Last update: 5 August 2023
What all the buzz is about
Hiew External Module (HEM) is a DLL that is called from Hiew, uses Hiew functions and exchanges data with it.
How it works
Hem modules are not loaded until the key F11 is pressed in any of the modes
(Text/Hex/Code). If you were brave enough to press the key F11 and engage Hem
modules, Hiew will scan special folder and its subfolders for Hem files.
For each found file Hiew loads it,
looks for exported entry point, and uses it for invoking module
initializer. Subsequent Hem menu invocations processed without directory scan.
HemLoad receives a pointer on function called HiewGate for back
communication with Hiew, and a unique handle that module should pass for
self-identification in each HiewGate call. HemLoad code is expected
to keep these values for future use. It is also expected to fill
a structure describing module. Structure contains things like module's text
description, as well as flags specifying Hiew states module will be invoked
in. Any Hem module can provide its functions for direct calls from other
modules via its gate. After successfully passing load and initialization
phases module is registered as valid.
(Detail info about hem interface see inside arhive.)
1. VerInfoX
|
VERSIONINFO Resource Viewer.
A Hiew plugin that allows to locate and view compiled VS_VERSIONINFO resources
|
 |
| Hiew version minimal: |
7.22 |
|
2. PeVerify ver 0.43
|
Verificator of the PE file.
Checking: stub, header, sections table, directory table, export, import (bound and delay include), resource.
Info: overlay.
|
|
| Hiew version minimal: |
7.22 |
|
3. PE Sniffer ver 1.02
|
PE Sniffer can analyze PE file and guess packer/compiler.
|
|
| Hiew version minimal: |
7.22 |
|
4. MapAndJump
|
First, it lets you quickly navigate through currently open file. Second, it does a very basic
analyzis of the file and shows which areas of the file are filled with
zeros or other constants, and which contain usual pseudo-random data.
|
|
| Hiew version minimal: |
7.22 |
|
5. HiewLua ver 1.02 (Hem2Hem plugin)
|
HiewLua is a Hiew plugin that provides other Hiew plugins with Lua script engine.
|
|
|
6. SciView ver 1.02 (Hem2Hem plugin)
|
SciView is a Hiew plugin that helps other Hiew plugins to overcome console
ouput limitations and provides a rather powerful graphical text editor/viewer
that is directly callable from any Hiew plugin.
|
|
|
7. CalcLuator ver 1.02
|
CalcLuator is a Hiew plugin that serves two main purposes. First, it
demonstrates how to use HiewLua and SciView plugins and therefore is
distributed along with its source code. Second, it provides its users
with a very nice programmable and extendable Lua calculator that may be
used for a huge variety of things in everyday life.
|
|
| Hiew version minimal: |
7.22 |
|
8. FileWalker ver 1.12
|
Show some details for specific files.
JPG: show markers
ZIP: show markers, filenames, compress/uncompress sizes
|
|
| Hiew version minimal: |
7.22 |
|
9. XorBlock ver 1.00
|
Xor block with line.
(this feature was deleted from exefile since version 7.40)
|
|
| Hiew version minimal: |
7.45 |
|
10. WhereComesFrom ver 2.02
|
List of references for PE
|
|
| Hiew version minimal: |
7.47 |
|
11. NamesPeMap ver 1.30
|
Import names from standart map-file
|
|
| Hiew version minimal: |
7.50 |
|
12. LoadMapEx [PE] ver 1.00
|
LoadMapEx [PE] allows load into HIEW .map files generated for PE files by Visual C++\Borland C++\DeDe\GNU compilers.
|
|
| Hiew version minimal: |
7.50 |
|
13. PE CheckSum Adjuster ver 1.33
|
PE CheckSum Adjuster can modify PE file to conform PE checksum.
New and original checksums are the same!
This means that checksum will be intact!
Useful when you need to keep original checksum, for ex. for Themida patching
|
|
| Hiew version minimal: |
7.45 |
|
14. TempLuator ver 1.03
|
TempLuator is a Hiew plugin that lets the user to see data in a neatly
formatted way according to selected template. Templates are ordinary
Lua scripts that may use extended data formatting and processing capabilities
provided by TempLuator. The end user can write his own (or edit existing)
templates in order to satisfy his particular needs in data representation.
|
|
| Hiew version minimal: |
7.22 |
|
15. PeEntryPointHere ver 1.05
|
PE files: set EntryPoint at current offset
|
|
| Hiew version minimal: |
8.00 |
|
16. ElTorito ver 1.00
|
Show entries of boot catalog for bootable CD/DVD
(Hint: Enter - goto sector)
|
|
| Hiew version minimal: |
8.00 |
|
17. mbytes2csrc
|
Marked bytes in the Hiew to C-source and put it in the clipboard.
|
|
|
18. PyHiew
|
PyHiew is a Hiew External Module that allows users to write Python scripts that interface with Hiew
|
|
|
19. DSymLoad
|
DSymLoad.HEM (and configuration file DSymLoad.ini) allows you to immediately
load a local name list from the target file (using debugging information).
|
|
|
20. Detect It Easy
|
Detect It Easy is a packer identifier.
|
|
| Authors: |
hors(die), exet0l(hem) |
|
21. Entropy Analyzer
|
This is the first Hiew plugin partially written in C#.
Entropy Analyzer is a Hiew plugin that shows in a convenient graphical form the entropy of each
block of a file thus allowing to see where the data in the file is... well, special and differs
from other data.
|
|
| Additional requirement: |
.NET v4.0 |
|
22. PInvoke Viewer
|
PInvoke Viewer shows which unmanaged resources a managed assembly uses and which
resources it provides for the unmanaged world.
|
|
| Additional requirement: |
.NET v4.0 |
|
23. LibView
|
LibView is a Hiew plugin that displays all public symbols defined in a COFF .lib file.
In addition, it may show such symbols for other types of libraries (*nix .a files, for example).
|
|
|
24. Elevate ver 1.03
|
When you are normally examining files with Hiew, running Hiew under UAC (User Account Control) is enough,
but if you need to modify objects in protected locations like %ProgramFiles%,
you need to elevate Hiew process to grant admin permissions.
"Elevate" module lets you to elevate current Hiew process to grant admin rights and to modify protected objects.
|
|
|
25. MSVC Demangler/Undecorator ver 1.0
|
This plugin does one simple thing:
it converts such crippled names back into much more readable representation.
|
|
|
26. Kiewtai
|
Kiewtai lets you use the library of Kaitai Struct parsers from within Hiew.
There are lots of binary formats already supported by Kaitai,
so you get templates for lots of things (Zip, Rar, Gzip, Png, Jpeg, etc, etc).
|
|
|
27. Hashes
|
HIEW module to calculate MD5, SHA-1, and SHA-256 hashes of a given file/block
|
|
|
28. CopyAs
|
External Module (HEM) to copy block data in different formats.
|
|
|
*)It is required HEM SDK for compiling.