sebastianbiallas / ht Goto Github PK
View Code? Open in Web Editor NEWThe HT Editor: A file editor/viewer/analyzer for executables.
License: GNU General Public License v2.0
The HT Editor: A file editor/viewer/analyzer for executables.
License: GNU General Public License v2.0
HT Editor ========= This is HT 2.1.0; Have fun... About ===== This program is a file viewer, editor and analyzer for text, binary, and (especially) executable files. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Key bindings ============ * General key bindings Return follow link (if applicable) Backspace undo "follow link" Space/F6 choose view mode Alt+[1-9] select window Alt+0 select window list Ctrl+Left/Right scroll left/right Cursor keys move around Page Up/Down next/prev page Alt+S toggle select Ctrl+Ins/Alt+C copy Shift+Ins/Alt+V insert Ctrl+Del/Alt+D delete Shift+Del/Alt+X cut * Window key bindings Alt+F3/Ctrl+W close window Ctrl+F5 resize/move mode (in resize/move mode only:) Space toggle resize/move mode Cursor keys resize/move window Escape/Return/Ctrl+F5leave resize/move mode * Analyser key bindings c continue code analysis at cursor f follow dword ptr at address n name current address (empty string to delete) x show xrefs (search for xrefs) # edit comments s define a string i define an integer (32bit) h define a halfword (16bit) b define a byte (8bit) Ctrl+A call assembler Ctrl+F goto start of current function (indicated in the 2nd line) Ctrl+L goto previous label Ctrl+T show recursive function references Note: Some keys don't work in HT-posix. Try using Escape instead of Control or something... Authors ======= * Stefan Weyergraf * Sebastian Biallas <[email protected]> Features ======== HT contains some very advanced and useful features, which you should carefully inspect: General features ================ 1. Supported file formats * common object file format (COFF/XCOFF32) - header - image with code/data analyser (x86) * executable and linkable format (ELF) - header - section headers - program headers - symbol tables - image with code/data analyser (x86, AMD64, Alpha, PowerPC, ARM, AVR) and relocations * linear executables (LE) - header - VxD descriptor - object table - page table - image with code/data analyser (x86) - auto-relocation layer (only internal refs for now) * standard dos executables (MZ) - header - relocations - image (disassembly only) * new executables (NE) - header - segments - names - entrypoints - image with code/data analyser (x86) - auto-relocation layer (pretty complete) * portable executables (PE32, PE64) - header - import section - delay-import section - export section - resources - image with code/data analyser (x86, AMD64, PowerPC, Alpha, ARM) - preliminary support for .net executables * java class files (CLASS) - header - image with code/data analyser (java bytecode disassembler) * Mach exe/link format (MachO) - header - image with code/data analyser (x86, AMD64, PowerPC, ARM) * X-Box executable (XBE) - header - imports - image with code/data analyser (x86) * Flat (FLT) - header - image with data analyser (no disassembler yet) * PowerPC executable format (PEF) - header - imports - image with code/data analyser (PowerPC) * Still some to be implemented (M$-OBJ, ARCH, LX) 2. Code & Data Analyser - finds branch sources and destinations recursively - finds procedure entries - creates labels based on this information - creates xref information - allows to interactively analyse unexplored code (press 'c') - allows to create/rename/delete labels (press 'n') - allows to create/edit comments (press '#') 3. Target systems - GNU/Linux - FreeBSD - Win32 Configuration files =================== Global configuration -------------------- HT automatically creates a file to store its configuration. It is called `~/.htcfg2' on Unices and `ht.cfg2' (where ht.exe resides) on Windows. More specifically it contains HT's registry and the *Note Global history::. Per file configuration ---------------------- The analyser (for analysable files) will be stored in an extra file called `FILENAME.htcfg', where FILENAME is the analysed file. This file contains all information to restore the complete state of the analyser. Clipboard ========= All open files and dialogs use the common clipboard, where all copied and cut text or binary data is stored. Clipboard operations are normally binary safe, that means you can copy some binary data out of a file and paste it into an input line. Exceptions are only the \0 character (binary null), it will be converted to a space in places where it would not make sense (e.g. file open). Although the clipboard won't be saved between different HT sessions (ie. you will loose it when exiting HT), you can either save and load it or part of it manually (via Edit->paste into/copy from file) or rely on the input lines' *Note history: Global history, which is stored and retrieved from the config file automatically. Global history ============== HTs history system is global, which means that you can use it for all open files. Histories are also grouped by their context. I.e. file-related and regex-search-related dialogs have their own history (who would want to open "[0-9][0-9a-z]+" anyway?). History entries are stored within the *Note Configuration files::, so they can be reused when you relaunch. You can delete a history entry by pressing DEL inside the history popup. Expression evaluation ===================== HT contains a very powerful expression evaluator which is used in all dialogs where expressions are expected. These are mainly blockoperation, goto, search and of course evaluate itself (Edit->Evaluate). You can use all standard math operators (+ - / * % **), logical operators (! && || ^^), relational operators (== != < > <= >=), bit operators (~ & | ^), string operators (. for concatenation), parenthesis, the ternary operator (a?b:c), functions and symbols (both depending on context). The evaluator uses integer, string and float types depending on context. You can always convert a result via the `int()', `string()' and `float()' functions to appropriate type. Try Edit->Evaluate to see how it works... Functions and symbols --------------------- You can always use the standard built-in math (`round', `sin', `random', etc.) and string (`strcmp', `strchr', `sprintf', etc.) functions, they work more or less like the corresponding C functions (actually they ARE more or less wrappers for them); see `eval/eval.y' for details (sorry but a detailed help would get outdated rather soon). The symbol _ always refers to the last result. If you are in a hex buffer, the variable `first' contains the offset of the first byte and the variable `last' contains the offset of the last byte. This is useful, for instance, if you want to jump to the last byte of a file. When using *Note Block operations::, or searching you have some context depending functions and symbols; see these sections for explanation. Block operations ================ Block operation (Blockop) is a very powerful tool to perform modifications on binary files. It is available in hex viewer only. Blockop takes four parameters: START, END, MODE and EXPRESSION. Blockop works as follows: * START: Start at the offset specified by START * REPEAT: Evaluate EXPRESSION and store n bytes (1 - byte, 2 - word, 4 - dword, variable - string) at the current offset. Increment current offset by n. Stop if END has been reached. Special variables/functions that can be used in EXPRESSION: `readbyte(ofs)' read a byte from offset OFS, returns a number `readstring(ofs, size)' read SIZE bytes from offset OFS, returns a string `i' contains the iteration count/index starting with 0 `o' contains the current offset Search and its different modes ============================== The search function is one of the most advanced functions of HT. It is invoked through F7, Shift-F7 continues a search from cursor. Depending on context (ie. file type and mode) the following modes are enabled: bin: ASCII / Hex ---------------- Enter an exact search string either via ascii characters or via hexadecimal interpretation. This is the fastest search mode. You may specify a case-insensitive search. bin: eval str ------------- Enter an expression, it will be evaluated ONCE (difference to the 4th mode), and HT will then search for the result-string. This is pretty useful when searching for intermixed text and control-chars/binary, e.g. `"hello world\n\0"' display: regex -------------- As the prefix indicates, this search doesn't search in the binary file but in the display on screen. HT searches for a regular expression so this can be very powerful, e.g. in PE/Image you can search for `(add|sub).+?,\ [78]$'. This will find all add or sub instructions with second parameter 7 or 8. expr nonzero ------------ This is the slowest but also most advanced search mode. Enter an expression and the search stops if this expression evaluates to non-zero (it will be evaluated on every byte). In this mode there are two predefined symbols and some functions: I is always the number of current iteration and O stands for the current offset in file. With the functions `readbyte(ofs)' and `readstring(ofs, size)' you access the file's content. It's easier to understand this with examples: 1. Searching for patterns: a. Enter `readbyte(o) == readbyte(o+1)' This will search for two equal bytes ("AA", "55", "!!", etc.). b. Enter `(readbyte(o) == readbyte(o+1)-1) && (readbyte(o)==readbyte(o+2)-2)' This will search for three ascending bytes ("ABC", "123", etc). 2. Search with special functions: With HT you can easily detect the RSA key in the `ADVAPI32.DLL': Search for `entropy(readstring(o, 64)) > 82' in expr!=0 mode, and you will find it very quickly. How does it work? `readstring(o, 64)' reads a 64 byte string from current offset and entropy calculates the entropy ("randomness") of a string (result is 0..100). So the search stops if an entropy greater than 82% (guessed value) is encountered, which normally indicates packed or encrypted data. Note: the `entropy()' function is not the best of its kind, if you know of a better one please let us know! Command line options ==================== `--' treat all additional parameters as file names `-v' `--version' show version and copyright on console `-h' `--help' show help `-t' `--text' load file(s) in text editor mode `-b' `--bin' load file(s) in hex editor mode `-a' `--auto' try to guess file type Where to download? ================== The HT homepage is located at `http://hte.sourceforge.net' Downloads are available from the 'download' section. Please also take a look at `http://sourceforge.net/projects/hte'
The menu Edit -> delete (Ctrl+Del/Alt+D) of HT current latest release (ht-2.1.0-win32.exe) doesn't work.
A crash of the program occurs when I'm trying to edit some exe files.
ht 2.1.0, Windows 10
There is an example of a file (this is an exe file from the game UnReal World 3.30):
https://bitbucket.org/snippets/insolor/XKAX8
g++ -DHAVE_CONFIG_H -I. -I./analyser -I./asm -I./info -I./io/posix -I./io -I./output -I./eval -I. -DNOMACROS -O3 -fomit-frame-pointer -Wall -fsigned-char -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Woverloaded-virtual -Wnon-virtual-dtor -MT htapp.o -MD -MP -MF .deps/htapp.Tpo -c -o htapp.o htapp.cc
htapp.cc:282:7: warning: unused variable 'buflen' [-Wunused-variable]
int buflen = ht_snprintf(buf, VFS_URL_MAX, "%s:%y", listbox->getCurProto(), &res);
^
htapp.cc:769:10: warning: cast to 'void ' from smaller integer type 'uint' (aka 'unsigned int') [-Wint-to-void-pointer-cast]
return (void)(project->count());
^
htapp.cc:3026:9: error: call to 'abs' is ambiguous
while (abs(a - b) > 1) {
^~~
/usr/include/stdlib.h:137:6: note: candidate function
int abs(int) __pure2;
^
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1/stdlib.h:115:44: note: candidate function
inline _LIBCPP_INLINE_VISIBILITY long abs( long __x) _NOEXCEPT {return labs(__x);}
^
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1/stdlib.h:117:44: note: candidate function
inline _LIBCPP_INLINE_VISIBILITY long long abs(long long __x) _NOEXCEPT {return llabs(__x);}
^
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1/math.h:693:1: note: candidate function
abs(float __lcpp_x) _NOEXCEPT {return ::fabsf(__lcpp_x);}
^
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1/math.h:697:1: note: candidate function
abs(double __lcpp_x) _NOEXCEPT {return ::fabs(__lcpp_x);}
^
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1/math.h:701:1: note: candidate function
abs(long double __lcpp_x) _NOEXCEPT {return ::fabsl(__lcpp_x);}
^
2 warnings and 1 error generated.
gmake[2]: *** [Makefile:703: htapp.o] Error 1
a float/int/uint define/preview/view would be useful, a preview of interpreted bytes.
atm i note interesting values via comment.
edit: tried to better explain
Recently I've run into a crackme from the web-site http://crackmes.de/. Here is the link to binary http://crackmes.de/users/josamont/j333/, but it needs registration, so I've uploaded the binary here https://yadi.sk/d/WheWlZ1FdH8kF.
Running ht on this binary gives me segfault.
Here is the gdb backtrace: https://gist.github.com/yurket/2f70b1199db5aae3bfc5
hello , I found two potential bugs of null pointer dereference,would you help me check if these bugs are true?Thank you for your patience and effort.
==============================================================================
step 1 :
In file ht/asm/javadis.cc , function javadis::str_format line 362 :
null assigned to t reaches here
step 2 :
In file ht/asm/javadis.cc , function javadis::str_format line 367 :
null is used as the 2nd parameter in function strcpy
==============================================================================
step 1 :
In file ht/asm/x86dis.cc , function x86dis::str_format line 1485 :
null assigned to t reaches here
step 2 :
In file ht/asm/x86dis.cc , function x86dis::str_format line 1490 :
null is used as the 2nd parameter in function strcpy
hello , I found two potential bugs of file memory leak ,would you help me check if these bugs are true?Thank you for your patience and effort.
==============================================================================
step 1 :
In file ht/info/infoview.cc , function ht_info_viewer::init line 388 :
Allocate memory to f, the allocated memory is leaked
==============================================================================
step 1 :
In file ht/info/infoview.cc , function ht_info_viewer::init line 390 :
Allocate memory to s, the allocated memory is leaked
$ ./autogen.sh
$ ./configure --prefix=/usr/local/stow/ht
...
...
./configure successful.
=====================
Configuration summary
=====================
X11 textmode support available: yes
enable profiling: no
make a release build: yes
using included minilzo: yes
$ make
...
...
...
$ make htdoc.h
...
...
...
$ make
Making all in eval
make[2]: Entering directory `/home/nopnop/src/ht/eval'
gcc -DHAVE_CONFIG_H -I. -I.. -I. -I.. -DNOMACROS -pipe -O3 -fomit-frame-pointer -Wall -fsigned-char -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -MT evalparse.o -MD -MP -MF .deps/evalparse.Tpo -c -o evalparse.o evalparse.c
evalparse.y: In function ‘yyparse’:
evalparse.y:65:22: error: ‘resultptr’ undeclared (first use in this function)
input: scalar { *(eval_scalar*)resultptr=$1; }
^
evalparse.y:65:22: note: each undeclared identifier is reported only once for each function it appears in
make[2]: *** [evalparse.o] Error 1
make[2]: Leaving directory `/home/nopnop/src/ht/eval'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/nopnop/src/ht'
make: *** [all] Error 2
hello , I found two potential bugs of use of uninitialized variable ,would you help me check if these bugs are true?Thank you for your patience and effort.
==============================================================================
step 1 :
In file ht/asm/javadis.cc , function javadis::str_op line 265 :
a is used as the 1st parameter in function addr_sym_func (a is uninitialized)
==============================================================================
step 1 :
In file ht/asm/ildis.cc , function ILDisassembler::strf line 275 :
caddr is used as the 1st parameter in function addr_sym_func (caddr is uninitialized)
on ubuntu 14.04
./configure
make
g++ -DHAVE_CONFIG_H -I. -I.. -I.. -I../asm -I../io/posix -I../io -I../output -I../eval -DNOMACROS -pipe -O3 -fomit-frame-pointer -Wall -fsigned-char -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -std=c++14 -Woverloaded-virtual -Wnon-virtual-dtor -MT analy.o -MD -MP -MF .deps/analy.Tpo -c -o analy.o analy.cc
g++: error: unrecognized command line option ‘-std=c++14’
make[2]: *** [analy.o] Error 1
hello , I found three potential bugs of file descriptor leak,would you help me check if these bugs are true?Thank you for your patience and effort.
==============================================================================
step 1 :
In file ht/tools/bin2c.c , function main line 162 :
Function fopen64 executes and stores the return value to out
step 2 :
In file ht/tools/bin2c.c , function main line 163 :
Select the true branch at this point (out!=null is true)
step 3 :
In file ht/tools/bin2c.c , function main lines after line 163
no statement close out
==============================================================================
step 1 :
In file ht/tools/bin2c.c , function main line 157 :
Function fopen64 executes and stores the return value to outh
step 2 :
In file ht/tools/bin2c.c , function main line 158 :
Select the true branch at this point (outh!=null is true)
step 3 :
In file ht/tools/bin2c.c , function main lines after line 158:
no statement close outh
==============================================================================
step 1 :
In file ht/tools/bin2c.c , function main line 140 :
Function fopen executes and stores the return value to in
step 2 :
In file ht/tools/bin2c.c , function main line 141 :
Select the true branch at this point (in!=null is true)
step 3 :
In file ht/tools/bin2c.c , function main lines after line 141:
no statement close in
Hello, can you please include ELF program header types 0x65a3dbe7 OPENBSD_WXNEEDED, 0x65a3dbe6 OPENBSD_RANDOMIZE and 0x65a41be6 OPENBSD_BOOTDATA.
See http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/gnu/usr.bin/binutils-2.17/include/elf/common.h?annotate=1.6 Line 308.
Thanks
I'm trying to open an invalid file with the following ELF header:
7f 45 4c 46 00 00 00 00 00 00
Which is giving me the following error message
No disassembler for unknown machine type 0000!
followed by a segfault.
I'm not able to open the file in binary mode. Only text mode works.
There have been many releases of ht, as shown on the news page of your web site, but there are no corresponding tags or GitHub releases in this repository. Please create a git tag and GitHub release for each version that you have released.
HTE d462d62 does not cleanly start when compiled with Address Sanitizer. The following output is produced:
=================================================================
==7327==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000125f9b8 at pc 0x00000089e45e bp 0x7fffc9635790 sp 0x7fffc9635788
READ of size 8 at 0x00000125f9b8 thread T0
#0 0x89e45d in find_pal_layout(pal_class*, char const*, int*) /home/jn/dev/hack/ht/htpal.cc:166:3
#1 0x89f059 in load_pal(char const*, char const*, palette*) /home/jn/dev/hack/ht/htpal.cc:191:19
#2 0x9fe6bd in ht_c_syntax_lexer::reloadpalette() /home/jn/dev/hack/ht/syntax.cc:432:2
#3 0x9fe46c in ht_c_syntax_lexer::config_changed() /home/jn/dev/hack/ht/syntax.cc:375:2
#4 0x9fdc6d in ht_c_syntax_lexer::init() /home/jn/dev/hack/ht/syntax.cc:363:2
#5 0x651a39 in ht_app::init(Bounds*) /home/jn/dev/hack/ht/htapp.cc:1430:2
#6 0x685460 in init_app() /home/jn/dev/hack/ht/htapp.cc:3364:2
#7 0x995ba2 in init() /home/jn/dev/hack/ht/main.cc:98:8
#8 0x98fce0 in main /home/jn/dev/hack/ht/main.cc:282:7
#9 0x7f34911dcb44 in __libc_start_main /build/glibc-NmptCx/glibc-2.19/csu/libc-start.c:287
#10 0x53624c in _start (/home/jn/dev/hack/ht/ht+0x53624c)
0x00000125f9b8 is located 40 bytes to the left of global variable 'pal_layout_analyser' defined in 'htpal.cc:118:12' (0x125f9e0) of size 96
0x00000125f9b8 is located 8 bytes to the right of global variable 'pal_layout_syntax' defined in 'htpal.cc:103:12' (0x125f900) of size 176
SUMMARY: AddressSanitizer: global-buffer-overflow /home/jn/dev/hack/ht/htpal.cc:166 find_pal_layout(pal_class*, char const*, int*)
Shadow bytes around the buggy address:
0x000080243ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080243ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080243f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080243f10: 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
0x000080243f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x000080243f30: 00 00 00 00 00 00 f9[f9]f9 f9 f9 f9 00 00 00 00
0x000080243f40: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
0x000080243f50: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
0x000080243f60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080243f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080243f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
ASan internal: fe
==7327==ABORTING
ASan is nice because it helps in testing crash bugs.
the subject
As I needed to check the results of a first stage cross compiler (amd64 -> powerpc) on glibc, I tried to disassemble compiled files in glibc/csu, and each one I tried on hte ver 2.0.22 made it core dump. I'm using the ubuntu packaged build, though looking at the diffs, the program shouldn't be sensibly different from stock.
I don't know how to attach the files to this issue, but I can definitely provide them if needed.
I tried to build it myself but failed.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.