| Author | Message | ||
     U. Jaenicke-Rößler (Ujr) |
Hi, I like the data interpreter and I need it often. I have a couple of ideas to enhance it. Maybe some of it is already available and I just did not find it... 1) I was searching for a float - just as a test I tried a value that the interpreter window was already showing. It was 2,070414e-19 - in hex (as output by WinHex) this is "6C 6E 74 20". However, in my file there is "69 6E 74 20" - which is certainly near 2,070414e-19, but not identical. This is obviously some "epsilon" problem when comparing floats. It would be a nice enhancement, when such an epsilon could be specified in the search dialog - maybe with predefined with some reasonable defaults. 2) I'm looking for a view of a file completely shown as floats/double/int16/int32 a.s.o. - of course with a certain adjustable offset in order to identify blocks of relevant data and find data without going through the file step by step. I'm looking for this for ages. Unfortunately a simple "template view" cannot achieve this, because it is limited in size. Is there a way to do that with WinHex? Maybe in 13.0? ;-) 3) This might be an extention to 2), but could be work with the data interpreter too. How can floats/doubles/ints a.s.o. be edited in a simple way? Last not least I found the options of the data interpreter very hard to find and to edit by the right click on the window. I often simply got the copy/paste/... context menu :-( Thanks! Best regards Ulf | ||
| Stefan Fleischmann (Admin) |
1) Good idea. 2) I can only recommend applying a template with a limited size to that part of a file that you wish to view. 3) Double-click or press F2 in the edit box, enter the number, and then press Enter. It is very easy to find the data interpreter options. You can either invoke Options | Data Interpreter (the menu command) or right-click the data interpreter window (its left half). If you right-click one of the edit boxes within the data interpreter window, you get the context menu of that edit box, of course. Is this surprising? No, this standard behavior of windows and control items in Windows. | ||
| U. Jaenicke-Rößler (Ujr) |
Ah - well, your answer to 3) is very useful, indeed. Did not know that! Great! (Btw, it makes "6C 6E 74 20" out of "69 6E 74 20" by simply pressing Return on the appropriate Edit field :-)) Regarding the context menu - I thought I could click on the edit field side outside the label/edit fields themselves. It was confusing for me when I clicked on the apparently empty part on the right side. Anyway - the menu command is probably simpler but I didn't think of it :-( Ulf | ||
| Ulf Jaenicke-Rler |
Hi, is 1) (using epsilon when searching for floats) in the works or is it planned to be included soon? BTW, the forum can't handle umlauts - at least in the subject or author fields... Ulf | ||
| Stefan Fleischmann (Admin) |
1) It's on the To Do list, but so are 250 other suggestions we have received, so I cannot promise anything for soon, sorry. Umlauts in the name field work fine from here, I just tried. | ||
| U. Jaenicke-Rößler Username: ujr Registered: 3-2005 |
Hi, I'm sorry to be a nuisance (well, at least somewhat ;-)). I just had to look for certain float in a binary file. So I came across this (rather old point) point 1) again. I wonder how useful floating point search (not only in WinHex, actually) is at all without an epsilon range. Indeed, I have never managed to find some concrete float (at least the LSB always differs). Even if I, for tests, look in data interpreter and search for a float I read there (an example can be found above in this thread). Well, the only way I was able to test is to enter the number in data interpreter and then look for it. So this is another vote for the proposed feature. Thanks! | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Understood, however, we have 572 other item on the To Do list, too. | ||
| U. Jaenicke-Rößler Username: ujr Registered: 3-2005 |
Well, I thought this proposal might have raised in the to do's because it's nearly two years old. I hope it get's to top somewhen soon. BTW, a number like "1,11111111111111111e-1111" (long double), as tested and copied from the data interpreter window, cannot be searched for because of line length restrictions in the floating point search edit box. | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Since floating point numbers practically do not play any role in computer forensics and we keep getting more relevant suggestions and have own ideas every day, it is not likely to rise, I'm afraid. |