Hiew+ – Editing process memory with Hiew hex editor

What’s is Hiew+

Hiew+ is based on the FsPlus project. FsPlus is an implementation of an idea that allows you to access non disk files as if they were disk files. Hiew+ is a real life example of FsPlus where we take Hiew (an excellent hex editor) and turn it into an excellent process editor. Each process will be viewed as a file with a size as much as SYSTEM_INFO.lpMaximumApplicationAddress returns. In theory FsPlus should work with any hex editor to provide process memory editing, but this release is just Hiew ready.

Hiew+ editing the process memory of a process being debugged by IDA Pro

Usage

To use FsPlus, you need to inject FsPlus.dll into Hiew’s process memory so that the APIs are hooked. After APIs are hooked, FsPlus will recognize and treat in a different manner any file name that has the following form: “pid|1234” where 1234 is a given PID. To make the usage even simpler, I provid a small GUI (FsPlusGui) to allow you launch Hiew conveniently.

In fact, Hiew+ can be considered as a nice addition to your reverse engineering tools arsenal (IDA Pro‘s debugger or any other debugger, etc.).

Here’s a screenshot of the FsPlusGui:

You will need to double click on a process to have Hiew or the desired process launched with FsPlus support.
Make sure you specify the settings correctly in FsPlus.ini:

[settings]
title=Hiew+ (c) lallous <lallousz-x86@yahoo.com>
hookdll=.\fsPlus.dll
launch=c:\hiew\hiew32.exe

Features

After you run it successfully, you will be able to start editing processes as if you were editing files. The catch is every process virtual address is now a physical offset in Hiew.

Modules as IMAGE_SECTION_HEADERs

For your convenience we have created additional IMAGE_SECTION_HEADER structures in the PE header of the main process, so that each loaded module is view as a PE section:

Textual information about process’ modules

In addition to viewing modules as PE sections, you will have an actual representation of all loaded modules just after the end of the PE header:

flower separator
batchography-good-resDo you want to master Batch Files programming? Look no further, the Batchography is the right book for you.

Available in print or e-book editions from Amazon.
flower separator

No Read Errors

To avoid reading errors and such, any unreadable memory page is filled with “BAD!” pattern.

Physical and Logical disk editing

This is not something added by FsPlus, rather it is a undocumented feature of Hiew32 where you can use Hiew to edit/view logical and physical disk sectors:

Conclusion

Download – Release date: late 2008

This tool has been tested with Windows Vista (32) and Windows XP SP2 and with Hiew 7.29.
Hope you find this tool useful as Hiew itself.
Note: Please don’t contact me if you run into trouble. This tool is no longer supported.

You might also like:

A visit to the Saint Charbel Monastery in Annaya, Lebanon

Charbel Makhlouf, also known as Saint Charbel in Annaya Lebanon is very famous amongst Maronite and Catholic Christians. Charbel is famous for his numerous miracles such as healing partial paralysis or eradicating cancer from patients.
It is customary for me and my family to visit Saint Charbel’s monastery once a year at least. In this blog post, I share with you some of the photos I took.


You might also like:

Take aways from the Defensive Driving Course

Recently, I took the 6 session defensive driving course. The following are some of the notes I extracted from the course that I would like to share with my you:

There were lots of information in the course, I highly recommend taking it! You can download the notes as a single PDF file from here:

(The PDF was created using the free Pic2Pdf tool)

The defensive driving formula


Continue reading “Take aways from the Defensive Driving Course”

The difference between hell and heaven is a mindset

the sacrifice of one An old teaching tale goes like this: A young man wanted to know the difference between Heaven and Hell.

The sage led him to two rooms with observation portals, one labeled Heaven and one Hell.

Looking in at Hell he saw a banquet table filled with luscious food but the people at the table were emaciated and distressed. Their spoons had long handles to reach the food, but the handles were too long to bring the food to their mouths.

Then he looked in on Heaven. Same table full of luscious food. Same long spoons. But the people were healthy and happy and using their long-handled spoons to feed one another.

You might also like:

Funny male sexuality quotes from a shirt I found

  • God gave men both a penis and a brain, but unfortunately not enough blood supply to run both at the same time.
  • Sex is hereditary. If your parents never had it, chances are you won’t either.
  • What matters is not the length of the wand, but the magic in the stick.
  • A verbal outburst during the male orgasm is called “sperm wail”
  • It’s not how deep you fish, it’s how you wiggle your worm.
  • Sex is not the answer. Sex is the question. “Yes” is the answer.
  • Wanna hear a joke about my penis? Never mind, it’s too long.

 


You might also like:

How many slaves work for you?

When researching minimalism and reading the Affluenza book, I came across the “Slavery Footprint” website (http://slaveryfootprint.org)

how many slaves work for you?
On this website, you take a survey:


…and then at the end you get the result:

This is not my real result. This is an example.


You might also like:

The 2017 World Predictions – Between reality and illusion, between today and tomorrow

Last year, out of curiosity, I decided to translate the predictions of Michel Hayek for the year of 2016. The article proved to be popular so I decided to do a preliminary translation of the 2017 predictions.

Disclaimer:

  1. I am not a professional translator and I do this as a hobby.
  2. I do not claim the accuracy of the translation below.
  3. I did not translate everything. I skipped many things including predictions of events that are very local to the Arab region and Lebanon.
  4. Please watch the original video with the help of an interpreter if you want to know about all of his predictions.

As Michel Hayek said in his interview, the title of his predictions for the year of 2017 is:

Between reality and illusion, between today and tomorrow

Let’s get started!

More predictions:

A day trip to Manhattan, New York City

Back in August, while visiting Boston, I took the Saturday morning Amtrak train to the Pennsylvania Station, New York City. It was a pleasant 4 hours ride in the train. After I arrived, I left the station and found myself in the center of Manhattan.

I was greeted by a bus tour saleswoman. I figured, why not, let me ride the tour bus and familiarize myself with the city. Unfortunately, it was raining the most part of the day.

It was a very busy day. People everywhere and there were barely room for pedestrians. The trash bins were full, homeless people were everywhere and the city was very very dirty. It felt like a zoo. Manhattan is not like what you see on TV. In reality it is a dog eat dog city. People were pushing each other and were very unfriendly. Later that day, I did my best to go away from Times Square and deep into the other parts of Manhattan. The further I got away from Manhattan the more tolerable and pleasant the city felt to me. What struck me most was that on each block you would find a pizza place. No wonder why the Teenage Mutant Ninja Turtles, who live in New York, love Pizza 😉 Continue reading “A day trip to Manhattan, New York City”

Batchography: Converting numbers to characters (or the CHR() function)

In various programming languages, you might sometimes need to convert numbers to characters. In simple terms, each character you see has a numerical representation. The ASCII table  shows the numbers of each character and its corresponding glyph.

Converting numbers to their corresponding characters would be useful to generate a random string for instance. The first step to generating a random string is to generate random numbers between 65 and 90 (upper case ‘A’ to upper case ‘Z’) or between 97 and 122 (lower case ‘a’ to lower case ‘z’).

While the Batch language is pretty primitive, you would be surprised how many things you can do with it. In the Batchography book, I cover various topics that would bring your Batch programming skills to the next level.
batchography-good-res

Get the book from Amazon:

  • Paperback editionbtn-buy-on-amazon
  • E-book editionbtn-buy-on-amazon

flower separator Continue reading “Batchography: Converting numbers to characters (or the CHR() function)”

Batchography: How to do a “switch/case” in Batch files

You have found this blog post because you are wondering if there is a way to express a “switch/case” logic in Batch files.

The short answer is: “no, not exactly”. However, there are ways to achieve the same in Batch files.

In the Batchography book, I explain in details the “switch/case” construct, but in this blog post I will illustrate this mechanism briefly. For more advanced Batch scripting topics, please grab a copy of the Batchography book.

batchography-good-res

Get the book from Amazon:

  • Paperback editionbtn-buy-on-amazon
  • E-book editionbtn-buy-on-amazon

flower separator Continue reading “Batchography: How to do a “switch/case” in Batch files”

Are you Christian? Are you Muslim? What’s your religion? Tell me, I want to feel better

I am writing this blog post just to rant and vent off and share with you one incident that happened with me.

 

The other day, while visiting Vancouver, BC, I was stopped by a family to take a photo. They observed my accent and they asked me where I am from. When I mentioned Lebanon, they wanted to know if I am a Christian or a Muslim. When I said Christian, they felt really happier and more friendly!

If you live in the West, some (if not many) people are Islamophobe. They ask you if you are a Christian or a Muslim so they feel a bit of relief if you have a more “positive” and “peaceful” religion.

I just hate the fact that I have to declare my religion so that others around me feel better. Even if they don’t ask directly, I feel this covert need to disclose my religion. Too bad, what a state of affairs. Having said that, I was born to a Christian family.

Today, based on the current world events, more and more people are brainwashed by the mainstream media to hate the religion of Islam. Where is the real freedom of expression?

When it comes to me, I treat others not based on their religion, but on how they act towards others. I try not to generalize because each person is different.: there are bad Christians as there are good Muslims and vice versa.

You might also like:

The Zen master Shichiri Kojun and the thief

One evening, Zen master Shichiri Kojun was reciting sutras when a thief entered his house with a sharp sword, demanding “money or life”.
Without any fear, Shichiri said: “Don’t disturb me! Help yourself with the money, it’s in that drawer” and he resumed his recitation.

The thief was startled by this unexpected reaction, but he proceeded with his business anyway.
While he was helping himself with the money, the master stopped and called, “Don’t take all of it. Leave some for me to pay my taxes tomorrow”.
The thief left some money behind and prepared to leave. Just before he left, the master suddenly shouted at him, “You took my money and you didn’t even thank me?! That’s not polite!”. Continue reading “The Zen master Shichiri Kojun and the thief”