-
I am new ImHex user and did not found in documentation how to appl pattern on windows. I tried open .dll and .zip file. |
Beta Was this translation helpful? Give feedback.
Replies: 9 comments 3 replies
-
What you are looking for is how to load pattern files that can be run on the given input file. For some types of files ImHex is able to determine that for you and will ask you if you want to load some pattern file. In other cases it is up to you to select and load a pattern file. A lot of different types of files are loaded through the import menu. Open File>Import and select menu item called "Pattern file". ImHex should then present you a list of pattern files (.hexpat) to choose from. The name of the file corresponds to the type of file you want to run the pattern at. Since you mention a dll you probably are looking to use either the pe.hexpat or the coff.hexpat. Similarly for a zip file you would select the pattern file called zip.hexpat. After loading the file its contents should be displayed on the right window called the pattern editor window. This is where you write or modify pattern files and also where you run them. Click the green play icon found on the bottom row and the pattern should be executed |
Beta Was this translation helpful? Give feedback.
-
Thanks, that is feature I was looking for.
|
Beta Was this translation helpful? Give feedback.
-
What input file are you trying to analyze? Did you try pe pattern instead of coff? I think pe is more developed and has less problems. |
Beta Was this translation helpful? Give feedback.
-
that's the pattern file. I need to know which exe/dll you are using it on so i can test it and possibly fix, but i suggest you use pe.hexpat instead. |
Beta Was this translation helpful? Give feedback.
-
Input does not matter. I tried several: small .c program I compiled but the same promlem occurs if you try with C:\Windows\write.exe. |
Beta Was this translation helpful? Give feedback.
-
In the user/appsdata/local/imhex folder you will find a directory called tests. inside there is a patters folder and inside it a test_data folder. There you will find example input files for most of the patterns supported and the all should work. In particular the file called coff.obj is to be used with coff.hexpat and it runs without errors. There are subtle differences between pe and coff format. for exe/dll the recomended one is pe. coff may be for static libraries and obj files but i'm not sure. Note that i am not saying that the formats are defined for those types , i am merely pointing how the imhex patterns were created. |
Beta Was this translation helpful? Give feedback.
-
did you check the users appsdata folder and the installation folder. it must be in one of the two. |
Beta Was this translation helpful? Give feedback.
-
you may be right about not being distributed. go to pattern github repo and download/clone it. (https://github.com/WerWolv/ImHex-Patterns) |
Beta Was this translation helpful? Give feedback.
-
another possibilityis the content store but i did not see them there either |
Beta Was this translation helpful? Give feedback.
What you are looking for is how to load pattern files that can be run on the given input file. For some types of files ImHex is able to determine that for you and will ask you if you want to load some pattern file. In other cases it is up to you to select and load a pattern file. A lot of different types of files are loaded through the import menu. Open File>Import and select menu item called "Pattern file". ImHex should then present you a list of pattern files (.hexpat) to choose from. The name of the file corresponds to the type of file you want to run the pattern at. Since you mention a dll you probably are looking to use either the pe.hexpat or the coff.hexpat. Similarly for a zip fil…