Skip to content

Hex Workshop editor's structure library for the Microsoft's Portable Executable format.

License

Notifications You must be signed in to change notification settings

Antoine87/pe.hsl

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 

Repository files navigation

pe.hsl

Hex Workshop editor's structure library for the Microsoft's PE/COFF file formats.

The pe.hsl file contains:

Common filename extensions for this format includes:

  • exe - Executable program for Windows.
  • dll - Dynamic library for Windows.
  • obj - Object file, usualy temporary between compilation and linking.
  • lib - Static library produced by Microsoft's compiler.
  • sys - Driver for Windows.
  • mui - Compiled language pack for windows.

Use cases of analysing PE files mostly includes understanding the format, analyse compiled object files and linked executables, manipulating structures to test loaders, repair corrupted files, understand malwares, ...

Caveats

  • The AutoParseFile function currently supports only PE executable and COFF object files for x86 and AMD64 architectures. ARM is not implemented for example but you are free to contribute if you know the format.
  • If for any reason your pe.hsl file does not have the Windows line-break format the editor will fail loading it. Please ensure that this file only contains CRLF line-breaks.

Contribution

This software is released into the public domain, so you are free and very welcome to contribute if some structures are missing or the function does not parse a format you would like.

As of the time of writing (2016), Hex Workshop's editor seems to be a discontinued project but it is still the only one advanced enough to propose this structure-way of looking/editing files at a hex editor level using its own scripting language.

Installation

  1. You may either copy the pe.hsl file directly into the Hex Workshop's "Structures" folder place it wherever you want.

how-to-install

  1. Show the "Structure Viewer Window" and load the file by clicking on the "Select Structure Library" button.

how-to-load

Usage

  1. Manually adding structures.

how-to-add-structures

  1. Using the AutoParseFile function to discover structures.

how-to-use-autoparse-function

And for an Object file.

how-to-use-autoparse-function2