I remember reading a thread here before, in which it was mentioned a bug in Hex Workshop that made it silently fail to write data to some files under certain conditions (files over a certain size, too high offsets, too large data pastes or something like that). It was discussed because it caused big trouble for someone during a project, until he found out that it was not his fault, but that his file modification had partly failed due to this bug. Sadly I cannot find that thread again.

I was just wondering if anyone knows what I'm talking about, and if that bug has been fixed yet? Hex Workshop seems to have been stuck on version 3.11 for quite a while now, so I'm a little afraid that it hasn't. Although it's a very nice program, such a bug simply means just too much potential trouble for me to dare using it.

Anyway, in that same thread, someone else recommended another hex editor that should be somewhat equal to Hex Workshop, and I would really like to take a look at it if I just knew its name, but I don't.

So, can anyone recommend a really good Windows hex-editor (i.e. not Hiew), except Hex Workshop? (I've already tried to search for other such discussions in this forum, but didn't find any)

Any and all tips would be much appreciated.

Thanks!

Hi,
JimmyClif has given you the right search methods
search for it

Yeah, it seemed it had trouble saving large files sometimes when you would add a large amount of data to the end of the file (i.e. paste a new IT, heh.) It would corrupt the file with random bits of data from your harddrive. Really strange bug, I would find bits of text from some asm file or letter in the new section of the saved file. I heard someone else experienced that as well.

I found a simple solution though. It had something to do with saving the file under the same filename with 'Save'. If you selected SaveAs and a new filename it would save the file OK no matter what the size.

Now, I'm going to scold you slightly, not for the usual 'searching' rhetoric which I think there's a little too much fuss made over anyway, but for what you said about "...too much potential trouble for me to dare using it...". Now I'm only teasing, but that's a BAAAADDDD attitude to have if you're going to do RE. That's like saying you never want to delve into Ring0 because you're afraid it might hang your system. Get over it and grab your crash helmet

Kayaker

What do you think about UltraEdit v8.0 ? (v9 is crap)

Yeah I'm a little dubious about v9 too. I use UE as an ASM IDE and found the new version gives problems with some syntax highlighting settings and mouse clicks often turn into line selects too easily. A few nice new features like the search combo box but overall v8 seems a little less quirky.

Thanks for the reply Kayaker! I never actually thought anyone would know what I was talking about.

I must defend myself from your light scolding though :

1.
There is one big difference between using a software that has a bug that can silently and undeterministically cause lots of trouble for you, and diving head-first into ring-0 code: If my ring-0 experiments wreak havoc with my computer it is my own fault, and I also have control over it and can fix it. In the former case, I cannot do anything, and just have to put up with the fact that any problems with my patched files might be due to a faulty patch, and not my own fault, which is very uncomforting. (ok, I guess I could theoretically reverse Hex Workshop and fix the bug myself, but let's be sensible here )

2.
It was not just "the usual searching rhetoric" from my side, I really tried to find it by searching, but some things are very hard to find in that way, since either you must already know certain keywords which might be the exact things you are looking for (and hence don't know them before finding the answer ), or you get so many hits that you never find what you're looking for anyway. But I agree that there is a little too much fuss about the searching here, which is why people always feel compelled to mention that they "have already searched but didn't found the answer" in every post. Otherwise you risk being immediately flamed, which is neither fun nor productive. Of course I understand that some questions could indeed be resolved very easily by searching, so sure these people should have searched and should be told so, but some things are very hard to find, even if they have indeed been discussed here before (see the reasons above), and hence, some people here should maybe take it just a little more easy with the "use the search" flames.


But in any case, even though my statements above might seem a little serious, I know that you were just joking and they are in no way directed to you, I just thought some people on the board should read that.

Thanks again Kayaker.

Maybe of no interest, but HexWorkshop is available in a 4.0 beta version.
hobgoblin

Right Hobgoblin !
I'm using HW 3.11 from a long time with the bug described here, i've now 4.0 beta and it seem to work fine (only the last beta).

Hi hobgoblin/LOUZEW,
have you tried this last version of HWS?
I have not tried it yet mainly because the new features that have not captured my attention and because I like old friendly tools
Btw, I have seen they have released the beta n° 4, it seems to be very bugged...

ZaiRoN

v4.0 final is released.

I'm not sure, the news-entry regarding this on http://www.bpsoft.com is dated "5 Jan 2004", so maybe it's just a prediction about when they will have a bug-free version available.

The bug discussed in this thread is not mentioned in the "bug fixes" section of the version history of version 4.0.

Are you sure it's fixed LOUZEW? Have anyone else verified this (e.g. by trying it with a test case that always failed in 3.11)? I don't have any good test case, so I cannot verify it myself.

Just D/L the 4.0 final.
Trying now, let you know !

OK, it seem to work right now (also with large files)

Ok, cool, thanks!

Still strange that they didn't mention it in the version history though!?

I discovered the same bug yes

I bug-reported it like 3 weeks ago, it was happening with version 3.11 and with 4.0 beta 3 (at that time). But it seems to be fixed in version 4.0 final.

I think it maybe sounds little said to tell copy paste of more then 0x100000 bytes will cause a crash... especially when the changelog also includes the new 4GB support!

not that I found it the right way, I think they better always can be honest what is fixed and what not. Anyway it is working now, so who cares....

ppl at BPSoft... keep up the good work.

(ps. Though I really don't like they didn't send any reply on my mail).