HIEW32 Plugins Collection

[dosprog]

PE_OVL.HEM PlugIn for HIEW32
for Strip/Add/Save/Goto overlay of PE-EXE file.

Logic:

If PE-EXE contains the overlay
then select:
-Strip overlay
-Append or replace overlay from file
-Save overlay to file
else
-Append overlay from file

Plugin Actions Menu:

Overlay:
- Strip
- Add
- Save
- Goto

See ->Start Post <-

[dosprog]

Not only everyone(c) knows that you can speed up
the launch of Plug-Ins using the "hemkeys.ini" file.
For example:

[HemKeys 7.45]
c: crack
w: pe_rwe
o: pe_ovl
t: pe_tails
h: pe_hints
v: peverify
e: peentrypointhere
a: checksum
g: goto

[dosprog]

GOTO.HEM - HEM-PlugIn for locate some positions in MZ-PE-EXE file.

Menu available:

Goto MZ:
========
MZ relocs
MZ relocs END

Goto PE:
========
MZ Header ...
PE Header
PE Characteristics
PE Directories
PE Directories END
PE Obj Table
PE Obj Table END
PE Overlay

See ->Start Post <-

[dosprog]

Updated 5 PlugIns for manipulate with PE-EXE.
(Now if file opened in Hiew is not PE, then PE_xxxx PligIns not listed in Hiew32 PlugIns Menu).

Updated full PlugIns archive.

See ->Start Post <-

[agoo]

Originally Posted by an0rma1

I found this: https://github.com/lallousx86/pyhiew

And an example able to retrieve results from virustotal: https://github.com/matrosov/pyHiew/blob/master/vt_check.py

Be aware of some malware in this site I found a while ago.

[sendersu]

you say malware found @github?
how come... or maybe it started to happen after MS bought GH by 7 500 000 000 usd?

[dosprog]

) sendersu, he got little excited

[dosprog]

Goto.HEM - added new option "Goto PE CheckSum".

Menu available:

Goto MZ:
========
MZ relocs
MZ relocs END

Goto PE:
========
MZ Header ...
PE Header
PE Characteristics
PE CheckSum <-------NEW OPTION----
PE Directories
PE Directories END
PE Obj Table
PE Obj Table END
PE Overlay

See ->Start Post <-

[dosprog]

Happy NY 2 all

@Jupiter,
test, please, HEM-plugin KBD_CYR.HEM with new version 8.66, if possible
- because in leaked vmprotected version it doesn't works.

[chessgod101]

@dosprog, The plugin loads in my legal copy. This is the output for characters a-z on an English keyboard.

https://i.imgur.com/SMnal27.png

[dosprog]

New plugins released 2020:

--> BASE64.HEM <-- (17 apr 2020) - HEM-PlugIn produces BASE64 string for marked block (16Mb max.)

--> SECTOR.HEM <-- (18 apr 2020) - HEM-PlugIn for write sector(s) of disk to a file (256 sectors max.).

--> PE_SPLIT.HEM <-- (24 apr 2020) - HEM-Plugin - Split & Join 32-bit PE-file. (Prototype is --> PEU <-- by A.Quincey,1998)

--> BL_FILE.HEM <-- (26 apr 2020) - HEM-PlugIn writes selected block to a file with HEX-address as filename.

[dosprog]

--> PE_TIME.HEM <-- (23 apr 2020) - HEM-Plugin - PE-file LinkTime<-> FileTime.

[TQN]

Another excellent HEM plugin by Tavis Ormandy, view data structures in Kaitai format:
https://github.com/taviso/kiewtai

[dosprog]

Updated PlugIn MBYTE2.HEM
- Added "Raw" Option.
- Fixed "Asm" transtation (removed invalid comma at EOL)

Now converted bytes :

C-code:

#define MB_BUF_SIZE 0x6
unsigned char marked_bytes[MB_BUF_SIZE] = {
0x48, 0x49, 0x45, 0x57, 0x33, 0x32
};

Asm-code:

;MB_BUF_SIZE equ 06h
marked_bytes label byte ;{
db 048h, 049h, 045h, 057h, 033h, 032h
;}

Raw-bytes:

48 49 45 57 33 32

Download: MBYTES2.HEM

[dosprog]

Updated PlugIn MBYTE2.HEM
- Fixed "Asm" translation (missing ending 2 symbols)

Download:MBYTES2.HEM