FlexHEX Editor - Just the Right Tool to Edit Binaries

Tutorials

Hex Editing for Beginners

Modification Tracking

File Comparison

Hot Tracking File Changes

Accessing Locked Files

Online Help

Introduction

Files and Drives

Inspecting Data

Editing Data

Navigation

Search and Replace

Tools

Complex Data Types

Advanced Features

Articles

NTFS Alternate Streams

Links, Junctions, Shortcuts

NTFS Sparse Files



      
 

 

Modification Tracking Tools: Area Pane and File Map

When editing a file, it would be very useful to keep a record of what have been modified. For a text file, tracking modified areas is all that is needed; but things are a little more complicated in case of a binary file. For many binary files the data position is no less important than the data itself, and shifting a data block to another position may invalidate internal links and so render the file unusable.

A Simple Example

The best way to understand the FlexHEX modification tracking features is by example. Start FlexHEX and create a new file containing 16 bytes with values from 00 to FF. Save the file and the file map pane will immediately appear (the file map is not shown for a newly created file until it is saved).

The map of this file looks rather simple - it is just a single green box, because the file consists of a single area of unmodified data:

   File map of an unmodified file

Now switch the editor to the insert mode (the status bar shows the current editing mode), go to address 00000004 (right before byte 44) and enter F0. This operation inserts byte F0 moving the data down, and the file map displays the new file layout:

   Single byte has been inserted

Green represents the unchanged block at the beginning of the file, red is the inserted block (that is the byte F0 we have just entered), and the light brown is the block shifted down.

Tip We use blue and brown for shifted blocks to make memorizing easier. Blue means "up" (to the sky), and brown means "down" (to the ground).

You may have noticed a new Area pane showing up in the Navigation panel. This pane is always shown when the file consists of two or more areas:

   Area pane appears when there is more than one area

The Area pane contains the complete list of areas - in fact, the file map is simply a graphical representation of the Area pane. We'll talk later about the Area pane and its usage.

Go to the address 00000008 (where the byte 77 is) and press the Delete key. This operation restores the original position of the block after the caret and the map now looks as this:

   Position of the last block has been restored

Delete the byte CC at the address 0000000C and the map changes once again:

   The last block moved up

Now we can see the blocks of four types:

  • Two green unchanged original blocks,
  • A blue original block moved up,
  • A light brown original blocks moved down,
  • And the red modified/inserted block.

There is one more block type we didn't mention before - it is often useful to know that a block contains only zeros. Press Ctrl-End to go to the end of the file and insert a zero byte using the Edit / Insert Zero Block command. This creates an area of the fifth type - gray color represents a sparse zero area or a block inserted with the Insert Zero Block command.

   A zero block has been inserted

It is surprising to see how much information can the file map provide. Although the edit window marks the changed data in red, all we can see there is that two bytes has been modified. The file map however shows the real picture, and we can easily see that there have been a lot more changes.

Area Pane: Conclusion

While we were editing the file, the Area pane was also changing to mirror the current area layout:

   Area pane displaying the final result

Even if not so illustrative as the file map, the Area pane shows all the areas, no matter how small. This makes the Area pane the primary modification tracking tool.

You can use the Area pane to quickly navigate through the file areas. Clicking on the Address field will take you to the start of the area; clicking the Size field selects the area. The usage of the Shift value (if present) is less obvious - clicking it moves the caret to the position the start of the block initially was, that is, moving the block so that it starts on that address will turn the block back green.

File Map: Conclusion

The file map provides a graphical view of the Area pane. It may be very useful if a typical block size is comparable to the file size. Is a block is too small, it may be hard to notice on the map - or even not shown at all. This is the reason why the map view is turned off by default for disks - maps are virtually useless for tracking small modified areas in huge streams. In such situations you will have to rely on the Area pane.

As the Area map, the file map can be used to navigate the file. Left click any position on the map to jump there; right-click a block to call up the block menu.

In general, both the tools provide an easy and convenient way to keep track of a complex editing operation.


Comments? Suggestions? Please feel free to let us know.

 
Copyright © 2007 Inv Softworks LLC
All rights reserved
 
Home | Product | Download | Order | Support | Documentation | Company