hexedit :angry:

Hi folks

A few times ago, when I joined this forum, I have known the "hexedit" word, and I always think that hexedit was a "hexaddecimal edition" of an executable or dinamic link library.

But to me, only know what is the word, and what hexedit do doesn't all, now I want to know how I do the hexedit.

CmoneX, C:Amie, mscdex, or anyone that knows this technique, tell us why we do to "hexedit" a file!!!

Share the knowledge!

PS.: I'm VERY thanks to this forum! And all that are part of it!

For me, hexedit means to edit a file using hexadecimal notation, base 16. Some programs will not run on my 900C, often they are pocketpc programs. They give me an error when I check them with executability check. Most of the time it is a "coredll.dll won't return 1172 or 1171" error.

If I open the .exe file with a hex editor, such as Hex Workshop, then I can look for hexedecimal code such as 93 04 00 80 and replace it with 29 00 00 80 in every instance I find it. This resolves the 1171 error. For a 1172 error I search for 94 04 00 80 and replace all instances with 29 00 00 80.

I can then copy the modifed file back to my 900C and it normally will then run without error.

Most hexadecimal editors allow you to search for hex characters or decimal or ascii text. Sometimes it is necessary to have the program look for a modified file rather than the normal file. Such as you might have it look for mfcce301.dll instead of the normal mfcce300.dll file. In these cases, I would search for an ASCII text string within the file, mfcce300.dll and make the changes. Again I would save the modified file and copy it back to my HPC.

Anything beyond that is way beyond my skill level.

Now, did I explain that correctly all you gurus of hex?

Rich

Edited by Rich Hawley 2006-06-12 3:08 PM

hexedit = editing a file with a hexeditor. (or with executabilitycheck.exe)

is this what you wanted to know?

edit: Rich, yes you explained it very well

Edited by cmonex 2006-06-12 3:09 PM

Thanks Rich Hawley and CmoneX, explained very good, and now I understand what is the hexedit.
Replace CE 3.0 DLLs for 2.11 (or other DLL)
Replace the VERSION of CE 3.0 t CE 2.11
Very greatfull!

Very good and detailed explanation, Rich!

I have one question: I understand that for a little-endian machine 93 04 (hex) is 1171 (dec) and of course 94 04 (hex) is 1172 (dec) however, what does THAT mean in machine code? Or, in other words, what is the reason of the 1171/1172 error?

the coredll.dll exports 1171 / 1172 / 1173 have to do with SIP functions that are missing from the core ce.net OS (some machines have the SIP built in, some don't, the 900c doesn't.) hpc2000 DOES have it. (because of the japanese machines..)

oh and you can hack the SIP onto the 900c using a second coredll (coredl2). then i guess you just have to hexedit programs to call coredl2 but i prefer the 117x solution.. never tried this one, only got as far as hacking the SIP and have some fun with it.

Edited by cmonex 2006-06-12 9:54 PM

All HPC2000 machines?

So at the end, if I have understood well, what you do is to replace a call to 0x0493 or 0x0494 with a "dummy" call to 0x0029???

Another question: are you aware of a native hexeditor for HPCs? I have tried one (I can't remember which one, now) but it wasn't actually an editor, rather a hex-reader.

How do you know that 1172 error in hex code are 94 04 00 80??

Edited by Derek.HPCManiac 2006-06-13 4:00 PM

I know because someone told me...lol, otherwise I wouldn't know a thing.

Rich

Isn't that what your wife is for - to tell you everything?

Edit: not "your wife"... "every wife"...

1172 = decimal
494 = same thing just hexadecimal.. all it takes to calculate it is the calculator built in windows xp




yes as hpc2000 is a platform.

You surely don't need XP to convert from hex to dec!!!

Seriously, I think Derek meant (and I also asked more or less the same thing): "Ok, we know that 0x94 0x04 (little-endian) is 1172 in decimal. But: what about 0x00 0x80?"

oh that usually has the 0x00 0x80.. don't ask why.. i don't know. maybe that means it's an import...?
anyway Peinfo will tell you the whole hexadecimal code (not always though)..