. The default is checked (or true), however,one may want to change this if the address is based ona calculation.

Count Fixed Length Determines whether array bookmarks should use thelength of the first bookmark or if the length should berecalculated each time. The default is checked (or true),however, one may want to change this if the address isbased on a calculation.

Interpret Data AsType

Identifies the data type for this bookmark. Thebookmark results window will display the documentdata rendered as this type. Additionally, within thebookmarks results window, you can edit the bookmarkin its native interpretable data type.

Interpret Data AsByte Order

Identifies the byte order for this bookmark. Thisparameter is only valid if a interpretable data type isselected.

Interpret Data AsStructure

Identifies the structure providing the details of acomplex data type. You must associate a structure withthe bookmark collection before you can choose astructure. Structures are associated with a bookmarkcollection through the Bookmark Properties dialog.Please see the Structure Viewer for more informationon structures.

Address / Length Functions and Operators+ Addition.

- Subtraction.

* Multiplication.

/ Division.

% Modulus Division.

& Bitwise AND

| Bitwise OR

^ Bitwise XOR

<< Bitwise Left Shift

>> Bitwise Right Shift

UByteAt(OFFSET) Unsigned 8 bit value at a specified offset.

UShortAt(OFFSET) Unsigned 16 bit Little Endian value at a specifiedoffset. Usebyteflip16(UShortAt(OFFSET)) to interpretthe value as Big Endian

ULongAt(OFFSET) Unsigned 32 bit Little Endian value at a specifiedoffset. Use byteflip32(ULongAt(OFFSET))to interpret the value as Big Endian

UQuadAt(OFFSET) Unsigned 64 bit Little Endian value at a specifiedoffset. Use byteflip64(UQuadAt(OFFSET))to interpret the value as Big Endian

last Ending position of the last bookmark

start Position of the caret when the bookmark wasoriginally added.

arrayindex Array index of the bookmark. This is only useful if abookmark has a repetition count of greater than 1.Otherwise, this value will always be 0.

filelength The length of the document file being viewed/editingwithin Hex Workshop.

byteflip16(VALUE) Flip bytes assuming 16-bit value







Recalling Bookmarks

1. Bring the desired document into focus.

2. Press the Open Bookmark Collection toolbar button or Select "Bookmarks" from the "Tools" menu and choose"Select Bookmarks" from the popup menu.

3. Select a previously saved bookmark file.

Saving Bookmarks

1. Bring the document containing the bookmarks into focus

2. Press the Save Bookmark Collection toolbar button or Select "Bookmarks" from the "Tools" menu and choose"Save" or "Save As" from the popup menu.

3. Enter the bookmark filename if saving a new collection or using "Save As" to create a new bookmark file.

Autoloading BookmarksHex Workshop will automatically load bookmarks if a file extension is defined in the bookmark properties or through theBookmark preferences.

Opening and Saving Bookmarks



Hex Workshop v6.6 Opening and Saving Bookmarks


The Bookmark Properties dialog is accessible by pressing the "Props" button while Adding/Editing Bookmarks or byselecting "Collection Properties" from the right-click context menu of the Bookmark Results Window.

Bookmark Property AttributesDescription Provides an overall description for all bookmarks within this document's

bookmark collection.

Author Names the original author of this bookmark collection.

Structures Identifies the set of structures used by this bookmark collection. Only onestructure definition library can be associated with a collection ofbookmarks. Once defined, one can select a structure definition in thebookmark editor.

FileExtensions

Defines a list of extensions for this bookmark collection. Hex Workshopwill automatically load this bookmark collection for any files which matchthe extension list.

To associate the collection with multiple file extensions, use a ";" as adelimiter. For example:

.ext1;.ext2;.ext3

NOTE: Extensions are stored on the local PC and are not defined as partof the bookmark collection.

File

Displays the filename and path of the bookmark collection. This area willbe blank if the bookmark collection has not been saved (as demonstratedabove).

Bookmark Properties



Hex Workshop v6.6 Bookmark Properties


Hex Workshop features a powerful color highlighting mechanism within the editor to help users find interesting data. Color highlights are defined through the Color Preferences, Color Priority Preferences, and Color Maps.

Users can specify the foreground, background, and border rectangle colors for both the hex and text areas of the editor. The various color attributes are merged and applied using prioritizes to maximize the data representation and value tothe user. Hex Workshop also displays popup windows when the user mouse cursor hovers a color highlighted area withinformation on the data.

Color Highlight Attributes

Foreground Color: Users can set unique foreground (text) colors for both the hex and text areas within the editor.

Background Color: Users can set unique background colors for both the hex and text areas within the editor.

Border Rectangle: Users can set a unique line colors for both the hex and text areas within the editor. HexWorkshop applies border rectangle around a blocks of highlighted data (as opposed to each byte contained withinit).

Color MergingEach color attributes is prioritized separately allowing users to view data with attributes from different highlights. Forexample, users can view data with the background color of one highlight, the foreground color of another highlight, and aborder rectangle from a 3rd highlight. Priorities are defined by Color Priority Preferences in cases where multiple colorhighlights of the same attribute (e.g. two foreground colors) are available for data.

Popup InformationIf the user hovers the mouse over a color highlighted area, Hex Workshop displays a popup window with information onthe color highlighting. In the example below, the mouse cursor was placed just to the left of "Doc2.doc" in the Text areaof the editor (4th line excluding header). The popup information tells the user that offset 0x00000001E is tagged by anapplied structure and is the FileName attribute of that structure.

Color Highlighting Overview



Hex Workshop v6.6 Color Highlighting Overview


Users can generate Character Distributions by selecting "Character Distribution" from the "Tools" menu or by pressingthe Character Distribution button from the Tools Toolbar.

OrganizationThe Character Distribution includes 3 windows or components:

1. Character Distribution Histogram2. Character Distribution List3. Character Distribution Bitmap

The Histogram and Bitmap components can be disabled in Character Distribution Preferences.

Character Distribution HistogramThe Histogram shows the number of times each byte is present in the file. Users can scroll over each character to seethe number of instances of each character.

Clicking on the graph selects that character in the Character Distribution List and populates the Character DistributionBitmap for that character.

Character Distributions

Hex Workshop v6.6 Character Distributions


Character Distribution ListThe Distribution List shows the count for each character in the users document. Selecting a character populates theDistribution Bitmap.

Sort the Distribution List by clicking on the column headers.

Character Distribution BitmapThe Distribution Bitmap shows the distribution of each character across the document. Mouse over the bitmap to viewthe number of instances of the character.

Exporting DataUsers can export the character distribution table by selecting "Export" from the "File" menu. Character Distributions canbe exported as Tabbed Text (.txt) or Comma Separated Values (.csv).

Users can also export the Histogram by right clicking on the Histogram and selecting "Export Dialog..."



Hex Workshop v6.6 Character Distributions


Generating Checksums and DigestsThe Checksum Generator allows users to generate checksums and digests for an entire document or a selection withina document and is started by select "Generate Checksum ..." from the "Tools" menu or by pressing the checksum buttonon either the main Tools toolbar or checksum toolbar (located on the Checksum tab of the Results Window).

Users can select the desired algorithms and configure CRC parameters for Custom CRCs prior to pressing the"Generate" button to calculate the checksums and digests. All calculations are performed on the active document withHex Workshop.

Checksum and Digest AlgorithmsThe Checksum Generator supports 23 checksum and digests variations:

Algorithm Bytes Description

Checksum (8 bit) 1Simple count where all the bytes areadded in an 8 bit accumulator. Initialvalue is 0.


Checksum (32 Bit) 4Simple count where all the bytes areadded in an 32 bit accumulator. Initialvalue is 0.


CRC (16 Bit) 216 bit Cyclic Redundancy Check (CRC)with a polynomial of 0x8005 and an initialvalue of 0x0000.

CRC/CCITT (16 bit) 216 bit Cyclic Redundancy Check (CRC)with a polynomial of 0x1021 and an initialvalue of 0xFFFF.

CRC (32 bit) 432 bit Cyclic Redundancy Check (CRC)with a polynomial of 0x04C11DB7 and aninitial value of 0xFFFFFFFF.

Custom CRC (16 bit) 216 bit Cyclic Redundancy Check (CRC)with a user supplied polynomial and initialvalue.

Checksum Generator

Hex Workshop v6.6 Checksum Generator


Custom CRC (32 bit) 432 bit Cyclic Redundancy Check (CRC)with a user supplied polynomial and initialvalue.

MD2 (128 bit) 16 MD2 Message-Digest Algorithm (RSAData Security, Inc.)



SHA-1 (160 bit) 20 160 bit Secure Hash Algorithm (NIST)





RIPEMD (128 bit) 16 128 bit RACE Integrity PrimitivesEvaluation Message Digest (RIPEMD)




Tiger (192 bit) 24 192 bit Tiger Digest Algorithm

Whirlpool (512 bit) 64 512 bit Whirlpool Hash Algorithm

Viewing Checksum ResultsChecksums and digests are displayed in the Checksum tab of the Results Window (Ctrl+W).

Checksums are displayed in both decimal and hex while digests are only displayed in hex.

1s and 2s ComplementUsers can display checksum values as calculated or in 1s or 2s complement. Select the complement drop down("None" is selected in the above example) to switch between as calculated ("None"), 1s compliment or 2s complement. Digests are not displayed in 1s and 2s complement.



Copying checksum and digestsUsers can copy a checksum or digest result by selecting the checksum/digest and pressing Ctrl+C or by right-clickingon the checksum/digest and selecting "Copy" from the popup context menu. The data is placed on the clipboard in bothbinary and text formats. This allows the user to paste the value into Hex Workshop or into another application as text. When pasting into a Hex Workshop document, position the editing caret in either the hex display (left side) or textdisplay (right side) to paste the data as binary or text, respectively.

Clearing ResultsThe checksum results control is cleared by pressing the "X" button in the upper-right of the Checksum Tab. Alternatively,right click anywhere within the Checksum tab and select "Clear All Results" from the popup context menu.

Remove a single checksum/digest by right-clicking on the checksum/digest and selecting "Remove selected checksum"from the popup context menu.

Regenerating Checksums and DigestsChecksums can be refreshed by either re-launching the Checksum Generator or by pressing the refresh button (buttonwith 2 rounded arrows) on the Checksum tab of the Results Windows. Refreshing a checksum maintains the selectedalgorithms and selection parameters (entire document or a block within a document).

The document must be open within the editor to refresh a checksum.

Hex Workshop automatically replaces checksum results generated on a particular file to reduce confusion. It is notpossible to display the checksum result of a particular algorithm before and after an edit without creating a newdocument.

Hiding and Showing Table ColumnsColumns can be shown or hidden by right clicking anywhere on the Checksum tab of the Results Window and selectingthe "Columns" sub-menu from the popup context menu. A description of the columns and default state is included below:

Column Default Description

Document Shown The file name portion of the document used to render thechecksum or digest. Selecting a checksum elementdisplays the full path on the top-left of the Checksum tab.

Offset Hidden Starting offset used to generate the checksum or digest.

Length Hidden Length of data used to generate the checksum or digest.

Algorithm Shown The algorithm used to generate the checksum or digest.

Checksum Shown Decimal checksum value

Checksum/Digest Shown Hex checksum or digest value





The Color Mapping feature of Hex Workshop helps users visually identify data patterns, add visual cues, and de-emphasize uninteresting data by modifying the display properties of user defined byte patterns and ranges.

All of the Color Mapping commands are accessible from the "Tools" menu, under the "Color Mapping" sub menu. Fromthis menu, you can add a new color map, editing existing color maps, clear all color maps, save color mappings, andrecalling color maps. An add Color Mapping toolbar button is also available on the editor's "Tools" toolbar.

For additional information, please see:

Adding a Color MapEditing Color MapsOpening and Saving Color Maps

Color Mapping Overview



Hex Workshop v6.6 Color Mapping Overview


The Add Color Mapping dialogs allow you to define a color mapping byte sequence and the display parameters usedwhen viewing that byte sequence.

There are 4 methods to add a new Color Mapping:

1. Toolbar: Select the Add Colormap toolbar button from the "Tools" menu

2. Keyboard Shortcut: The keyboard shortcut Ctrl+M is the default keystroke sequence that will add a new colormapping. This keystroke sequence can be remapped by selecting "Define Shortcuts" from the Options menu.

3. Menu: Select "Color Mapping" from the "Tools" menu and then choose "Add Mapping" from the popup menu.

4. Content Menu: Right click within the document view and select "Add Color Mapping".

Color Mapping AttributesHex Sequence Defines the byte sequence in hex displayed in a special foreground

and background color. The maximum byte sequence is 64characters; any data entered beyond 32 bytes is ignored.

Separate hex and textview colors

Check to define separate rendering properties for the hex and textdisplay within the editor.

Description A description of the color mapping. This string is displayed in atooltip when mouse cursor hovers for highlighted data in the editor.

Text Color Selects the foreground color used to display the specified hexsequence.

If no color is selected (unchecked), the default text color will be used.

Background Color Selects the background color used to display for the specified hexsequence.

If no color is selected (unchecked), the default color will be used.

Rectangle Color Selects the color of rectangle drawn around the highlighted data.

If no color is selected (unchecked), the default color will be used. Unless another color highlight sets a rectangle, no rectangle will bedisplayed.

Adding a Color Map

Hex Workshop v6.6 Adding a Color Map



Color Mapping OverviewEditing Color MapsOpening and Saving Color Maps



Hex Workshop v6.6 Adding a Color Map


To edit color maps, select the "Tools" menu, then "Color Mapping", and then "Editing Mappings" from the sub menu. Thiswill launch Microsoft Window's Notepad editor to modify an ASCII text file containing your color maps definitions.

The Color Map file can include author/description meta data along with the color definitions. Users can create colormaps for both hex strings and character ranges. Only hex strings can be added from the Add Color Map dialog;however, all of the information is persisted, except comments.

The order of color map definitions is not important. Hex Workshop internally sorts the color maps by hex sequencelength prior to applying them. If color maps overlap, Hex Workshop selects the more complex (longer) color map overshorter ones.

Comments (#)Users can add comment lines to the color map file by starting the line with a pound symbol (#). All data on that line isignored.

Warning: If you edit the color map through the editor, comments are lost when the file is saved. This includes bothadding color maps via the user interface and the "Tools\Color Mapping\Edit Mappings..." menu selection.

!authorThe author attribute declares who created the color map definition file. This information is not used within HexWorkshop and is used for decoration purposes.

Format:

!author="<AUTHOR>"

Example:

!author="BreakPoint Software, Inc."

!descriptionThe description attribute declares who created the color map definition file. This information is not used within HexWorkshop and is used for decoration purposes.

Format:

!description="<DESCRIPTION>"

Example:

!description="Color mappings to highlight non-ASCII data"

Color map DefinitionsColor maps are defined in the following form:

<Hex Sequence> = <Color Definition>

or

<Character Range> = <Color Definition>

Hex SequencesHex Sequences or strings define a search string within the editor. Strings are limited to 32 bytes of data (64 characters)and must be quoted.

Format:

"<HEX SEQUENCE>" = <Color Definition>

Examples:

"0000" = <Color Definition>

"FF0000" = <Color Definition>

Character Ranges

Editing Color Maps

Hex Workshop v6.6 Editing Color Maps

Character Ranges define a range of characters that should match a color mapping. This is useful if one wants tohighlight or de-emphasis ASCII characters or control characters. The range is specified as decimal numbers between 0and 255.

Format:

charrange(<start>, <end>) = <Color Definition>

Examples:

charrange(0, 32) = <Color Definition>

charrange(65, 122) = <Color Definition>

Color DefinitionsColor maps can define foreground, background, and border rectangle colors for both the hex display and ASCII displaywithin Hex Workshop. Colors are defined using a standard RGB tuple where each value represents a Red, Green, andBlue color component. The color components range from 0 to 255.

For example, <RGB>(255, 0, 0) represents Red and <RGB>(128, 128, 128) represents grey.

The foreground, background, and border rectangle colors are defined using the following keywords:

Hex Area ASCII Area

Foreground Color hexFgRGB asciiFgRGB

Background Color hexBgRGB asciiBgRGB

Border Rectangle Color hexRectRGB asciiRectRGB

A single RGB keyword can be used if setting the same foreground or background color for both the hex area and ASCIIarea. Mixing RGB with individual color keywords may result in an error or unpredictable results.

Also, a comment keyword allows users to add a description for individual color maps. This comment is displayed in theeditor if the mouse cursor hovers over color mapped data.

Format:

<Hex Sequence> | <Character Range> = <Foreground>,<Background>,<Border>,<Comment>

<Foreground> = [ RGB(...) | [ hexFgRGB(...) ] [, asciiFgRGB(...)] ]

<Background> = [ RGB(...) | [ hexBgRGB(...) ] [, asciiBgRGB(...)] ]

<Border> = [ hexRectRGB(...)] [, asciiRectRGB(...)]

<Comment> = comment("<COMMENT>")

Examples:

1. Display all instances of "AAAA" with a red foreground

"AAAA" = RGB(255, 0, 0), comment("Red Foreground")

2. Display all instances of "BBBB" with a yellow background

"BBBB" = hexBgRGB(255, 255, 0), asciiBgRGB(255, 255, 0)

3. Display all instances of "CCCC" with a red foreground, grey ASCII background and yellow hex background

"CCCC" = RGB(255, 0, 0), hexBgRGB(255, 255, 0), asciiBgRGB(128, 128, 128)

4. Display all instances of "DDDD" with a yellow foreground and grey border rectangle.

"DDDD" = RGB(255, 0, 0), asciiRectRGB(128, 128, 128), hexRectRGB(128, 128, 128)

A complete color map file including the examples above, might look like the following:

############################################################################### Hex Workshop Color Map Definition File (cmap)##

!author="BreakPoint Software, Inc."!description="Hex Workshop Help Example Colormaps" "AAAA" = RGB(255, 0, 0), comment("Red Foreground")"BBBB" = asciiBgRGB(255, 255, 0), hexBgRGB(255, 255, 0)"CCCC" = RGB(255, 0, 0), asciiBgRGB(128, 128, 128), hexBgRGB(255, 255, 0)"DDDD" = RGB(255, 0, 0), asciiRectRGB(128, 128, 128), hexRectRGB(128, 128, 128) For additional information, please see:

Color Mapping OverviewAdding a Color MapOpening and Saving Color Maps





MenuColor Maps can be opened (recalled) or saved from the "Tools", "Color Mapping" menu.

KeycutYou may also select a color map by using shortcut Ctrl+Shift+M.


Color Mapping OverviewAdding a Color MapEditing Color Maps

Opening and Saving Color Maps



Hex Workshop v6.6 Opening and Saving Color Maps


The Compare Tool (Ctrl+K), located under the Tools menu, allows the you to compare binary files. For yourconvenience, the drop lists are filled with files open within Hex Workshop.

Comparison Settings can be changed in Compare Tool Options Preferences or by pressing the advanced button forAdvanced Compare Options.

Users may select the their desired method of comparison:

Simple CompareResynchronizing Compare

Note: All documents opened within Hex Workshop must be saved before the compare tool can analyze them.

Compare Tool



Hex Workshop v6.6 Compare Tool


The Simple Compare Tool (Ctrl+K) allows you to quickly and easily find differences within two files. After selecting yourfiles and pressing the "OK" button, Hex Workshop will select the first difference found in your documents.

The compare tool starts looking for differences as offset 0 in both documents. You can change this behavior and set aalternative starting offset by pressing the "Advanced" button in the original Compare Dialog. Any future comparisons usethe current cursor position.

Select Next Difference from the Tools:Compare menu or press F6 to find the next difference.

Select Previous Difference from the Tools:Compare menu or press Shift+F6 to find the previous difference.

If any data was inserted or deleted, you will need to manually adjust your cursor position. Alternatively, you can use theresynchronizing compare tool.

NOTE: You should not see anything in the compare tab of the results control as that window is used for resynchronizingcompares.

Compare Tool: Simple Compare



Hex Workshop v6.6 Compare Tool: Simple Compare


The Resynchronizing Compare Tool (Ctrl+K) allows you find differences between two files. This technique is much moretime consuming than a simple compare, however the analysis yields detailed information on what blocks of data havebeen inserted, deleted, replaced, or are matching.

After the analysis completes, the differences are presented in the Compare tab of the results control window:

Hex Workshop will select the inserted, deleted, replaced, or matched data when you select a row in the table. You canalso select Next Difference from the Tools:Compare menu or press F6 to jump to the next difference. Shift+F6 orPrevious Difference from the Tools:Compare menu will jump to the previous difference.

Filtering:A drop down box is provided in the upper right hand corner of the compare results window. This can be used to filter thecomparison results. Selecting Matches, Insertions, Deletions, or Replacements will show only differences of the selectedtype.

Recompare:If editing a document, the compare results may become out of synch and require a re-compare. Users can press therefresh button located in the upper right hand corner of the compare results window, select Recompare from theTools:Compare menu or press Ctrl+R

Compare Tool: Resynchronizing Compare



Hex Workshop v6.6 Compare Tool: Resynchronizing Compare


The Advanced Compare Options dialog is displayed when a user presses the "Advanced" button in the Compare Tool.Use this dialog to adjust compare sensitivity, starting file offsets, and hide/show matching compares.

Settings are maintained for the current compare and are not saved for future compares. Please adjust the ComparePreferences for more permanent default settings. The Recompare Command (Ctrl+R) will retain these preferences andis discussed with the Compare Tool.

Starting Offsets:Users can specify the starting offset used for each file in the comparison. All data before the starting offset is ignored.

Starting Lengths:Users can specify the length of each file in the comparison. All data after the starting offset + length is ignored.

Resync Window:This is option is used to limit how far (in bytes) the compare tool will search for an insertion or deletion. A higher numbermay yield more accurate results, however, will take an exponentially longer time to execute. Lowering the number willspeed up the comparison, but may result in more replacements instead of insertions and deletions. The default value is2048 bytes.

Match Bytes:This option is used to tell the compare tool how many bytes must be identical before a match is reported. The defaultvalue is 32 bytes.

Advanced Compare Options



Hex Workshop v6.6 Advanced Compare Options


Hex Workshop includes a Data Inspector, which displays the caret data as decimal and binaries values. The DataInspector interprets the hexadecimal data at the cursor position as a byte, unsigned byte, short, unsigned short, long,unsigned long, quad, unsigned quad, half float, float, double, MSDOS date, MSDOS time, FILETIME, time_t, time64_tand binary.

Editing DataWithin the Data Inspector you can modify the data at the cursor position by highlighting the data type/value you wish tochange. Hex Workshop highlights the data within the editor using the Data Inspector Selection Highlight.

Managing Data Inspector Data TypesRight click on the data inspector window and select "Manage List" to hide and show data inspector types.

Showing/Hiding the Data InspectorThe Data Inspector can be toggled on/off (shown/hidden) from the Options Menu, the Data Inspector right-click contextmenu or by pressing Ctrl+I.

Data Inspector



Hex Workshop v6.6 Data Inspector


OverviewThe Data Visualizer allows users to view a bitmap representation of their document contents to help identify patternswithin their data.

By selecting or creating different color palettes users can quickly identify text sequences within binary data, patterns andrepeating data, tables, and even palette-based images.

Default PalettesEach Data Visualizer palette maps each byte of a document to a specific color.

SegmentedThe segmented palette displays bands of colors based on the byte value of the data. Thepalette is organized by color bands to help visually separate control, ASCII, and extendedASCII characters.

Range Color / Description

[ 0 .. 31] Grey scale; ASCII Control characters

[ 32 .. 127 ] Green; ASCII characters

[ 127 .. 254 ] Blue; Extended ASCII characters

[ 255 ] Black

Grey ScaleThe grey scale palette maps each character to its grey scale RGB value.

For example, <byte> becomes RGB(<byte>, <byte>, <byte>).

All 0x00 values are rendered as black and all 0xFF values are rendered as white.

Reverse Grey Scale

Data Visualizer

Hex Workshop v6.6 Data Visualizer

The reverse grey reverses the palette order of the grey scale palette.

For example, <byte> becomes RGB(255-<byte>, 255-<byte>, 255-<byte>).

All 0x00 values are rendered as white and all 0xFF values are rendered as black.

Custom PalettesHex Workshop processes the standard Microsoft(tm) .pal file format (RIFF format with PAL information in the paletteinformation in the DATA chunk). The palettes must contain exactly 256 colors. Hex Workshop will output errorinformation in the Output Results Window if unable to parse a palette file.

Users can create custom palettes using a graphic software package or by hand. Hex Workshop provides a palettestructure viewer library (pal.hsl) to aid in palette design.

By default, palette files should be placed in <Install Directory>\Palettes (e.g. C:\Program Files\BreakPoint Software\HexWorkshop v6.5\Palettes). Alternatively, users can change the default palette directory through the Paths ConfigurationPreferences.

Hex Workshop must be restarted to load new palette files.

Position BracketsThe Data Visualizer draws thin brackets around the visualization bitmap to indicate where the editor data resides in thebitmap.

Set Editor Caret Position and SelectionMouse-Over locationWhen users move the mouse over the visualizer bitmap, the cursor position displayed in the Status Bar is updated toshow the offset within the document.

Clicking within the Visualizer BitmapPressing the left mouse button while on the Visualizer bitmap will set the caret position within the editor window.

Selecting within the Visualizer BitmapUsers can select data within the Visualizer Bitmap (and editor) by either:

1. Pressing the left mouse button and dragging the mouse pointer to the ending location.

2. Pressing the left mouse button to set the start location and holding the shift key while pressing the left mousebutton to select the ending position.

Both selection methods will update the selection indicator in the Status Bar.

Manipulation Zoom to Editor View

The Zoom to Editor View feature synchronizes the Data Visualizer view to match the column width and page width of theeditor. When synchronizing with the editor view all of the scrolling and column width adjustment features are disabled. Zooming in or out automatically disables the Zoom to Editor View.

Zoom to DocThe Zoom to Doc features zooms out to view as much of the document as possible. Zooming does not adjust row length(number of bytes displayed per row). To adjust the row length, see Increase Row Length, Decrease Row Length, or SetRow Length features.

Zoom In (Keyboard: '+')Zoom in decreases the height of the Visualizer boxes.

Zoom Out (Keyboard: '-')Zoom out increases the height of the Visualizer boxes.

Match Editor Row Length (Keyboard: <space>)Set the Visualizer row length to match the editor row length. The number of bytes displayed per row will automaticallyadjust as the editor view is adjusted by sizing or through the General Display Options Preferences.

Increase Row Length (Keyboard: <right arrow>)Increases the number of bytes displayed per row in the Visualizer. The maximum number of rows displayed is limited bythe width of the Data Visualizer window. Increase the window size by dragging the window frame to allow for larger rowlengths.

Decrease Row Length (Keyboard: <left arrow>Decreases the number of bytes displayed per row in the Visualizer.

Set Row LengthDefines a specific row length. The row length will be reset if the window is sized smaller than the designated row length.

Refresh (Keyboard: F5)Forces a repaint of the Data Visualizer.

Keyboard Shortcuts:All keyboard shortcuts require that focus be set to the Data Visualizer by clicking within the Data Visualizer Window.

Key Description

Home Scroll to top of Visualizer View (not applicable when Zoomed to Editor View)

End Scroll to end of Visualizer View (not applicable when Zoomed to Editor View)

Page Up Scroll up one page within Visualizer View (not applicable when Zoomed to EditorView)

Page Down Scroll down one page within Visualizer View (not applicable when Zoomed to EditorView)

Up Arrow Scroll up one line within Visualizer View (not applicable when Zoomed to EditorView)

Down Arrow Scroll down one line within Visualizer View (not applicable when Zoomed to EditorView)

Left Arrow Decrease Column width (not applicable when Zoomed to Editor View)

Right Arrow Increase Column Width (not applicable when Zoomed to Editor View)

+ Zoom In by shrinking Visualizer box height

- Zoom Out by increase Visualizer box height

Space Match row width to editor width (not applicable when Zoomed to Editor View)

F5 Refresh the Data Visualizer by forcing a repaint

OverviewThe Expression Calc doubles as a simple calculator supporting arithmetic and bitwise operations, as well as scriptingextension to Hex Workshop, supporting variables, document manipulation, and conditional expressions. The calculatoruses the same expression parsing and evaluation engine that Hex Workshop uses for functions defined as part of theStructure Viewer.

Layout

Sign and SizeThe sign and size drop down lists control the sign and type of data used for the expression.

ExpressionThe expression area allows users to enter compound expressions. The last expression (literal, calculation, variable,etc.) is displayed in the results area.

ResultsDisplays the results of the last expression. See Options below to set the byte ordering and base (hex or decimal).

Defining ExpressionsPlease see the Expressions topics for information on defining expressions.

Executing ExpressionThe expression is evaluated (or executed) when a user presses the "Eval" button or presses Ctrl+Enter within the editorwindow.

The expression is also automatically evaluated when the user changes the Sign or Data Type using the drop downcombo boxes on the Expression Calc.

Sign and Data TypeThe sign and data type selections are used to render the final evaluation results and any literal values within theexpression. Some expression functions require specific data type sizes and will report an error if the data type is toosmall (e.g. invoking getDWordAt(...) when the data type is set to 16 bits).

OptionsThe following options can be set by right-clicking on the Expression Calc's title area or background area (not on theindividual controls).

Expression Calc

Hex Workshop v6.6 Expression Calc


Show Results AsControls the displayed base (either hex or decimal) of the results.

By default the Expression Calc displays the results based on the Toolbar's Environment Settings for offset base. Options include:

Hex

Decimal

Match Toolbar Settings (default)

Interpret Byte Order AsControls the byte order used to interpret hexadecimal strings (e.g. 0x00FF) and the byte order used to render the results.

By default the Expression Calc displays the results based on the Toolbar's Environment Settings for byte order. Optionsinclude:

Big Endian (Motorola)

Little Endian (Intel)

Match Toolbar Settings (default)

Place results on clipboardControls whether expression results are automatically placed on the clipboard. This option is enabled by default.



Hex Workshop v6.6 Expression Calc


Hex Workshop supports integrated data operations within the hex editor. This allow users to perform arithmetic andlogical operations on their data while interpreting their data as decimal or other values.

You can invoke an operation by

1. Selecting the desired operation on the Data Operation drop down,

2. Selecting the option from the Operations Toolbar. As of Hex workshop v5.1, the operations toolbar is disabled bydefault in favor the Data Operations drop down menu described above.

To enable the operations toolbar, selection "Toolbars..." from the "Options" Menu and check "Data Operations"

3. Selection the operation under the Tools\Operations menu.

The following operations are available:

Byte Flip Flip the order of bytes. For example, 0xABCD would become0xCDAB.

This operation can be performed on 16, 32, and 64 bit data blocks.

Inverse Bits Inverse the bits. For example 0xA0 (10100000) would become 0x5F(01011111).

This operation can be performed on data blocks of any size.

Shift Left Shift bits to the left by 1 bit.

This operation can be performed on 8 bit, 16 bit, 32 bit, or 32 bit datablocks in either Big Endian or Little Endian Byte order.

Shift Right Shift bits to the right by 1 bit.


Data Operations

Hex Workshop v6.6 Data Operations


Rotate Left Rotate bits to the left by 1 bit.


Rotate Right Rotate bits to the right by 1 bit.

This operation can be performed on 8 bit, 16 bit, 32 bit, or 32 bit datablocks in either Big Endian or Little Endian byte order.

Block Shift Left Block shift bits to the left by 1 bit (bits are carried across byteboundaries).

This operates at a byte level and can be performed on data blocks ofany size.

Block Shift Right Block shift bits to the right by 1 bit (bits are carried for across byteboundaries).

This operates at a byte level and can be performed on data blocks ofany size.

XOR Perform XOR (Exclusive OR) on data.


OR Perform bitwise OR on data. Requires additional parameter.

This operation can be performed on 8 bit, 16 bit, 32 bit, or 32 bitdata blocks in either Big Endian or Little Endian byte order.

AND Perform bitwise AND on data. Requires additional parameter.


Change Sign Change sign from negative to positive or from positive to negative.

This operation can be performed on 8 bit, 16 bit, 32 bit, and 64 bitintegers and float or doubles under Big Endian or Little Endian byteorder.

Add Add value to data.

This operation can be performed on 8 bit, 16 bit, 32 bit, and 64 bitintegers (signed or unsigned) and float or doubles under Big Endianor Little Endian byte order.

Subtract Subtract value from data.


Multiply Multiply data by a value.


Divide Divide data by a value.


Modulo Division Perform modulo division on data.




Set Floor Value Sets the minimum/floor value. If any values are lower than thespecified value, then the value is replaced with another value.


Set Ceiling Value Sets the maximum/ceiling value. If any values are greater than thespecified value, then the value is replaced with another value.


Upper Case Convert ASCII characters to upper case. Non-alphabetic charactersare not changed.

Lower Case Convert ASCII characters to lower case. Non-alphabetic charactersare not changed.

Swap Case Swaps the case of ASCII characters: lower case becomes uppercase, uppercase becomes lower case, non-alphabetic does notchange.

Hex Workshop will prompt you when additional parameters are required. A sample dialog is shown below:

Treat Data As:Hex Workshop needs to interpret the data as a decimal value for most data operations. For example, rotating 4individual bytes will yield different results than rotating a single long which is 4 bytes in length. Signed vs Unsigned statusis only used for arithmetic operations.

Byte Ordering:Hex Workshop allows you to interpret data in either Little Endian (e.g. Intel) or Big Endian (e.g. Motorola) byte ordering.Please see Understanding Byte Ordering for more information on byte ordering in general.

Value:Users can enter a decimal or hexadecimal operand for operations. You can toggle between hexadecimal and decimalby selecting the appropriate "Decimal" or "Hex" radio button.

Apply On:Hex Workshop can apply the operation on either a selection or your entire document. The "Selection" radio button will bedisabled if the dialog is invoked without a selection.



Hex Workshop includes the capability to both export and copy hex as formatted text (RTF), text, and HTML, forpublishing; C source and Java Source for inserting into code for development; and Motorola S-Records and Intel HexCode. Hex Workshop v4.2 added support for Base64 and UUEncoding. Exporting is accomplished using the File-Export Menu and copying to the windows clipboard is performed using the Edit-Copy As Menu. Format settings can beadjusted from Hex Workshop Preferences.

Below are some samples of the different formats:

Rich Text Format (RTF):

00000000 4D5AC600 B6000000 15040100 FFFF0000 MZ............00000010 00000000 00010000 1E000000 01000000 ..............00000020 00000000 00000000 00000000 00000000 ..............00000030 00000000 00000000 00000000 00000000 ..............

Text:

00000000 4D5AC600 B6000000 15040100 FFFF0000 MZ..............00000010 00000000 00010000 1E000000 01000000 ................00000020 00000000 00000000 00000000 00000000 ................00000030 00000000 00000000 00000000 00000000 ................

HTML:

<html><head> <title> HWS5383 </title></head>

<body bgcolor="#FFFFFF"> <h1><center>HWS5383</center></h1> <meta name="GENERATOR" CONTENT="Hex Workshop"> <hr><pre><code>00000000 4D5AC600 <fontcolor="#004080">B6000000 15040100 <fontcolor="#004080">FFFF0000 MZ..............00000010 00000000 <fontcolor="#004080">00010000 1E000000 <fontcolor="#004080">01000000 ................00000020 00000000 <fontcolor="#004080">00000000 00000000 <fontcolor="#004080">00000000 ................00000030 00000000 <fontcolor="#004080">00000000 00000000 <fontcolor="#004080">00000000 ................</code></pre> <hr> Generated by <a href="http://www.bpsoft.com">Hex Workshop</a> </body></html>

C Source:

// Generated by BreakPoint Software's Hex Workshop v3.10

Export and Clipboard Formats

Hex Workshop v6.6 Export and Clipboard Formats

// http://www.hexworkshop.com//// Source: hworks32.exe// Time: 5/2/2000 9:08 AM// Offset: 0 / 0x00000000// Length: 64 / 0x00000040 unsigned char rawData[64] = {0x4D, 0x5A, 0xC6, 0x00, 0xB6, 0x00, 0x00, 0x00, 0x15, 0x04, 0x01, 0x00,0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,0x1E, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00,} ; Java Source:

/**

* Generated by BreakPoint Software's Hex Workshop v3.10* http://www.hexworkshop.com** Source: hworks32.exe* Time: 5/2/2000 9:08 AM* Offset: 0 / 0x00000000* Length: 64 / 0x00000040*/ char rawData[] = {0x4D, 0x5A, 0xC6, 0x00, 0xB6, 0x00, 0x00, 0x00, 0x15, 0x04, 0x01, 0x00,0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,0x1E, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00,} ; 8 bit Intel Hex Code:

:140000004D5AC600B600000015040100FFFF000000000000B1

:14001400000100001E000000010000000000000000000000B8:140028000000000000000000000000000000000000000000C4:04003C0000000000C0:00000001FF Motorola S28 Records:

S00600004844521B

S2180000004D5AC600B600000015040100FFFF000000000000ACS218000014000100001E000000010000000000000000000000B3S2180000280000000000000000000000000000000000000000BFS20800003C00000000BBS804000000FB Base64:

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA== UUEncoding:

begin 666 BinDiff.exe



M35J0 , $ __\ +@ 03 Xend





Overview The Find Utility (Ctrl+F), located under the Edit menu, allows you to search for a hex, ASCII, decimal values, or bitmaskswithin a file or disk.

There are toolbar buttons that can be used as a shortcut for the Find Utility:

Initiates a new search or find.

Search for the next occurrence of a previous search. The defaultkeycut is F3 or select Find Next under the Edit Menu.

Search for the previous occurrence of a search. The default keycutis Shift+F3 or select Find Previous under the Edit Menu.

Initiate a new search and replace task.

Criteria Tab

Users can search by Text String, Hex, Bitmasks, or numeric values by selecting the desired option in the "Type" dropdown menu.

Searching by Text StringWhen searching by Text, users can opt to search for 8-bit characters, 16 bit characters (Unicode) or both. Additionally,users can opt for a case sensitive or insensitive search using the Match Case check box.

Searching by HexWhen searching by Hex, users can use a question mark as a wild card. For example, the search string "FF?D" wouldmatch on 0xFF0D, 0xFF1D, 0xFF2D, etc.

Searching by BitmaskWhen searching by Bitmasks, Hex Workshop will compare the document bytes against the specified bitmask and markwhenever a match is found. For example, a bitmask of 80 will match 0x80 to 0xFF, but not 0x00 to 0x7F.

Searching by ValueUsers can search by 8, 16, 32, and 64 bit signed and unsigned fixed point values, floats and doubles. Additionally, userscan opt to search for values stored in little endian byte order, big endian byte order, or both.

DirectionThe Direction option allows users to control the direction of searches. Up search from bottom to top and Down searchfrom top to bottom where top is the lowest offset and bottom is the highest offset.

Find All InstancesIf "Find All Instances" is selected, all occurrences of that search string are displayed in the Find Results Window. Within

Find Utility

Hex Workshop v6.6 Find Utility


the Find Results Window the user can use the up and down cursor keys to navigate through search results.

Document Range Tab

Users may also specify the range of a search. Options include searching the entire document, a selected region withinthe editor, or a manually entered document range. Hex Workshop will only wrap (i.e., restart searching at the start or endof the document) if "Entire File" is selected.

By default, Hex Workshop will always search the entire document regardless of the editor selection for each search. Users can change the default behavior through the Find Tool Options Preferences.

Sector Range Tab

Users searching disks or sectors may search the entire disk or enter a start and end sector.



Hex Workshop v6.6 Find Utility


The Find Results Window displays the results of Find Strings or a Find when "Find All Instances" is selected. Thewindow is located on the Find tab of the Results Window.

Example output from executing Find Strings on notepad.exe:

Example output from executing Find All Instances (including the right-click context menu):

Working with find resultsSelecting one of the rows in the Find Results Window scrolls the found area into the editor window based on the user'sindicated Find Tool Option Preferences. Users can use the up and down cursor keys to move between find results.

Press the button to set caret position to the start of found data and return input focus to editor window.

Press the button to select the found data within the editor and return input focus to the editor window.

Press the button to remove all contents from the Find Results window.

Press the Delete key on the keyboard or right click and select "Remove Find Results" to remove the selected findresults. This option supports multiple selections.

Copying Address or ValueRight click on a row and select Copy Address or Copy Value, to place either the finding's address or value on theclipboard.

Applying Structures and BookmarksUsers can apply Structure or Bookmarks to one or more find results in single action by selecting "Apply Bookmark..." or"Apply Structure..." from the right-click context menu. This option supports multiple selections.

Exporting ContentsUsers can copy the contents of the Find Results Window: address, length, and string (if using Find Strings) to theClipboard by "Copy All" from the right-click context menu. An example of that output is included below:

Find Results Window

Hex Workshop v6.6 Find Results Window


00000077 00000040 !This program cannot be run in DOS mode.00000206 00000006 \zRich00000496 00000005 .text00000535 00000007 `.rdata00000575 00000006 @.data00000616 00000006 .pdata00000655 00000006 @.rsrc00000695 00000007 @.reloc00000880 00000012 ADVAPI32.dll00000893 00000012 KERNEL32.dll00000906 00000009 NTDLL.DLL00000916 00000009 GDI32.dll00000926 00000010 USER32.dll00000937 00000010 msvcrt.dll00000948 00000012 COMDLG32.dll



Hex Workshop v6.6 Find Results Window


The Replace Utility, located under the Edit menu, works in the same manner as the Find Utility.

The Replace Utility allows for different sized search and replace strings, and has a Replace All option. In addition, theReplace Utility offers an option to "Pad String with Nulls" when replacing ASCII. This is useful if you are replacing a stringwith a shorter string and with to leave the file size intact. The replace string will be padded with NULL chars until it isequal in size to the search string, before substituted.

Hex Workshop is set up to notify the user upon wrapping around the file during a Find, Find Again, or Replace execution(See General Configuration Preferences).

Replace Utility



Hex Workshop v6.6 Replace Utility


Find Strings, located under the Tools menu, allows the user to find all of the text strings within a document or selection.While only strings containing ASCII characters are reported, Find Strings optionally locates ASCII strings stored asUnicode. Additionally, the user may restrict their search to only contain strings greater then a certain length or strings thatend with a NULL character.

See the Find Results Window for details on viewing and working with results.

ParametersMin Characters:Defines the minimum number of characters (not bytes) required to be considered a string. Users may specify between 3and 128 characters. Strings are terminated at the first control character, carriage return, or line feed.

Requires trailing Null:Restricts strings to those strings that end with a NULL (or zero) character.

ASCII, Unicode, Both:Find Strings can report ASCII strings, ASCII strings stored as Unicode, or both ASCII and Unicode. The default is "Both",however selecting only ASCII or Unicode will quicken the search.

Apply On:This operation can be performed on either the entire document or a selection within a document. This option is disabled(grayed) if no data was selected in the editor prior to starting the operation.

Find Strings



Hex Workshop v6.6 Find Strings


Hex Workshop support multiple method of navigating around documents. Users can launch the Goto Utility using theFind/Goto Toolbar, right clicking on the Offset Area, or right clicking within the Editor Window. Alternatively, users canenter addresses directly into the Goto Address edit box on the Find/Goto Toolbar.

Goto Utility

The Goto Utility (Ctrl+G), located under the Edit menu, allows the user to logically move throughout the file. The GotoUtility can be used to move from the beginning of the file, the cursor position, or the end of the file. The number of bytesto move can be specified in either hex or decimal (with hex values always positive). When moving from the cursorposition a negative decimal value may be entered to move backwards (This is the only time a negative value is allowed).In moving back from the end of the file, a positive number moves back into the file. There is a toolbar button which canbe used as a shortcut for Goto.

The Goto Again (F5) command, located under the Edit menu, is used to re-execute the last Goto command. If theprevious Goto was from the current position, then another Goto is executed moving the same amount of bytes in thesame direction, having the same effect as setting up and executing another identical Goto. If the previous Goto was fromthe beginning or end of file, then the dialog is brought up again with the previous values loaded. If there are no existingGoto parameters, the Goto Again brings up the original Goto Dialog.

Goto Utility



Hex Workshop v6.6 Goto Utility


The Quick Goto Toolbar control allows users to quickly jump to offsets in an active document.

Goto Absolute AddressTo jump to an absolute address in a document, either that address in the Quick Goto box and press enter. Prefixaddresses with "0x" for hex addresses. For example, to jump to position 32 in the file, enter either:

or

and press the Enter key.

Goto Relative AddressTo jump to an address relative to the current caret position, prefix your address with either "+" to jump forward or "-" tojump backwards.

To jump 100 bytes forward, enter:

and press the Enter Key

To jump 64 bytes backwards, enter:

and press the Enter Key

Repeat Previous GotoThe Quick Goto control includes a list of the most recently used goto sequences. Select an item from the drop down listto repeat a jump.

Alternatively, the Goto Next and Goto Previous toolbar buttons will update the caret position if the last goto sequenceswas a relatively address (+<value> or -<value).

Goto Toolbar Overview



Hex Workshop v6.6 Goto Toolbar Overview

The Hex Workshop Structure Viewer helps you view and edit binary data in a convenient and natural format. In thescreen capture below, an example is shown of a .ZIP file header in the Structure Viewer. The file is shown as a structuredset of data types instead of a series of hexadecimal values. In order to work with data files in the Structure Viewer,perform the following steps:

1) Define your structures and package them into a Structure Library2) Selected your structure library within Hex Workshop3) Add individual structures to the Structure Viewer window.

Please review Structure Libraries, Defining a Structure and Adding a Structure for more information on steps 1, 2, and 3above. The rest of this topic will focus on viewing and working with structures.

The Structure Viewer is docked on the bottom-left of Hex Workshop by default. You can hide and show the StructureViewer window by using the keycut Ctrl+T or by selecting the "Show Structure Viewer Window" option from the"Options" menu.

The Structure Viewer mimics the Window's Explorer by using "+" and "-" symbols to indicate nested data within the dataview. You can expand or collapse nested data by pressing the "+" or "-" icons, by double clicking on an entry'sAddress/Name, or by pressing the right and left arrow keys. Additionally, the icons depict a closed lock or an open lockto represent locked and floating structures. In the example above, a locked structure is shown. For more information onlocked and floating structures, please see Adding a Structure.

Mapping Structure to Document ViewOnce a structure is added, selecting the top element (or root node) of the structure highlights the all of the structure'sbinary data within the document view of your file. Selecting a single row within the structure will highlight only that row'sdata. The default highlight color is a green foreground on a white background. You can alter the default foreground andbackground colors of the data selected in the document view in the Color Settings Display Options Preferences.

Editing Structured DataTo modify the structure data, you can either edit the binary data in the document view or edit the rendered data within thestructure viewer. To edit data within the structure view either:

- Click on the data within the "Value" column of the Structure Viewer.- Selected the data that you wish to modify in the Structure Viewer and press the "F2" key.

Pressing the "Enter" key, or clicking the mouse off of the editor will valid and accept your changes. If you wish to abort achange while editing, press the "Esc" key.

Toolbar ButtonsOpen a Structure Library

Close a Structure Library

Add a structure from the selected structure library

Remove the selected structure (must select root of structure)

Execute a structure function

Structure Viewer Overview

Hex Workshop v6.6 Structure Viewer Overview


View Validation results

Goto start of structure in Editor

Goto end of structure in Editor

Selection Structure Contents in Editor

Refresh All Structures

See also Adding a Structure, Removing a Structure, Defining a Structure and Basic Structure Data Types.



Hex Workshop v6.6 Structure Viewer Overview


Before adding a structure, you must select a Structure Library. If you do not have a Structure Library selected, do thisnow. For help on selecting a Structure Library, please see Structure Libraries.

The Add Structure dialog can be invoked either by using the keycut Ctrl+L, by right-clicking on the Context menu andselecting "Add Structure" from the Structure Viewer, by pressing the "+" button on the Structure Viewer Window, or byselecting "Add Structure" from the "Tools:Structure Viewer" menu.

After you have selected a structure from the Structure Library located on the left of the dialog, select desired options, andthen press OK button. Options are described below.

Floating StructureA floating structure is not locked to a specific document or fixed to a specific address/offset. Moving your cursor arounda document and changing the document focus will force a floating structure to recalculate and re-render all of it's dataelements given the new document and/or offset. This is very useful when searching for structures within documents.

Locked document/offsetA locked structure is locked to a specific offset within document. The document will recalculate and re-render it's dataelements whenever the structure is refreshed. Closing and reopening the root data element is one method of refreshinga structure. Locked structures are automatically removed when the document it is locked to is closed.

DocumentIf adding a locked structure, you must select a document to anchor the structure to. By default, Hex Workshop fills in thein-focus document.

OffsetIf adding a locked structure, you must select an offset to anchor the structure to. By default, Hex Workshop fills in thecursor offset of the in-focus document.

Byte OrderIf your structure contains integer or floating point values, then you may need to specify the byte order used to interpret thedata values. You can select either Big Endian (Motorola) or Little Endian (Intel).

The byte order control is disabled when a byte order is specified in the structure definition using a #pragma byteorderdirective.

Validate StructuresThe Validation Structures check box verifies any pre-conditions defined the structure declaration. The check box isdisabled when adding a Floating Structure. For more information on structure validation, see Structure DefinitionVerification.

Validation StatusThe validation status button displays the results of a structure's pre-condition check. The button is only enabled if"Validate Structures" is checked and the structure includes validation checks.

See also Structure Viewer Overview, Removing a Structure, Defining a Structure and Basic Structure Data Types.

Adding a Structure

Hex Workshop v6.6 Adding a Structure




Hex Workshop v6.6 Adding a Structure


There are a four methods for removing a structure from the Structure Viewer.

1. Select the top (root) of the structure definition that you wish to remove from the Structure Viewer. Next, press the"Delete" key on your keyboard.

2. Right-click on the top (root) of the structure definition that you wish to remove from the Structure Viewer, and select"Remove Structure" from the popup context menu.

3. Select the top (root) of structure that you wish to remove from the Structure Viewer. Next, select "Structure Viewer"from "Tools" menu, and then select "Remove Structure" from the sub menu.

4. Select the top (root) of the structure that you wish to remove from the Structure Viewer. Next, select the "-" button inthe upper right of the structure frame.

Additionally, you can also remove all structures by select "Clear Structures" from either the right-click context popupmenu or the Tools:Remove Structure submenu.

See also Structure Viewer Overview, Adding a Structure, Defining a Structure and Basic Structure Data Types.

Removing a Structure



Hex Workshop v6.6 Removing a Structure


DefinitionA structure library (.hsl file) contains 1 or more Hex Workshop Structure Definitions. Each structure definition can beused to render binary data into structured data within the Hex Workshop Structure Viewer. This is a powerful and usefulfeature, with the following limitations:

- Structure definitions are limited to a set of predefined basic data types, type definitions, and otherstructures/enumerations.- A structure can only reference another structure defined before it within the same Structure Library (or an includedlibrary). - Only one structure library can be active at any point in time.

It is recommended that you save structures in the "Structures" directory created during installation. This directory iscreated relative to your installation directory and is by default: "C:\Program Files\Hex Workshop <version>\Structures".

Selecting a Structure LibraryYou can select a structure library using the key cut Ctrl+Shift+L or by selecting "Select Structure Library" from theStructure Viewer's right-click context menu, or by selecting "Select Structure Library" from the "Tools:Structure Viewer"menu.

NOTE: You cannot add a structure to the structure viewer before a structure library has been selected.

See also Structure Viewer Overview, Adding a Structure, Removing a Structure, Defining a Structure and BasicStructure Data Types.

Structure Libraries



Hex Workshop v6.6 Structure Libraries

General FormA Hex Workshop structure closely resembles a structure definition the C programming language, which is familiar tomany developers and easily learned by others. Future versions of Hex Workshop will incorporate a structure building toolalong with the ability to extract structures from existing C/C++ source files.

The following is an example of a Hex Workshop Structure definition. Both C++ comments ("// COMMENT") and Ccomments( "/* COMMENT */") are supported.

/* * LocalFileHeader for a .ZIP compressed file. */struct LocalFileHeader{ char Signature[4]; // PK<0x03><0x04>#pragma verify match_var_int("Signature[0]", "0x50")#pragma verify match_var_int("Signature[1]", "0x4B")#pragma verify match_var_int("Signature[2]", "0x03")#pragma verify match_var_int("Signature[3]", "0x04") WORD VersionNeededToExtract; WORD GeneralPurposeBitFlag; WORD CompressionMethod; DOSTIME LastModFileTime;

DOSDATE LastModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FileNameLength; WORD ExtraFieldLength;

}; The general format of a structure is as follows:

struct <<STRUCTURE_NAME>>{ <<DATA_TYPES_AND_NAMES>>};

A structure definition begins with the key word "struct" followed by the structure name. The structure name cannot containany tabs or spaces. An opening brace "{" marks the beginning of the data declaration and a closing brace "}" marks itsend. Lastly, a semicolon ";" marks the end of the structure definition.

Data TypesData types are declared in the following form:

<<DATA_TYPE>> <<VARIABLE_NAME>; A trailing semicolon is required and variable names cannot contain tabs or spaces.

For a list of basic built-in data types, see Basic Structure Data Types. Additional data types are provided in thestandard-type library included with Hex Workshop.

Nested StructuresYou can nest one structure within another by using a command of the following form:

struct <<STRUCTURE_NAME>> <<VARIABLE_NAME>>; In the following example, an ARGB structure is defined and followed by the definition of a palette structure, which asdefined below contains an array of 256 ARGB structures.

struct ARGB{ BYTE alpha; BYTE red; BYTE green; BYTE blue;};

Structure Definition Overview

Hex Workshop v6.6 Structure Definition Overview

struct palette{ struct ARGB entries[256];};

Defining your own types (typedef)The typedef keyword allows users to create and name new data types. Each new data type must map to a basic built-indata type or a pre-defined type. The following example creates two 8 bit signed integer data types named "BYTE" and"byte". The struct myTypedefExample then uses a basic type and the newly created data types to create a structure withthree 8 bit signed values (b1, b2, and b3).

typedef signed __int8 BYTE;typedef BYTE byte; struct myTypedefExample{ signed __int8 b1; BYTE b2; byte b3;} ;

Users can also typedef structures and enumerations. Typedef must be specified as part of the declaration. The examplebelow defines a new data type POINT and LINE structure. The LINE structure defines the start and end points of the lineby naming the full structure (struct tagPOINT) and the typedef name (POINT):

typedef struct tagPOINT{ LONG x; LONG y;} POINT; struct LINE{ struct tagPOINT start; POINT end; };

Including other files (#include)By adding a #include directive to a structure library definition file, Hex Workshop will insert the literal contents of thedesignated structure library (#include parameter) into your current structure library file where the #include is defined. Forexample, all of the sample structure libraries included with Hex Workshop reference a common library that consists ofcommon and standard data types. The #include directive used in the sample libraries is provided below.

#include "standard-types.hsl"

Keyword Variables (__this__ and __parent__)The __this__ and __parent__ variables are used to reference data from the base of the structure or parent structure.

__parent__

Considering having a nested structure that references a length variable within two different parent structures. One mightwant to define a structure that is based off a relative address from the start of a parent instead of the actual variablename. In the example below, the length variable is defined with different names in PARENT_1 and PARENT_2

typedef struct NESTED{ WORD someData[ushortAt(addrof(__parent__))] ;} NESTED ; typedef struct PARENT_1{ WORD parent1Length; NESTED nested ;} PARENT_1;



typedef struct PARENT_2{ WORD parent2Length; NESTED nested ;} PARENT_2; In the example above, the "NESTED" structure defines an array of WORDs where the array length hard-coded to the firstWORD in any parent structure. This allows users to use this structure in definitions where the parent variable name maydiffer. In this case, PARENT_1's length is "parent1Length" and PARENT_2's length is "parent2Length".

__this__

The __this__ keyword references the begin of a structure. Consider a case where one has a WORD length followed byN number of words. You can define a structure to display this data this in multiple ways:

typedef struct TYPICAL{ WORD length; WORD data[length];} TYPICAL; typedef struct ALTERNATIVE{ WORD data[ushortAt(addrof(__this__))+1];} ALTERNATIVE;

In this example, the "ALTERNATIVE" structure's length is defined as effectively at the data[0] position. The "TYPICAL"structure is clearly preferred; however, cases exist where using __this__ is useful.

More Information on Structure DefinitionsDefinition Overview, Data Types, Enumerated Types, Arrays, Strings, Bitfields, Expressions, Conditionals, Functions,Verification, Library Settings, Structure Settings, and Reserved Words and Symbols.





Hex Workshop supports a limited number of atomic data types. For added flexibility, users may define their own datatype definitions that resolve to one of the corresponding data types listed below:

Type Aliases Size(bits)

Signed Comment

bool 8 Unsigned

char signed char 8 Signed Treated as String in arrays

unsignedchar

8 Unsigned

__int8 Bytesigned __int8

8 Signed

unsigned__int8

UByte 8 Unsigned

__int16 Wordsigned __int16short

16 Signed

unsigned__int16

UWordunsigned short

16 Unsigned

__int32 DWordsigned __int32intlong

32 Signed

unsigned__int32

UDWordunsigned intunsigned long

32 Unsigned

__int64 QWordsigned __int64

64 Signed

unsigned_int64

UQWord 64 Unsigned

halffloat 16 N/A 16-bit half precision float (IEEE754-2008)

float 16 N/A

double 32 N/A

Data Types

Hex Workshop v6.6 Data Types


DATE 64 N/A Microsoft OLE Date/Timestructure.

DOSDATE 16 N/A MS-DOS style time.

DOSTIME 16 N/A MS-DOS date time.

FILETIME 64 N/A Window FILETIME structure.

time_t 32 N/A ANSI C time_t structure.

time64_t 64 N/A ANSI C time64_t structure.

zstring variable N/A Zero-terminated string.

In addition to the basic data types recognized by Hex Workshop, you can make use of standard types defined in thesupplied standard-types.hsl file:

Data Type Maps To

CHAR char

WCHAR wchar

BYTE signed __int8

byte signed __int8

UBYTE unsigned __int8

ubyte unsigned __int8

WORD signed __int16

word signed __int16

USHORT unsigned __int16

ushort unsigned __int16

SHORT signed __int16

DWORD signed __int32

dword signed __int32

LONG signed __int32

ulong unsigned __int32

quad signed __int64

UQUAD unsigned __int64

uquad unsigned __int64

FLOAT float

DOUBLE double



To utilize these standard types, please add the following line to the top of your structure library:

#include "standard-types.hsl"






OverviewEnumerated types allow users to couple human readable names with numeric values. When an enumeration is defined,Hex Workshop allows you to view and work with the human readable names within the editing environment.

Enumerated types are defined similarly to structures. The general form begins with the "enum" keyword, followed by theenumeration name, an opening brace "{", enumeration definitions, a closing brace "}", and a trailing semicolon ";".Enumeration values may be specified in decimal or hex. To specify an enumeration value in hex, prefix the hex valuewith "0x".

enum <ENUM_NAME>{ <ENUM_DEFINITIONS>};

typedef enum <ENUM_NAME>{ <ENUM_DEFINITIONS>} <ENUM_NAME>;

Controlling Enumeration sign and sizeThe sign and size of the enumeration is control through the #pragma enumsign and #pragma enumsize Library Settings.

Using Enumerations as ConstantsUsers can use enumerations as constants where an expression is expected. See the __verify statement at the end ofthe example:

#pragma enumsize(4)#pragma enumsign("unsigned")typedef enum tagSIGNATURE{ LocalFileHeader = 0x04034B50, ArchiveExtraData = 0x08064B50, EndOfCentralDirectory = 0x06054B50, DigitalSignature = 0x05054B50, CentralDirectoryFileHeader = 0x02014B50, ZIP64EndOfCentralDirectory = 0x06064B50, ZIP64EndOfCentralDirectoryLocator = 0x07064B50} SIGNATURE ; struct LocalFileHeader{ SIGNATURE Signature ; WORD VersionNeededToExtract ; WORD GeneralPurposeBitFlag ; COMPRESSION_METHOD CompressionMethod ; DOSTIME LastModFileTime ; DOSDATE LastModFileDate ; DWORD Crc32 ; DWORD CompressedSize ; DWORD UncompressedSize ; WORD FileNameLength ; WORD ExtraFieldLength ; char FileName[FileNameLength] ; blob ExtraField[ExtraFieldLength] ; blob FileData[CompressedSize] ; __verify(Signature == SIGNATURE.LocalFileHeader) ;} ;The enumeration is referenced using the <enumeration name>.<enumeration field>.

Examplesenum _FINDEX_SEARCH_OPS{ FindExSearchNameMatch, // Value: 0 FindExSearchLimitToDirectories, // Value: 1 FindExSearchLimitToDevices, // Value: 2

Enumerated Types

Hex Workshop v6.6 Enumerated Types

FindExSearchMaxSearchOp // Value: 3}; enum myOtherExample{ MY_STARTING_VALUE = 100, // Value: 100 MY_NEXT_VALUE_1, // Value: 101 MY_NEXT_VALUE_2, // Value: 102 MY_RESET_VALUE = 200, // Value: 200 MY_NEXT_VALUE_3, // Value: 203 MY_OTHER_VALUE = 0x10 // Value: 16};




Hex Workshop v6.6 Enumerated Types


OverviewTo specify an array of a data type, indicate the desired repetition count of the array, in decimal, surrounded by bracketsafter the variable name. In the example below, 32 values of data type "int" are defined under the variable myArray:

int myArray[32]; Users may also define variable length arrays within structures. A variable length character string is demonstrated below:

struct pstring16{ unsigned short len; // 16 bits worth of length char content[len]; // Actual string content};

Users can specify expressions within array declarations. For example, consider the need to deserialize an array ofbytes:

struct myByteArray{ unsigned short rows; unsigned short columns; __int8 data[rows*columns];};


Arrays



Hex Workshop v6.6 Arrays


OverviewThe Hex Workshop structure view can accommodate three popular types of strings:

- A variable length null (or zero) terminated string (zstring).- A fixed length string.- A variable length string where the length precedes the string content.

Example of the three string types are shown below:

struct stringexample{ zstring null_terminated_str; char fixed_length_str[128]; struct length_first_str { WORD length; char string[length]; };};


Strings



Hex Workshop v6.6 Strings


OverviewHex Workshop v4.2 added basic support for C style bitfields. Bitfields allow users to view and edit a selection ofconsecutive bits as an independent integer. This reduces the need to count bits and convert binary to decimal. HexWorkshop supports 8, 16, 32, and 64 bit bitfields.

struct screenchar{ unsigned short character : 8; unsigned short color : 4; unsigned short underline : 1; unsigned short blink : 1;};

In the example above, 16 bit value is broken into a 8-bit character, 4 bit color, and 1 bit flags for the underline and blinkattributes.


Bitfields



Hex Workshop v6.6 Bitfields


OverviewUsers can embedded expressions supporting arithmetic and bitwise operations, limited conditionals (? : operators),and document/data manipulation in Array definitions, Structure Conditionals, and Structure Functions.

Please see the Expressions Reference Overview for information on expression definitions and features.


Expressions



Hex Workshop v6.6 Expressions


OverviewStructure definitions support two forms of conditions: switch and if statements.

NOTE: The support for conditionals in Structure definitions differ from Structure Functions.

switch statementThe switch statement allow users to define conditional structure elements based on another structure variable orexpression. The general form is:

switch (<expression>){case <expression>: <<DATA TYPES>> break;case <expression>: <<DATA TYPES>> break;default: <<DATA TYPES>> break;};

Example:

#include "standard-types.hsl

struct conditionalExample{ WORD type ; WORD len ; switch (type) { case 1: WORD value ; __verify(len == 2); break; case 2: DWORD value ; __verify(len == 4); break; default: blob value[len]; break; };};

Limitations:

The variable or expression used in the switch statement must resolve to an integer (8, 16, 32, or 64 bit).

Each case statement must be followed by break statement. The following is not supported:

...case 1: case 2: <<DATA>> break ;...

If the structure references switch statement data elements further down in the structure or from a parent structures,the switch data element must be declared in all case branches -- including the default branch.

In the example below, all branches define a "length" structure element which is referenced in the declaration of"data". If the "default" case is omitted, the structure may fail to parse or be applied.

struct example {

Conditionals

Hex Workshop v6.6 Conditionals

UWord len_type; switch (len_type) { case 1: UByte length; break; case 2: UWord length; break; default: UDWord length; break; } blob data[length];};

if statementThe statements allows users to define conditional structure elements using if, else if, else statements and resembles theC/C++ language. Each branch of the if statement must include an open and closing brace and the last branch mustincluded a semicolon.

Form 1:if (<expression>){ } ; Form 2:if (<expression>){ }else if (<expression>){ }else{ } ;




Hex Workshop v6.6 Conditionals

OverviewStructure libraries may contain parsing functions for file formats or functions to be used to provide general datamanipulation helpers (e.g. recalculating a checksum). Functions include a list of expressions delimited by semicolonsand can include arithmetic and bitwise operations, conditionals, loops, functional calls, etc.

Please see the Expressions Reference Overview for information on expression definitions and features.

Functions may be executed from Structure Viewer by pressing the hammer icon located on the structure viewerwindow and then selecting the desired function.

Form:function <function name>{ <expression1>; <expression2>; ...};

Example:function AutoParseZipSelection

{ UQWord pos = __getCaretPos() ; UQWord end = pos + __getCaretSel() ; while (pos < end) {

switch (__getUDWordAt(pos)) { case SIGNATURE.LocalFileHeader: pos += __addStructureAt(pos, "LocalFileHeader", "") ; break ; case SIGNATURE.ArchiveExtraData: pos += __addStructureAt(pos, "ArchiveExtraData", "") ; break ; case SIGNATURE.EndOfCentralDirectory: pos += __addStructureAt(pos, "EndOfCentralDirectory", "") ; break ; case SIGNATURE.DigitalSignature: pos += __addStructureAt(pos, "DigitalSignature", "") ; break ; case SIGNATURE.CentralDirectoryFileHeader: pos += __addStructureAt(pos, "CentralDirectoryFileHeader", "") ; break ; case SIGNATURE.ZIP64EndOfCentralDirectory: pos += __addStructureAt(pos, "ZIP64EndOfCentralDirectory", "") ; break ; case SIGNATURE.ZIP64EndOfCentralDirectoryLocator: pos += __addStructureAt(pos, "ZIP64EndOfCentralDirectoryLocator","") ; break ; default: pos += 4 ; break ; } ; } ;}


Functions



Hex Workshop v6.6 Functions

OverviewThe Structure Viewer and Add Structure dialog allow users to verify basic pre-conditions on structures (sanity check).

While adding a structure, icons are displayed next to the structure definition to indicate the validation status. Users canpress the "Validation Status" to investigate which validation check failed.

Floating and locked structures also display a "verify failed" message in the Structure Viewer if any validation conditionsfail. The user can press the yellow warning icon button on the Structure Viewer toolbar to investigate.

For example, adding a ZIP format "LocalFileHeader" at the wrong offset tells the users that the signature doesn't matchexpectations.

Structure Definitions support two methods of declaring verification checks:

1. __verify(<expression>) function

2. #pragma verify

We recommend using the __verify(<expression>) method when possible as the #pragma method will be deprecated infuture releases of Hex Workshop.

__verify(<expression>)The __verify function allows users to define expressions to validate pre-conditions. For example:

typedef struct tagBITMAPFILEHEADER{ WORD bfType; DWORD bfSize; WORD bfReserved1; WORD bfReserved2; DWORD bfOffBits; // Verify that file header looks sane __verify( (bfType == 0x4D42) && // Expected type: 'BM' (bfSize == __getDocSize()) && // header size matches file size (bfOffBits < __getDocSize()) // image offset within range ) ;} BITMAPFILEHEADER ;

This method allows complex validation rules; however, presently does not support string comparisons.

#pragma verifyThe pragma verify statement allows users to define integer and string comparisons.

The Syntax is as follows:

#pragma verify <<MATCHTYPE>>("<<VARIABLE>>", "<<VALUE>>")

Verification

Hex Workshop v6.6 Verification

NOTE: The variable and value must be quoted.

MATCHTYPE Description

match_var_int Compares a variable against the specified integer value. 8, 16, 32, and 64 bit valuesare supported. The value can be declared in either decimal or hex.

Examples:

#pragma verify match_var_int("Signature[0]", "0x50")#pragma verify match_var_int("Signature[1]", "0x4B")#pragma verify match_var_int("Signature[2]", "0x03")#pragma verify match_var_int("Signature[3]", "0x04")#pragma verify match_var_int("magic", "0xCAFEBABE")

match_var_str Compares a variable against the specified string value.

Examples:

#pragma verify match_var_str("method", "add")




Hex Workshop v6.6 Verification


OverviewStructure Definitions support various #pragma directives to control the properties of structure definitions. Like C/C++pragma usage, the directives can be placed in different locations to control properties of elements defined after it. Exception: the fileextensions, and displayname #pragma directives must only allow to appear once.

Library Setting #pragma directives must be defined outside of a structure, enumeration, or function declaration. Someexception exist.

With Library #pragma directives, users can control:

Display Name of the Structure Library

Expected File Extensions

Whether structures are shown/hidden when adding

Byte Order

Pointer Size

Maximum Array and String lengths

Enumeration Size and Sign

#pragma displayname("<string>")The display name pragma defines the friendly name of the structure. The friendly name is displayed on the structureviewer selection tool.

#pragma displayname("zip structures")

#pragma fileextensions("<string>")The file extensions pragma defines which document extensions are appropriate for the structure definition. Multiple fileextensions can be specified by using a semicolon a delimited. If the structure definition is loaded/open, Hex Workshopwill automatically select the library whenever a compatible document is in focus.

#pragma fileextensions(".zip;.jar")

#pragma hide()The hide pragma hides all structure definitions and enumerations defined after the #pragma until the next #pragmashow() statement is reached. Hidden structures can be referenced by other structures; however, are not shown in theAdd Structure Dialog's list of available structures. Users often hide structures that are not useful by themselves oralways nested within another structure.

#pragma hide()

#pragma show()The show pragma defeats the #pragma hide() setting and allows structures declared after it to be shown in the AddStructure Dialog.

#pragma show()

#pragma byteorder(<byte order type>)The byte order directive controls the interpretation of document data (in either Little Endian or Big Endian byte order). Options include little_endian, big_endian, and environment. The Environment setting will use the byte order set on theEnvironment Toolbar.

#pragma byteorder(little_endian)#pragma byteorder(big_endian)#pragma byteorder(environment)

#pragma maxarray(n)By default, Hex Workshop limits the length of arrays to 1024 members. This setting imposes an upper limit to bound howmuch processing Hex Workshop performs when evaluation structures. If a structure definition containsrecursive/exponential data structures (e.g. arrays of arrays) and is applied to a corrupt file, Hex Workshop may appear

Library Settings

Hex Workshop v6.6 Library Settings

to hang while processing.

#pragma maxarray(2048); // Increase the max array length to 2048

#pragma maxstring(n)Like array lengths, Hex Workshop limits the maximum string length to avoid run-away processing of corrupt files. Bydefault, strings are limited to 512 characters, however, users may increase the number of characters to a max of 65,536by using the maxstring #pragma. An example is shown below:

#pragma maxstring(128); // Decrease the max string length to 128

#pragma ptrsize(<n>)The structure viewer treats pointers to structures or data types as an absolute location to that data. For example, adding"UWord* myValue" to a structure definition is interpreted as "the next data (value) within the document represents anabsolute value to a UWord".

By default, pointers are assumed to be 32bit. The ptrsize pragma directive can be used to change the default pointersize to 8 bit, 16bit, 32 bit, or 64 bit.

#pragma ptrsize(1) // Set pointer size to 8 bit




NOTE: #pragma ptrsize is allow supported within structure definitions. See Structure Settings for other definitionsallowed within a structure definition.

#pragma enumsize(<n>)By default an enumerate type is assumed to be a 4 byte (32 bit) data member. To define an enumeration for an 8 bit, 16bit, 32 bit, or 64 bit enumerated type, use the #pragma directive to indicate the size. The #pragma directive sets theenumeration data size for all enumerations defined after the directive until a new #pragma is encountered.

#pragma enumsize(1) // Enums defined after here are 1 byte (8 bits)

<<enum definitions>>

#pragma enumsize(2) // Enums defined after here are 2 bytes (16 bits)






NOTE: The size can be changed between enumeration definitions, but not in the middle of a definition.

#pragma enumsign("<sign>")Structure definitions can switch the interpretation type of the enumeration elements using the enum_sign #pragma. Options include signed and unsigned. Enumerated types are signed by default.

#pragma enum_sign("signed") <<enum definitions>> #pragma enum_sign("unsigned") <<enum definitions>>

NOTE: The sign can be changed between enumeration definitions, but not in the middle of a definition.

#pragma pack(n)Not yet implemented






OverviewStructure Definitions support various #pragma directives to control the properties of structure definitions. Like C/C++pragma usage, the directives can be placed in different locations to control properties of elements defined after it.

Structure Setting #pragma directives must be defined within a structure definition.

With Structure #pragma directives, users can control:

Pointer Size

Suggested location

#pragma ptrsize(<n>)The structure viewer treats pointers to structures or data types as an absolute location to that data. For example, adding"UWord* myValue" to a structure definition is interpreted as "the next data (value) within the document represents anabsolute value to a UWord".

By default, pointers are assumed to be 32bit. The ptrsize pragma directive can be used to change the default pointersize to 8 bit, 16bit, 32 bit, or 64 bit.





NOTE: #pragma ptrsize is allow outside structure definitions. See Library Settings for other definitions allowed outsidea structure definition.

#pragma lockAt(n)#pragma floatAt(n)The lockAt and floatAt pragma commands are used to suggest an initial locked or floating offset. If specified, the addstructure dialog will pre-populate the offset and float/locked options when adding a structure.

Syntax:#pragma lockAt(offset)#pragma floatAt(offset)

Where offset can be a decimal (e.g. 32) or hexadecimal value (e.g. 0x20).

Example:

struct LocalFileHeader {#pragma lockAt(0x00000010) char Signature[4]; // PK<0x03><0x04> WORD VersionNeededToExtract; WORD GeneralPurposeBitFlag; WORD CompressionMethod; DOSTIME LastModFileTime; DOSDATE LastModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FileNameLength; WORD ExtraFieldLength;};


Structure Settings

Hex Workshop v6.6 Structure Settings



Hex Workshop v6.6 Structure Settings


The following strings are reserved by Hex Workshop and cannot be used as structure or variable names:

Structure Constructs:struct, union, typedef, enum, switch, case, break, default, else, if, while,for, #include, #pragma, function

Data Types:signed, unsigned, bool, char, int, __int8, __int16, __int32, __int64,halffloat, float, double, DATE, DOSDATE, DOSTIME, FILETIME, zstring, time_t,time64_t, blob, short, long, Byte, UByte, Word, UWord, DWord, UDWord, QWord,UQWord

Functions:__min, __max, __byteflip16, __byteflip32, __byteflip64__addStructureAt

__getCaretPos, __getCaretSel, __getDocSize, __setCaretPos, __setCaretSel,__getAddrOf, __getSizeOf

__getByteAt, __getUByteAt, __getWordAt, __getUWordAt, __getDWordAt,__getUDWordAt, __getQWordAt, __getUQWordAt__setByteAt, __setUByteAt, __setWordAt, __setUWordAt, __setDWordAt,__setUDWordAt, __setQWordAt, __setUQWordAt__insertByteAt, __insertUByteAt, __insertWordAt, __insertUWordAt,__insertDWordAt, __insertUDWordAt, __insertQWordAt, __insertUQWordAt

Reserved Words:__parent__, __this__, __verify

Deprecated:addrof, sizeof, __size__, ubyteAt, ushortAt, ulongAt, uquadAt, byteflip16,byteflip32, byteflip64

Symbols:// /* */ ; { } [ ] ( ) , ? : + - * / % & | ~ ^<< >> == != || && < <= > >= = += -= *= /= %= &= |= ^= <<= >>= ++ --


Reserved Words and Symbols



Hex Workshop v6.6 Reserved Words and Symbols

Users Tools allow you to add custom applications and tools to the Hex Workshop environment. Custom applications areadded to the end of the Tools Menu and are managed by select "Customize..." from the Tools Menu.

Additionally, Hex Workshop allows you to add context sensitive variables in the "Arguments" setting of customize dialog.These variables pull information from the active document. If no document is in focus or a setting is not applicable then aspace is substitute for the variable. An overview of the variables are listed below:

Variable Description

$(FilePath) Fully qualified path to active document

$(FileDrive) Drive of the active document

$(FileDir) Directory of the active document

$(FileName) Filename of the active document

$(FileExt) File extension of the active document

$(DosFilePath) Fully qualified DOS (8.3) path to activedocument

$(CurrOffsetDec) Current address or offset in decimal

$(CurrOffsetHex) Current address of offset in hexadecimal

$(CurrSelectionDec) Current selection length in decimal

$(CurrSelectionHex) Current selection length in hexadecimal

User Tools



Hex Workshop v6.6 User Tools


OverviewExpressions are used by the Expression Calc and by the Structure Viewer. Expressions include arithmetic, logical, andbitwise operations; arithmetic and document functions; conditional statements; and the creation and manipulation ofatomic integer variables.

Literal ValuesLiteral values can be specified in either hex or decimal. For hex literals, prefix the value with "0x".

Examples:

-1, 0x0000FFFF, 100, 0x64

CommentsExpressions support single line and multiline comments. Comment are ignored during parsing and evaluation.

Single line commentsUsers can comment out a single line by entering "//" on that line. All text is ignored from the start of the comment until thenext line.

Multiline commentsUsers can comment multiple lines (or text within a single line) by wrapping the text between "/*" and "*/" charactersequences. Overlapping and nested comments are not supported.

Expression TypesSimple ExpressionsA Simple Expression consists of a single expression. For example: "1+2".

Compound ExpressionsA Compound Expression consists of multiple expressions delimited by semicolons (";"). For example: "variable2 =variable1; variable2 += 1".

More Information

Expressions Overview

Operations: Arithmetic, Bitwise, Logical, and Precedence

Functions: Arithmetic and Document

Conditionals and Loops

Variables

Expression Data Types

Structure Functions and Expression Calc




Hex Workshop v6.6 Expressions Overview


OperatorsOperator Description

+ Addition

- Subtraction

* Multiplication

/ Division

% Modulus Division

( ) Parenthesis (grouping)

Order of OperationsArithmetic Operations follow the standard mathematical order of operations:

1. Parenthesis

2. Exponents (not supported)

3. Multiplication

4. Division (including modulus division)

5. Addition

6. Subtraction

Examples1 + 2

2 * 5 + 1

2 * (5 + 1)

More Information





Variables



Arithmetic Operations



Hex Workshop v6.6 Arithmetic Operations


& Bitwise AND

| Bitwise OR

^ Bitwise XOR

<< Bitwise Left Shift

>> Bitwise Right Shift

~ Bitwise Complement

Examplesvariable & 0x000000FF

variable << 2

variable ^ 0xA5A5A5A5

More Information





Variables



Bitwise Operations



Hex Workshop v6.6 Bitwise Operations

OverviewLogical Operations enable that comparison of different values and return a boolean (0 for FALSE and 1 for TRUE)indicating the results of the comparison.


== Equals

!= Not Equals

|| Logical OR: Left-hand side or right-hand side must be true for the largerlogical operation to be true.

&& Logical AND: Left-hand side and right-hand side must be both true forthe larger logical operation to be true.

< Less than

<= Less than or equal

> Greater than

>= Greater than or equal

Examplesvariable == 2

variable != 1

(variable == 1) || (variable == 2)

variable < 3

More Information





Variables



Logical Operations



Hex Workshop v6.6 Logical Operations

FunctionsFunction Description

value __min(x, y) Returns x if less then y; otherwise y

value __max(x, y) Returns x if greater then y; otherwise y

UWord __byteflip16(x)UDWord __byteflip32(x)UQWord __byteflip64(x)

Returns a byte flipped version of x.

__byteflip16, __byteflip32, and __byteflip64 flips 16 bit, 32 bit, and 64bit integers, respectfully.

Please see Expression Data Types for information on the data typesign and size.

Examples__min(-1, 3)

__max(100, __getUDWordAt(0x2E))

__byteflip32(__getUDWordAt(0))

More Information





Variables



Arithmetic Functions



Hex Workshop v6.6 Arithmetic Functions


Caret and Selection FunctionsFunction Description

UQWord __getCaretPos() Get the current caret position within the editor's active documentview

UQWord __getCaretSel() Get the current selection length within the editor's activedocument view

UQWord__setCaretPos(offset)

Set the caret position within the editor

NOTE: Setting the caret position automatically clears anyselection.

UQWord__setCaretSel(length)

Set the selection length within the active document window.

Structure FunctionsFunction Description

UQWord __addStructureAt( offset, "structure name", "variable name")

Adds a structure of the specified name to the specified offset andreturns the length of the added structure.

If the expression is defined as part of a Structure Viewer function,the current library is used for resolving structure names.

If the expression is defined as part of the Expression Calc, theactive structure collection is used for resolving structure names.

Document Reading FunctionsFunction Description

UQWord __getDocSize() Returns the size of the editor's active document.

Byte __getByteAt(offset)

UByte __getUByteAt(offset)

Word __getWordAt(offset)

UWord __getUWordAt(offset)

DWord __getDWordAt(offset)

UDWord__getUDWordAt(offset)

QWord __getQWordAt(offset)

UQWord__getUQWordAt(offset)

Returns the value at the specified address. Each functionvariation returns a different sized value. The expression isaborted (fails) if unable to read at the specified offset.

If using a variable declaration to read or manipulate documentdata, that variable should be defined as a UQWord (unsigned 64bit integer).

Please see Expression Data Types for information on the datatype sign and size.

Document Manipulation FunctionsFunction Description

Byte __setByteAt(offset, value) Sets (overwrites) the value at the specified offset.

Document Functions

Hex Workshop v6.6 Document Functions


UByte __setUByteAt(offset, value)

Word __setWordAt(offset, value)

UWord __setUWordAt(offset, value)

DWord __setDWordAt(offset, value)

UDWord __setUDWordAt(offset, value)

QWord __setQWordAt(offset, value)

UQWord __setUQWordAt(offset, value)

The expression is aborted (fails) if it's unable tooperate at the specified offset. Otherwise, the newvalue is returned.

If using a variable declaration to read or manipulatedocument data, that variable should be defined as aUQWord (unsigned 64 bit integer).

Please see Expression Data Types for information onthe data type sign and size.

Byte __insertByteAt(offset,value)

UByte __insertUByteAt(offset,value)

Word __insertWordAt(offset,value)

UWord __insertUWordAt(offset,value)

DWord __insertDWordAt(offset,value)

UDWord __insertUDWordAt(offset,value)

QWord __insertQWordAt(offset,value)

UQWord __insertUQWordAt(offset,value)

Inserts the value at the specified offset. Theexpression is aborted (fails) if it's unable to operate atthe specified offset. Otherwise, the new value isreturned.

If using a variable declaration to read or manipulatedocument data, that variable should be defined as aUQWord (unsigned 64 bit integer).

Please see Expression Data Types for information onthe data type sign and size.

NOTE: The caret position and length is not modifiedwhen inserting data.

UQWord __deleteAt(offset, length) Deletes a range of data starting at the designatedoffset. The length is limited to a UDWORD.

Examples__setUByteAt(0x2E, __getUByteAt(0x2E) + 1)

__insertUWordAt(__getDocSize(), 0x0000) ;

More Information





Variables





Hex Workshop v6.6 Document Functions


Conditionalsif statementsThe if statement supports both simple and complex logical operations. if, else, and else if branches are supported withand without open and close braces ('{' and '}'). Unlike many programming languages, a semicolon is required at the endof the final close brace (if used).

Form 1:if (<expression>) <expression>;else if (<expression2>) <expression>;else <expression>;

Form 2:if (<expression>){ <expression1>; <expression2>;};

? : operatorThe ? operation can be used to define a simple if operation, and when combined with a : can include an else clause. The true and false branches each allow a single expression.

Form:<expression> ? <true expression> [: <false expression>]

If no : or <false expression> is included, the original expression is returned. For example:

0 ? 100, yields 01 ? 100, yields 100(1==1) ? 100 : 200, yields 100(1==0) ? 100 : 200, yields 1000

Note: Users must pay attention to operator precedence. The statement "1==1 ? 100 : 200" yields 0 since it isinterpreted as "1==(1 ? 100 : 200)", and 1 == 100 is false or 0.

switch statementThe switch statement resembles the C/C++ switch statement with the following exceptions:

1. The closing brace must include a semicolon

2. Users cannot consolidate expressions under multiple case statements. The following is not supported:

case 0x01:case 0x02: <expression>; break ;

3. Case statements are not checked for uniqueness.

Form:switch (<expression>){case <expression1>: <expression1a>; <expression1b>; break;

case <expression2>: <expression2a>; <expression2b>; break;

case <expression3>:


Hex Workshop v6.6 Conditionals and Loops

case <expression3>: <expression3a>; <expression3b>; break;

default: <expression4a>; <expression4b>; break;};

LoopsWhile and for loops resemble the C/C++ constructs, but with the following exceptions:

1. "break" and "continue" statements are not supported

2. The ending brace (if used) must include a trailing semicolon

3. Loops and expression aborted on error

while loopForm 1:while <expression1> <expression2>;

Form 2:while <expression1>{ <expression2>; <expression3>;};

for loopForm 1:for (<init expression>; <control expression>; <post expression>) <expression>;

Form 2:for (<init expression>; <control expression>; <post expression>){ <expression1>; <expression2>;};

More Information





Variables





Hex Workshop v6.6 Conditionals and Loops

Declaring VariablesFunction Description

Byte myByte

UByte myUByte

Word myWord

UWord myUWord

DWord myDWord

UDWord myUDWord

QWord myQWord

UQWord myUQWord

Declares a variable of the specified name. The variable is globalto the entire expression (or Structure Function). The expression willfail and abort if the variable name already exists.

Variable is initialized to zero at time of declaration and the value isreturned.

Please see Expression Data Types for information on the data typesign and size.

Variable OperatorsOperator Description

= Assignment / equals, sets the variable's value.

+= Equivalent to variable = variable + <expression>. See Arithmetic Operators for moreinformation.

-= Equivalent to variable = variable - <expression>. See Arithmetic Operators for moreinformation.

*= Equivalent to variable = variable * <expression>. See Arithmetic Operators for moreinformation.

/= Equivalent to variable = variable / <expression>. See Arithmetic Operators for moreinformation.

%= Equivalent to variable = variable % <expression>. See Arithmetic Operators for moreinformation.

&= Equivalent to variable = variable & <expression>. See Bitwise Operators for moreinformation.

|= Equivalent to variable = variable | <expression>. See Bitwise Operators for moreinformation.

^= Equivalent to variable = variable ^ <expression>. See Bitwise Operators for moreinformation.

<<= Equivalent to variable = variable << <expression>. See Arithmetic Operators for moreinformation.

>>= Equivalent to variable = variable >> <expression>. See Arithmetic Operators for moreinformation.

++ Equivalent to variable = variable + 1

-- Equivalent to variable = variable - 1

Variables

Hex Workshop v6.6 Variables

ExamplesUQWord i;UWord count;for (i=0; i<100; i++){ count += __getUByteAt(i);};count;

More Information





Variables





Hex Workshop v6.6 Variables

Type Description

Byte signed 8 bit integer

UByte unsigned 8 bit integer

Word signed 16 bit integer

UWord unsigned 16 bit integer

DWord signed 32 bit integer

UDWord unsigned 32 bit integer

QWord signed 64 bit integer

UQWord unsigned 64 bit integer

More Information





Variables






Hex Workshop v6.6 Expression Data Types


Expressions follow the standard C/C++ operator precedence. In the table below, expressions are evaluated from high tolow priorities. Operators at the same priority are evaluated from left-to-right.

Priority Operators Comments

1 ( ) Parenthesis (grouping)

2 Literals, Functions, ++, and -- Post increment (++) and Postdecrement (--)

3 !, ~ Logical Negation (NOT) and Bitwisecomplement

4 * Multiplication

5 /, % Division and Modulus Division

6 +, - Addition and Substraction

7 <<, >> Bitwise Left and Right shift

8 <, <=, >, >= Greater than/Less than Comparisons

9 ==, != Equals Comparisons

10 & Bitwise AND

11 ^ Bitwise XOR

12 | Bitwise OR

13 && Logical AND

14 || Logical OR

15 =, +=, -=, *=, /=, %=, &=, ^=, |=, <<=,>>=

Assignments

More Information





Variables



Operator Precedence



Hex Workshop v6.6 Operator Precedence

PreferencesHex Workshop Preferences Dialog is launched by either selecting "Preferences..." from the "Options" menu or bypressing the Preferences icon on the File Operations Toolbar.

Preferences are organized under 4 major categories: Display Options, Configuration, Tool Options, and Import/Exportfollowed by sub-categories.

The "All Settings" button allows users to reset all preferences to default settings or import/export settings. The "Help"button displays help for the selected preference sub-category.

SettingsOpen Documents Maximized within editor frameWhen enabled (checked), Hex Workshop will always open files or disks with their editing window maximized. Thissetting is ignored when comparing documents the source and target file may be tiled horizontally or vertically. TheDefault is enabled.

Display documents in Tabbed Workbook ModeWhen enabled (checked), Hex Workshop displays a tab for each opened file in list located under the editor window. Atthe expensive of screen real estate, it allows the user to quickly switch between opened documents. The Default isenabled.

Group Bytes byWithin the rows, data is broken up into columns to make viewing the data easier. The Column preference allows the userto choose how this data is grouped. For example, if data is grouped in 4 bytes (or longs), there would be 4 columns of 4bytes in each row of hexadecimal data (assuming 16 bytes per row). The default is group by 1 byte (8 bits).

The Group By setting can also be changed in the editor by clicking and dragging the column separators in on theheader. When updating by dragging columns, the setting is not saved across application restarts and is only applied tothe active document. Use the preference setting to change the default for all documents.

Fit Contents to Window (automatic bytes per row calculation)If enabled (checked), Hex Workshop will fill automatically calculate the bytes per row to be displayed in the editor by thesize of the window. The maximum displayed byte per row is 128. See Bytes per Row below for more information. Thedefault is enabled.

Bytes per RowSpecifies the amount of data that is displayed for each row (or line) within the editor. Users can specify between 1 and128 bytes or have the Byte per Row calculated automatically based on the window size (see Fit Contents to Windowabove). The value must be an even multiple of the column group by length (see below). The default is 16 bytes per row.

To enter a fix bytes/row value, "Fit Contents to Window" must be disabled (unchecked).

The Byte per Row setting can also be changed in the editor by clicking and dragging the column separators between thehex area and the text area. When updating by dragging columns, the setting is not saved across application restarts

General Display Options Preferences

Hex Workshop v6.6 General Display Options Preferences


and is only applied to the active document. Use the preference setting to change the default for all documents.

Show Offset HeaderIf enabled (checked), Hex Workshop will display a header above the Hex and Text areas within the editor window. Theheader displays the offset for each of the columns in either hex or decimal and highlights both the current caret positionand the mouse-over position.

Offset LengthThe displayed length of the offset address can be adjusted from 4 to 12 character in length. Users may also drag thedivider line in the editor to adjust this value. The default is 8 characters.

The Offset Length setting can also be changed in the editor by clicking and dragging the column separators between theoffset address list the hex area. When updating by dragging columns, the setting is not saved across applicationrestarts and is only applied to the active document. Use the preference setting to change the default for all documents.

Display Tooltips and Pop-up Information in editorHex Workshop display context information within the editor if you leave the mouse over highlighted data. The default isenabled.

Automatically Flip Bytes In EditorHex Workshop includes a feature to swap the byte order of the document data based on the Group Bytes By size. Flipping bytes allow uses to view data in its natural byte order.

This settings control whether the Byte Flip Options (Ctrl+Alt+Shift+B) is set when switching between Little Endian andBig Endian byte order from the Environment Toolbar.

Default is disabled.

NOTE: The Flip Bytes in Editor setting only controls the displayed hex values and individual character editing within theeditor. Copy, Paste, and other editing features continue to use the bytes as ordered in the file or sector.



Hex Workshop v6.6 General Display Options Preferences


Hex Workshop v6.6 Font & Filter Display Options Preferences





SettingsShow Setting ForHighlight Description

Offset Area Controls the foreground and background colors of the offsetaddress area (left side of editor window) and the editor header(top of edit window).

Odd Hex Column Area Controls the hex foreground and background colors of oddnumbered hex columns. Odd and Even columns color settingsare separated to allow for easier viewing of data.

Even Hex Column Area Controls the hex foreground and background colors of evennumbered hex columns. Odd and Even columns color settingsare separated to allow for easier viewing of data.

Text Area Controls the foreground and background colors of the text area(right side of editor).

Separator Line Controls the color of separator lines display between the offset,hex, and text area within the editor and between columns in theeditor header.

Offset Caret Controls the foreground and background colors of the caretposition (editing caret -- not mouse cursor) within the offset andheader areas.

Offset Cursor Controls the foreground and background color of the mousecursor position within the offset and header areas.

Modified Bytes Controls the foreground, background, and border rectanglecolors for data modified within the editor, but not yet saved.

Color Settings Display Options Preferences

Hex Workshop v6.6 Color Settings Display Options Preferences


Find All Controls the foreground, background, and border rectanglecolors for data found as part of a "Find All Instances" search.

Selected Find All Controls the foreground, background, and border rectanglecolors for a "Find All Instances" item selected in the Find tab ofthe Results Window.

Selected Structure Controls the foreground, background, and border rectanglecolors for a structure element selected in the Structure Viewerwindow.

Selected Structure Odd Controls the foreground, background, and border rectanglecolors for odd indexed structure element members.

The structure selected odd and even settings allow users to viewdata boundaries of data elements with the editor.

Selected Structure Even Controls the foreground, background, and border rectanglecolors for even indexed structure element members.

The structure selected odd and even settings allow users to viewdata boundaries of data elements with the editor.

Unselected Structure Controls the foreground, background, and border rectanglecolors of unselected structures.

By default, Hex Workshop defines a border rectangle to allowusers to view structure boundaries.

Selected Bookmark Controls the foreground, background, and border rectanglecolors of selected bookmarks.

Unselected Bookmark Controls the foreground, background, and border rectanglecolors of selected bookmarks.

By default, Hex Workshop defines a border rectangle to allowusers to view structure boundaries.

Compare Matched Data Controls the foreground, background, and border rectanglecolors of data marked as a match during a comparisonoperation.

Compare Inserted Data Controls the foreground, background, and border rectanglecolors of data marked as a inserted during a comparisonoperation.

Compare Deleted Data Controls the foreground, background, and border rectanglecolors of data marked as a deleted during a comparisonoperation.

Compare Replaced Data Controls the foreground, background, and border rectanglecolors of data marked as a replaced during a comparisonoperation.

Selected Compare Item Controls the foreground, background, and border rectanglecolors of an item selected in the Compare tab of the ResultsWindow.

Selected Data Inspector Item Controls the foreground, background, and border rectanglecolors of data that will be modified from the Data Inspector.

These attributes are applied when the user selects an item in theData Inspector.



Use DefaultThe "Use Default" button reverts the selected color setting back to the original Hex Workshop default.

Use Same colors for Hex and Ascii AreasIf checked, users can specify different color settings for the hex and text areas within the editor. If unchecked, colorsettings will be used for both the hex and text areas within the editor.

Disable color Highlight in editorDisabled color rendering for the selected color setting. This options allows users to temporarily disable color settingswithout clearing selected colors.








SettingsColor Rendering PriorityThe rendering priority specifies how Hex Workshop displays highlighted data if that data is highlighted by multiplesources. For example, data could be modified (Altered Data Highlights) and also tagged as part of a structure definition(Structure Highlights). The default color rendering priority (show above) picks altered data highlights over structurehighlights.

Hex Workshop merges the color highlights when displaying data. This settings only controls the highlighting prioritywhen color highlights conflict. If one color highlight sets a background color and another sets a foreground color, datawill be displayed with both the background color and foreground color highlights (no conflicts).

Color Priority Display Options Preferences



Hex Workshop v6.6 Color Priority Display Options Preferences





SettingsFloat PrecisionThe Float Precision settings controls how many significant digits are displayed when rendering a floating point value. This setting controls the display for the Data Inspector, Structure Viewer, and Bookmarks.

Double PrecisionThe Double Precision settings controls how many significant digits are displayed when rendering a floating point value. This setting controls the display for the Data Inspector, Structure Viewer, and Bookmarks.

Precision Display Options Preferences



Hex Workshop v6.6 Precision Display Options Preferences





SettingsDisplay ThemesA display theme is a collection Display Options (All options under Display Options in Preferences). Themes aredesigned to allow users to save and easily switch between sets of font and colors. By default, Hex Workshop includetwo themes: Default and Black. Themes are loaded and applied to the Current Settings. Changing color and fontswithin Preference will update the Current Settings.

LoadPressing the Load button will load a theme into the Current Settings. Press the "OK" button view the applied settingswithin the Hex Workshop Editor.

NewPressing the "New" button allows users to create a named theme based on either the Current Settings, Hex Workshop'sdefaults, or a previously saved theme.

SavePressing "Save" overwrites the selected theme with the Current Settings.

DeletePressing "Delete" removes the selected theme.

Rename

Theme Display Option Preferences

Hex Workshop v6.6 Theme Display Option Preferences


Pressing "Rename" allows users to change the name of the selected theme.

ImportPressing "Import" allows users to import a previously exported theme. Import and Export allows users to transfersettings between computers and users.

ExportPressing "Export" allows users to export a theme for use on another computer or backup. Alternatively, users can exportall of the preferences from the "All Settings" button.



Hex Workshop v6.6 Theme Display Option Preferences


That character filter editor is invoked by pressing the New, Edit, or View buttons in Font & Filter Display OptionsPreferences. The editor allows you to change which characters are displayed for each hexadecimal byte value.Additionally, you can specify the foreground color for characters and control the reverse mapping of characters enteredin the text area of the Hex Workshop Hex Editor.

View Characters AsThe drop down choice box in the upper right corner of Editor allows you to view the Map From and Map To columns asHexadecimal values, decimal values, or as characters. The default value is Hexadecimal.

Map Selection ToThe group of controls within the Map Selection To group are used to apply changes to a one or more character maps.The table supports multiple selections and users may use the shift and control keys to select additional character maps.The Apply button must be pressed to commit changes.

CharacterThis edit box contains the character that will be displayed in the text tab of the Hex Workshop Hex Editor when the hexdata contains the hexadecimal value in the "Map From" column. You can either: enter a character here, enter thecharacter's hexadecimal value in the Hex edit box, or enter the character's decimal value in the Dec edit box As aconvenience, the character filter editor will fill in the character's values in the other edit boxes when changed. The Applybutton must be pressed to commit changes.

HexThis edit box contains the hexadecimal value of the character that will be displayed in the text tab of the Hex WorkshopHex Editor when the hex data contains the hexadecimal value in the "Map From" column. You can enter the hexadecimalvalue here, enter the character directly in the Character edit box, or enter the character's decimal value in the Dec editbox As a convenience, the character filter editor will fill in the character's values in the other edit boxes when changed.The Apply button must be pressed to commit changes.

DecThis edit box contains the decimal value of the character that will be displayed in the text tab of the Hex Workshop HexEditor when the hex data contains the hexadecimal value in the "Map From" column. You can either: enter the decimalvalue here, enter the character directly in the Character edit box, or enter the character's hexadecimal value in the Hexedit box As a convenience, the character filter editor will fill in the character's values in the other edit boxes whenchanged. The Apply button must be pressed to commit changes.

ColorUsers can specify the foreground color that each map is displayed in. A sample of the current color immediatelyfollowings the "Color:" label. A color of "default" indicates that Hex Workshop should use the default Odd Hex Color,Even Hex Color, or Text Color.

Press the button labelled "..." to pick a new color or press the "def" button to restore the default color.

Character Filter Editor

Hex Workshop v6.6 Character Filter Editor


Reverse MapThis settings allows you to configure whether entering the "Map To" character in the text area of the Hex Workshop HexEditor (character entered in same Map Selection To group) should map back to the Map From character. For example,the default ASCII filter maps a 0x00 to 0x2E ('.') because a zero/null value is not viewable. However, when a user enters a'.', we want a 0x2E inserted and not a 0x00 character. For this reason Reverse Map is disabled in this case. In othercases, you may want to reverse map characters.

NOTE: The Character Filter Editor performs some simple checks when the OK button is pressed and will reportconflicting reverse maps (i.e., multiple characters that map to different results).



Hex Workshop v6.6 Character Filter Editor





SettingsPrompt for file backup when savingWhen checked Hex Workshop will ask if a backup should be created whenever an altered file is saved. A backup filewith the extension .BAK is created if requested. Default is checked.

Warning on Insertion/DeletionWhen checked Hex Workshop will post a warning message (dialog box) before allowing an insert or delete of bytes inan open file. Default is checked.

Notification of Goto and Find WrappingWhen checked Hex Workshop will prompt the user whether or not to wrap the file (move from the end to the beginning orvice-versa) during the Goto, Find/Replace, or Compare Operations. Default is checked.

Notification if operation exceeds undo buffer sizeWhen checked Hex Workshop will post a warning message (dialog box) before allowing an operation that cannot beundone. Default is checked.

Undo Buffer (KB)Specifies the size of the buffer used by Hex Workshop for maintaining a list of previous editing operations. This is usedwhen the undo command is selected, the larger the buffer the more operations which can be saved and undone later, ifrequested. Default is 256 KB.

Define KeycutsHex Workshop allows users to update and add new keyboard shortcuts for frequently used operations. See KeyboardShortcuts for default keyboard shortcut definitions.

General Configuration Preferences

Hex Workshop v6.6 General Configuration Preferences


Users can view, edit, and create new shortcut sequences for frequently used operations.

Print Page SetupThe Page Setup settings allow users to customize the header, footer, font, displayed bytes per row, and margins forprinting.



Hex Workshop v6.6 General Configuration Preferences





SettingsShow Settings forPath Setting Description

Open From The default open path used when opening files.

Options: Last used or user-defined path

Save To The default save path used when saving files.


Import From The default open path used when importing files.


Export To The default open path used when exporting files.


Compare Source The default open path used when selecting a comparison sourcefile.


Compare Target The default open path used when selecting a comparison targetfile.


Temporary Files The default directory used for temporary files.

Options: System default or used-defined.

Paths Configuration Preferences

Hex Workshop v6.6 Paths Configuration Preferences


Structures The default directory used to find structure definition files.

Options: Installation default or used-defined.

Bookmarks The default directory used to find bookmark definition files.


Color maps The default directory used to find color map definition files.


Character Filters The default directory used to find character filter definition files.


Palette Directory The default directory used to find palette files for use with theData Visualizer.


Used Last <setting> DirectoryCheck to use the last-used directory or Uncheck to specify a path.

Use Default DirectoryCheck to use the default directory or Uncheck to specify a path.



Hex Workshop v6.6 Paths Configuration Preferences




SettingsAdd "Hex Edit" to system right-click context menuWhen checked Hex Workshop will install a Windows Context Menu Shell Extension so whenever the right mouse buttonis clicked on a file, a "Hex Edit using Hex Workshop" menu item will appear. Clicking on the Hex Edit menu item willautomatically launch Hex Workshop with the selected file(s) to open. Users can also click on the root directory of drives(e.g. "C:\") to invoke the sector editor. Default is enabled.

Allow Multiple Instances of Hex Workshop to runWhen checked Hex Workshop allows multiple instances of itself to be run. If not checked, launching Hex Workshop fromanywhere will result in the previously running instance moving to the foreground with the selected files open ifappropriate. Default is disabled.

Enable Direct File editing (no temporary files)Hex Workshop supports a direct edit mode which allows you to modify files with out creating a temporary work file. Thisfeature is useful when users need to modify very large documents and do not have enough free disk space for acomplete working copy. All changes are made immediately to the source file and the users should backup their databefore editing.

The Status Bar will display a "DIR" in the last pane when a file is opened under direct editing mode. The "save"command is also disabled when direct file editing is enabled.

Default is disabled.

Postpone write initialization until neededWhen checked Hex Workshop will delay creating a temporary working copy of your data until you first modify the file. The default is enabled.

Allow Plug-in auto executionHex Workshop's plug-in framework allows a plug-in to register for file extensions and automatically executed when a fileis opened. This settings can be used to disable that behavior.

Default is enabled.

Advanced Configuration Preferences

Hex Workshop v6.6 Advanced Configuration Preferences




Hex Workshop v6.6 Advanced Configuration Preferences


Hex Workshop provides the ability to print customized printouts (hex dumps) with a Page Setup feature. Using the PageSetup users can use a custom header and/or footer, printer font, and margins.

Header/Footer:The header and footer can consist of any valid text. Using special codes (listed to below) users can print the filename orfull path, current page number, total pages, and time and date in a number of different formats. In addition, any portion orall of the headers and footers can be left, center, or right justified using these special codes:

Font:The font which is used to print all data. This can be changed to any monospace font on the users system. The default isCourier 12 point.

Bytes/Row:You can specify how many bytes are printed on a single low (line). The default is 16 bytes per row.

Margins:The left, right, top, and bottom margin can be set for printouts. The default is 0.50 inches for all margins.

Page Setup



Hex Workshop v6.6 Page Setup


Updating ShortcutsYou may modify existing or create new keyboard shortcut sequences for frequent tasks by selecting "Define Keycuts"from the "Options" menu or from the General Display Options Preferences.

Default ShortcutsShortcut Description

F1 Help (Contents)

F2 Tile Windows Horizontally

Alt+F2 Tile Windows Vertically

Ctrl+F2 Cascade Windows

Ctrl+I Show/Hide Data Inspector Window

Ctrl+W Show/Hide Results Window

Ctrl+N Create New File

Ctrl+O Open File

Ctrl+D Open Drive

Ctrl+S Save File or Sector

Ctrl+P Print

Ctrl+C Copy

Ctrl+V Paste

Ctrl+X Cut

Ctrl+Z Undo

Ctrl+Y Redo

Ctrl+Ins Insert

Ctrl+F Find

F3 Find Next

Shift+F3 Find Previous

Ctrl+H Replace

Ctrl+F3 Find Selected (next/downwards)

Ctrl+Shift+F3 Find Selected (previous/upwards)

Keyboard Shortcuts

Hex Workshop v6.6 Keyboard Shortcuts


Ctrl+G Goto

F5 Goto Again

Shift+F5 Goto Previous (jump backwards)

Ctrl+B Add Bookmark

F7 Next Bookmark

Shift+F7 Previous Bookmark

Ctrl+Shift+B Select Bookmark File

Ctrl+M Add Color mapping

Ctrl+Shift+M Select Colormap File

Ctrl+L Add Structure

Ctrl+Shift+L Select Structure Library

Ctrl+K Compare Files

Ctrl+R Recompare Files

F6 Next Difference

Shift+F6 Previous Difference

Alt+Enter Properties of File/Sector

Tab Toggles between Hex and ASCII in main edit window

Ctrl+U Toggles between ASCII and Unicode text entering modes.

Home Goto Beginning of File/Sector

End Goto End of File/Sector

Alt+Up Goto Previous Sector (Drive Editing Only)

Alt+Dn Goto Next Sector (Drive Editing Only)

Alt+PgUp Jump Back 10 Sectors (Drive Editing Only)



Alt+PgDn Jump Ahead 10 Sectors (Drive Editing Only)

Alt+Home Goto First Sector (Drive Editing Only)

Alt+End Goto Last Sector (Drive Editing Only)

Ctrl+Shift+G Goto Sector (Drive Editing Only)

Ctrl+Alt+Shift+G Goto Sector Again (Drive Editing Only)








SettingsWhen select bookmarksUsers can define the edit caret position and editor selection when selecting a bookmark item. Available options arelisted below:

Scroll Data Into View Moves the data into view, but does not adjust the caretposition.

Set Caret Position in Editor Scrolls the bookmark data into view and moves thecaret position to the start of the bookmark.

Select Data In Editor Scrolls the bookmark data into view and sets theeditor selection to match the bookmark data.

Prompt to save when closing a file containing unsaved bookmarksIf checked (enabled), Hex Workshop will prompt to save new or modified bookmark collections upon closing a file. Thedefault is enabled.

Automatically load bookmark collections by file extensionIf checked (enabled), Hex Workshop will automatically load and apply bookmarks based on the file extension. Thedefault is enabled.

Bookmark file extension associationsUsers can define a mapping between file extensions and bookmark files by pressing the "+" button to add new entriesor the "-" button to remove entries.

Bookmarks Tool Options Preferences



Hex Workshop v6.6 Bookmarks Tool Options Preferences





SettingsShow Character HistogramCheck (enable) to include a character distribution graph of your data. The default is enabled.

Show Character Distribution BitmapCheck (enable) to include a graph showing the distribution of characters across a file or selection. The default isenabled.

Char Distributions Tool Options Preferences



Hex Workshop v6.6 Char Distributions Tool Options Preferences





SettingsPrompt to save when closing a file containing unsaved colormapsIf checked (enabled), Hex Workshop will prompt to save any new or modified color maps upon closing a file. The defaultis enabled.

Color Maps Tool Options Preferences



Hex Workshop v6.6 Color Maps Tool Options Preferences





SettingsResync WindowThis is option is used to limit how far (in bytes) the compare tool will search for an insertion or deletion. A higher numbermay yield more accurate results, however, will take an exponentially longer time to execute. Lowering the number willspeed up the comparison, but may result in more replacements instead of insertions and deletions.

The default value is 2048 bytes.

Match BytesThis option is used to tell the compare tool how many bytes must be identical before a match is reported.

The default value is 32 bytes.

Default Comparison Dialog withThe Comparison Dialog can be defaulted with either the Last Compared Files or Open Documents. The default is LastCompared Files.

When displaying result filesWhen performing a comparison, Hex Workshop can align the files to better compare differences. Available options arelisted below:

Do not Tile Files Open the files, but do not tile the files (place themside-by-side)

Tile Files Vertically Tile the files vertically (side-by-side)

Tile Files Horizontally Tile the files horizontally (one on top, one on bottom)

When selecting resultsUsers can define the edit caret position and editor selection when selecting a comparison item from the Compare tab ofthe Results Window. Available options are listed below:

Compare Tool Options Preferences

Hex Workshop v6.6 Compare Tool Options Preferences



Set Caret Position in Editor Scrolls the data into view and moves the caretposition to the start of the bookmark.

Select Data In Editor Scrolls the data into view and sets the editor selectionto match the bookmark data.



Hex Workshop v6.6 Compare Tool Options Preferences





SettingsWhen selecting find resultsUsers can define the edit caret position and editor selection when selecting a find item from the Find tab of the ResultsWindow. Available options are listed below:




Default to searching entire document (as opposed to selection)This setting defines the default search range when using the Find/Replace Utility on documents. If checked, HexWorkshop defaults to searching the entire document regardless of any selection. If unchecked, Hex Workshop defaultsto limiting search results to the selected document region (or entire document if no selection is made. Users canoverride this default for each search by changing options on the Find/Replace Utility's Range tab.

Find Tool Options Preferences



Hex Workshop v6.6 Find Tool Options Preferences





SettingsWhen selecting locked structureUsers can define the edit caret position and editor selection when selecting a locked structure from the Structure Viewer. Available options are listed below:




Floating structures are applied to the current edit caret position and cannot change the caret position or selection. Selecting a floating structure will scroll the data into view without adjusting the caret position or selection.

Structure Viewer Tool Options Preferences



Hex Workshop v6.6 Structure Viewer Tool Options Preferences





SettingsDefault Variable NameDefines the variable name used in the C Source or Java Source export of the users data.

Data TypeSpecified the data type used for a C Source or Java Source export. Choices include 8 bit, 16 bit, 32 bit, and 64 bit datatypes.

Bytes Per LineDefines the number of data bytes to include on each line of C Source or Java source export array definition.

Swap Byte OrderAllows users to swap the byte order (e.g. big endian vs little endian) of their data when exporting to C Source or JavaSource arrays. The default is disabled.

Limit Array LengthAllows users to set the maximum array size for C or Java source export. If a user tries to export data larger then themaximum size defined, Hex Workshop will output multiple chunks of data into separate arrays. This feature was addedto address the a maximum array size limitation in some compilers. By default, this is disabled.

Pad uneven selections with hex byteDefines the handling of uneven file sizes or selections when exporting as C and Java source. If the selection or file sizeis not an even multiple of the data type, Hex Workshop can either:

1. Truncate the data by unchecking this parameter

2. Pad the data with the specified hex byte by checking this parameter

The default is unchecked (or truncate data).

C Source Import/Export Preferences



Hex Workshop v6.6 C Source Import/Export Preferences





SettingsUse Display Settings to determine Group By and Bytes Per LineChecking this setting will export your document with the same Bytes Per Line and Group By configuration as seen in theeditor. The default is checked.

Bytes Per LineThis setting controls the amount of data displayed on each line or row. Valid values range from 1 to 64, however, thisvalue must be a multiple of the Group By setting. The default is 16.

Group Data ByThe Group By controls how much data is grouped together before a breaking white space. Value options are 1, 2, 4, 8,or 16. The default is 2.

Export ColorChecking this setting will export color to the format. The default is checked.

HTML Import/Export Preferences



Hex Workshop v6.6 HTML Import/Export Preferences





SettingsFill Empty BytesHex Workshop fills unspecified memory with this byte when importing Intel Hex Code or Motorola S-Records. Forexample, if the hex code or s-records does not supply data for a particular block of memory, this data byte will be usedas fill. The default value is 0x00.

Bytes Per LineDefines the number of data bytes to include on each line of output. The default is 16.

Intel Hex Code Import/Export Preferences



Hex Workshop v6.6 Intel Hex Code Import/Export Preferences





SettingsDefault Variable NameDefines the variable name used in the C Source or Java Source export of the users data.

Data TypeSpecified the data type used for a C Source or Java Source export. Choices include 8 bit, 16 bit, 32 bit, and 64 bit datatypes.

Bytes Per LineDefines the number of data bytes to include on each line of C Source or Java source export array definition.

Swap Byte OrderAllows users to swap the byte order (e.g. big endian vs little endian) of their data when exporting to C Source or JavaSource arrays. The default is disabled.

Limit Array LengthAllows users to set the maximum array size for C or Java source export. If a user tries to export data larger then themaximum size defined, Hex Workshop will output multiple chunks of data into separate arrays. This feature was addedto address the a maximum array size limitation in some compilers. By default, this is disabled.

Pad uneven selections with hex byteDefines the handling of uneven file sizes or selections when exporting as C and Java source. If the selection or file sizeis not an even multiple of the data type, Hex Workshop can either:

1. Truncate the data by unchecking this parameter

2. Pad the data with the specified hex byte by checking this parameter

The default is unchecked (or truncate data).

Java Source Import/Export Preferences



Hex Workshop v6.6 Java Source Import/Export Preferences





SettingsFill Empty BytesHex Workshop fills unspecified memory with this byte when importing Intel Hex Code or Motorola S-Records. Forexample, if the hex code or s-records does not supply data for a particular block of memory, this data byte will be usedas fill. The default value is 0x00.

Bytes Per LineDefines the number of data bytes to include on each line of output. The default is 16.

Motorola S-Records Import/Export Preferences



Hex Workshop v6.6 Motorola S-Records Import/Export Preferences








Export ColorChecking this setting will export color to the format. The default is checked.

RTF Import/Export Preferences



Hex Workshop v6.6 RTF Import/Export Preferences








Text Import/Export Preferences



Hex Workshop v6.6 Text Import/Export Preferences


Hex Workshop includes a Base Converter (BCONV16.EXE or BCONV32.EXE, in the 16 or 32 bit version,respectively). The Base Converter converts from hex to decimal and decimal to hex (while displaying binary). For aconversion the user can specify byte order (Little Endian/Intel, Big Endian/Motorola, or Raw Hex) and Data Type (byte,unsigned byte, short, unsigned short, long, unsigned long, float, or double).

The Base Converter includes an Always on Top (Ctrl+A) option accessible from the system menu.

Note: When entering hex values with the Byte Order set on Intel or Motorola, the Base Converter will only convert anddisplay a decimal value when the number of digits is exactly the number appropriate for the selected Data Type. Forexample, if the Byte Order is set to Intel and the Data Type is set to unsigned short a decimal value will only be displayedwhen 4 hex digits are entered. This is necessary to avoid assumptions on zero padding (right or left) before byte flipping.When the Byte Order is set to Raw Hex, then a decimal value will be displayed when the number of digits is less than orequal to that for the selected Data Type (left padding of zeros is assumed).

Base Converter



Hex Workshop v6.6 Base Converter


Hex Workshop includes a Hex Calculator (CALC16.EXE or CALC32.EXE, in the 16 or 32 bit version, respectively). TheHex Calculator operates in two modes; arithmetic mode and bit manipulation mode. The arithmetic mode supportsaddition (+), subtraction (-), multiplication (*), and division (/) and the bit manipulation mode supports logical or (|), logicaland (&), exclusive or (^), negation (~), left shift (<<), and right shift (>>). Both modes operate on hex or decimal unsignedlong values and do not allow negative numbers or fractions.

The left shift (<<) and right shift (>>) operators require a second value specifying the amount of bytes to shift. Forexample to left shift 0xFF by 1 bit, enter FF << 1 =., by 4 bits enter FF << 4 =. Further it should be noted the left and rightshift do not rotate the most significant and least significant bit (because that would be dependent on data type).

The mode can be toggled from the system menu or using the Ctrl+S keycut. The calculator can be toggled between hexand decimal by clicking on the "HEX" or "DEC" in the display or using the spacebar, and the calculator can be switchedinto hex or decimal mode using the keycuts, Ctrl+H and Ctrl+D, respectively.

The Calculator includes an Always on Top (Ctrl+A) option accessible from the system menu.

Hex Calculator



Hex Workshop v6.6 Hex Calculator

Hex Workshop allows users the ability to open files, logical drives, and physical drives via the command line.

Usage: hworks32 [file|drive|fixeddisk|/HEXCODE:file|/SRECORDS:file [/READONLY]

[/FILELIST] [/GOTO:address] [/SELECT:count] /BOOKMARKS:file]

hworks32 [file [/COMPAREWITH:file2]]

Attribute/Option Description

file Opens the specified file. Please place quotes around paths with spaces.

drive Opens a Logical Drive in the form 'X:', where X is the drive letter. A: for Drive A:, C: forDrive C:, etc.

fixeddisk Open a Physical Drive in the form '/F:x', where x is the fixed disk number:

/F:80 for the first fixed disk

/F:81 for the second fixed disk

...

/READONLY Open the resource in read-only mode. This disables all write operations.

/FILELIST Open the resource as a CrLf delimited text file and then open each individual filespecified within it.

/GOTO:x Places the editor caret at the specified offset 'x'. Values are interpreted as decimalvalues unless prefixed with "0x" when they are interpreted as hexadecimal values.

/SELECT:x Select 'x' bytes from the current editor caret position. If a /GOTO is not specified, HexWorkshop will select data starting from offset 0.

/SRECORDS:file Import the specified file as Motorola S-Records.

/HEXCODE:file Import the specified file as Intel Hex Code.

/COMPAREWITH:file Compare the source file with this target file. This parameter is only valid for file types(not drive, fixeddisk or imports). The default window size and match bytes are used. Astarting offset of zero is used for both files.

/BOOKMARKS:file Load and apply the bookmark file to the file, drive, or fixed disks.

Examples: c:\hexworks\hworks32 foobar1.bin foobar2.bin

The command above will start Hex Workshop with the files "foobar1.bin" and "foobar2.bin" loaded in the editor.

c:\hexworks\hworks32 C:

This will start Hex Workshop with the logical "C:" drive loaded in the sector editor.

c:\hexworks\hworks32 /F:80 /READONLY

The command above will start Hex Workshop with the first physical disk loaded in the sector editor. The sector will beloaded in "read-only" mode so no sectors can be modified.

Command Line Usage

Hex Workshop v6.6 Command Line Usage


c:\hexworks\hworks32 foobar3.bin /GOTO:300 /SELECT:0x100

This will start Hex Workshop with foobar3.bin loaded in the editor. The editor caret will be placed at offset 300 (0x012C)and 256 bytes (0x100) will be selected.

c:\hexworks\hworks32 /SRECORDS:mykernel.mot /GOTO:0x1000

This will start Hex Workshop, import mykernel.mot as Motorola S-Records, and place the caret as offset 0x1000.

c:\hexworks\hworks32 file1 /COMPAREWITH:file2

This will start Hex Workshop, and start a resynchronizing compare operation between file1 (source) and file2 (target).

c:\hexworks\hworks32 myIcon.ico /BOOKMARKS:icon.hbk

This will start Hex Workshop, load myIcon.ico into the editor and apply bookmarks found in icon.hbk. Hex Workshopslooks for bookmark files in the Bookmarks directory if a full path is not specified and unable to load the file from thecurrent working directory.



Hex Workshop v6.6 Command Line Usage


Name Size (bytes) Range of Values

signed byte 1 -128 to 127

unsigned byte 1 0 to 255

signed short 2 -32,768 to 32,767

unsigned short 2 0 to 65,535

signed long 4 -2,147,483,648 to 2,147,483,647

unsigned long 4 0 to 4,294,967,295

signed quad 8 -9223372036854775808 to 9223372036854775807

unsigned quad 8 0 to 18446744073709551615

float 4 3.4E +/- 38

double 8 1.7E +/- 308

long double 10 1.2E +/- 4932

Data Types





Hex Workshop supports both Big Endian and Little Endian byte ordering. These terms are used to describe the order inwhich bytes are stored in memory.

In Big Endian byte ordering, the most significant byte is stored first. For example, the decimal number 1,000 would bestored as 0x03E8 and the decimal number 100,000 would be stored as 0x000186A0.

In Little Endian byte ordering, the least significant byte is stored first. For example, the decimal number 1,000 would bestored as 0xE803 and the decimal number 100,000 would be stored as 0xA0860100

You can observe that changing the most significant or first byte of a Big Endian number from 0x03E8 to 0x04E8(decimal 1,256) causes a more significant change than changing the least significant or first byte of Little Endian number0xE803 to 0xF803 (decimal 1,016).

Hex Workshop will interpret these decimal values based on the byte ordering environment settings. You can also use theByte Flip operation to convert between different byte ordering.

Understanding Byte Ordering



Hex Workshop v6.6 Understanding Byte Ordering
