4.0 Hex Editing

4.1 Explorer.exe
 


4.0 Hex Editing

Now that you've explored the system registry, we'll move on to something far more invasive; Hex Editing. What follows is a crash course on the subject of hex, and is by no means to be considered definitive on the subject. Any inconsistency between this text and another along these subject lines is almost certainly the fault of this text. With any luck, though, this should provide at least a working understanding of hex.

Note: Some software may be protected by law against the use of a Hex Editor (Possibly including all Microsoft products, even Explorer.exe which is the subject of the next section). Thus, use of a hex editor in some cases may be illegal. I cannot advise you as to the legality of hex editing, that is for you to determine. I do not encourage the use of this information in any illegal manner. Again, this is merely a guide, not a manual.

Most of you will be familiar with the term "binary". It refers to (among other things) the way that information is stored on a hard drive; in the form of a 0 or a 1. Positive and negative, being and non-being, light and dark; binary. Binary is used to represent characters by means of an eight digit binary code (e.g., 00110011). Hex (short for hexadecimal) is a similar means of representing characters, however hex uses a two digit alphanumeric code to represent characters (e.g., 42 6C ...).

Note: Translation of binary code is hard to come by these days, so I cannot tell you what 00110011 means (if anything). Hex code translation is somewhat easier to come by (If anyone has something along the lines of a hex dictionary, please send me a copy or point me towards it), this is the reason I recommend HEdit as a hex editor. As one of it's features, HEdit will translate hex into normal text--and vice versa--for use in its search feature, which will be a valuable tool for the following "tweaks". If memory serves (and I'm not betting on it) 42 6C translates to B L, but I wouldn't stake my reputation on it.

Some programs will "allow" (physical, if not legal, possibility) changes to be made through the use of a hex editor. Usually, though, the changes that can be made will be changes to displayed text. Characters can be replaced by changing the hex value (e.g., replace 42 with 6C) to something else. This limits any changes you may make to the exact length of the existing text (Or less).

Generally, text characters are separated from each other by the hex code 00. This appears in ASCII form as a period (".") however, when the text actually displays, this period does not appear. This is because when hex is converted to ASCII, many of the hex characters don't have equivalent ASCII characters. In fact, all the hex codes 00 through 20 will represent themselves as periods.

The important issue here, though, is to be sure that those separating characters (00) remain in place. The only exception to this, is in the case of the hotkey character (26) which can replace a character separation (00). 26 converts to ASCII as an ampersand (&), however the two are not interchangeable. An ampersand inputted in the ASCII portion of your hex editor will not produce the same results as a 26 inputted into the hex portion.

If you don't understand the bits about the Hex/ASCII portions of the editor, you probably haven't opened a hex editor. Hex code is displayed on the left (usually), while comparable (though not necessarily equivalent) ASCII characters appear on the right.
 
 

4.1 "The White Pages"

The following is an excerpt from NeuroLyger's "The White Pages", a similar article on how to customize Windows 95. I felt that this article was especially relevant to the subject, and since it already existed, there was really no point in my re-writing it. I make no claims that this is the best hex information on the net (nor does NeuroLyger), it was simply the product of a friend who was kind enough to allow me to reproduce it here.

Note: NeuroLyger went a little wild with the copyright symbols. Don't worry about it, he's just following Rule #1: Cover Your Ass.

This document in its original and complete HTML form can be found at:

http://home.att.net/~NeuroLyger/


 Technical stuff for semi-techies

     Okay, there are many of us out there that take pride in our uniqueness, our individuality. For techies this is readily expressed in 'customizations' made to the systems they use. This page will give you a bit of info on how you can personalize many of those annoying windows pre-sets. By the end of this make-over you will be able to change the text and icons in the 'Start Menu©', alter your 'My Computer' icon and rewrite those witty, master-of-the-obvious 'Tips of the Day'. I'll add more of the  neat things I know how to do later. Much later. I update my page every three lifetimes... If there's anything you want to tweak that isn't covered here ( and that's a lot ) you can E me at [email protected].

     First, though, please read the Important Notice.

     Ahem, I said

                    Read the Important Notice
 
 

          That being: Make backups of all files you will be working on. Then make a copy in a working directory. That way if anything goes wrong you can drop back to Dos and reload the original files. ( if you don't know what I'm talking about go play somewhere else. This is somewhat tricky stuff and is not recommended for novices )

          Also, be advised that I put this knowledge out as information only. I take no responsibility for any inaccuracies (which I will attempt to keep at a total of zero), misuses, or misinterpretations on the part of the user. i.e. Here's the info, use it as you will but keep backups of the original files and know that I will not be sued because windows stops working, eats your cat, refuses to let you download porn, only lets you connect to vegetarian web sites, etc.
 
 

     Okay, now that we're through the icky crap let's get into the bit-head stuff. First you'll need a hex editor ( Om... Hexadecimal Om... ) to work with your system files. Notepad won't do it folks, go for the big toys. I have used Hex Workshop and HEdit and find that I prefer the latter. Either will do and they both have shareware releases.

     If you don't have any experience with hex, let me give you a layman�s run-down: Hex allows you to see what is actually in the file as opposed to text editors which convert everything to ASCII. Also they let you tweak with the file on a semi-coherent level. Now the files we'll be playing with are kind of important. In fact, Windows© won't run with out them. If we tweak them incorrectly Windows© will notice and retaliate by refusing to load. Therefore, let's not mess any of this up.

     Now how does windows know that we've been playing doctor with it's innards? Well it's rather simple. Before loading any crucial components ( Explorer.exe, io.sys, user.exe, user.dat, system.dat ) it checks the file size against what it thinks the size should be. So, if we add stuff... it won't work. If we remove stuff... it won't work. But if we replace stuff... Aha, customized instead of crippled. So the key is to replace things that are already there. If the file is even one character off in either direction Windows© goes cuckoo for Coco-Puffs©.

     When I customize a file I invariably set my insert to overwrite ( OVR ). This allows me to basically write over the existing text so I never worry about miscounting the number of characters I'm replacing. This is far safer than deleting the old text and writing in the new. Also, make a mental note that the text you see is only a representation of the hex code. Sometimes the same ASCII character will be used to signify two very distinct hex commands. For example when we edit the "Start Menu©" commands you will see an & symbol in the middle of a word, though when you actually click on the "Start Button©" it's not there. That's because the hex command to utilize the following letter as a hotkey is symbolized with an &, though if you were to type in the & symbol in the ASCII section it would be treated as a normal ASCII character.

     Lost anyone? If this makes at least some conceptual sense then let's get on with it.

     Step 1: Backup the file you are altering in a separate directory from the one you are working in. Then copy the backup to your working directory. You should now have three copies of the file on your hard drive. One being used by Windows©, on in a backup directory and one in a working directory.

     Step 2: Load up your trusty hex editor and open the file in you working directory. ( Don't get ahead of yourself here, the names of files and tweakable stuff is included below ) Consult the list below to see what changes you want to make.

     Step 3: Carefully, make the changes. If you think you might have made a mistake don't try and correct it. Just exit the editor without saving, open it and start again.

     Step 4: Once you have made the changes you want, shut down into Dos mode ( don't just shell a copy of dos, it won't work ). There you can delete the original file and replace it with your customized version. Then reboot to see the changes take effect. Because Windows© requires these files to run it won't let you alter or replace them while Windows© is running. That's why we're mucking around in dos.

     If for some reason Windows© won't load get back into dos and delete your modified file, replacing it with the original. Start over.

      Things of Which to Tweak
 

     File: Explorer.exe

     Location: C:\windows\

     Tweakable areas:

          The Start Button

          To change the text in the 'Start Button©' to something other than Start, find all instances of the hex code 530074006100720074. This is represented by the ASCII text "S.t.a.r.t". Over-write the letters with whatever you wish, though it must be five characters. You can over write letters with spaces. Leave the periods alone as they are not ASCII periods but actual hex code. The end result should look like "C.r.a.s.h" or "H.i. . . " Go on to the next instance of the hex and replace it too. Replace all " S.t.a.r.t. .m.e.n.u" instances with your modified text.

          Inside the Start Menu

          You can also alter those names inside the start menu in the same way. Here's a list of the menu name and it's hex equivalent:

          Run : 2600520075006E

          Help : 2600480065006C0070

          Find : 2600460069006E0064

          Settings : 2600530065007400740069006E00670073

          Taskbar : 26005400610073006B006200610072

          Control Panel : 260043006F006E00740072006F006C002000500061006E0065006C

          Printers : 26005000720069006E0074006500720073

          Documents : 260044006F00630075006D0065006E00740073

          Programs : 2600500072006F006700720061006D0073

          * Note the & symbol ( hex: 26 )indicates the next character will be the functions' hotkey

<Section Removed>

     The End for now. E me if you want any more info not included here. I don't like writing HTML much so I've only thrown in the simple stuff.

                    -Lyg


Section 5