Hi!
First of all, excuse my English, I'm a german without great english knowledge ...

Okay, here my problem: I have an application, which I loaded in W32DASM. There I looked for the right address, wich I want to edit in hview. But it is displayed as :xxxx.xxxx and not how its usually displayed as :xxxxxxxx. Therefor I can't find the right address in hview to change...
I have no idea how I can convert the :xxxx.xxxx into :xxxxxxxx. And of course I searched the board and google, but I didn't get any results which helped me.

I hope you understood my problem and know what to do!

Esbit

you should use a windows gui hexeditor(hexworkshop).Its more easy for you

search the forum searching+hex you find more info


*search the forum before asking any question

As I told you, I did search the forum.
Its not important, which hex editor I use, my question was, how to convert that :0017.00B1 Code Data into normal Hex-Code, like :000406C7 to find the right line in any Hexeditor. I tryed several hex editors, but the addresses were the same.

This adress notation style eg:0017.00B1 seems to be a 16 bit application.
In this case, the first 2butes is a memory offset and the second one is the offset of code in this segment.

For your case, maybe it will be more simply to search a suite of bytes in an hex editor like hexworkshop (for exemple).

hmm . . . isn't it possible to convert this 16-Bit Code into 32-Bit Code, so I can find the right address in another hexeditor, which shows only 32-Bit Addresses?

Hi.
Take a look at windasm's output because you can find the address by yourself.

At the top of the output produced by windasm there are the informations about the objects which are something like:
Object1:
rva = 0x0000000
offset = 0x00000200
size = 0x00001234
...
There are other informations but you don't need them.

Suppose to have:
0001.000A CD 21 int 21

How can you find the right address in hiew?
You have to add 0x000A to the offset of the object, in this case you have: 0x00000200 + 0x000A = 0x0000020A
and 0x20A is the address you are looking for.

hmm, if I highlight the address :0017.00B1 in w32dasm, i get the offset :0000A9B1. "0017" is the dec code sektor and "00B1" is the hex Code Offset, isn't it? if I add 00B1 and 0000A9B1 I get 0000AA62. But that can't be the right address, because hview says "segment out of file". What have I to do with the "0017" to become the right address?

EDIT: Okay, I solved the problem by myself! I didn't know, that you are able to put the offset directly into hiew... but thanks to you all!

Esbit

Why do you want to do that complicated thing?

Simply look at the w32dasm status bar at the bottom.

Each XXXX:XXXXXXXX address is also represented by XXXXXXXX address as physical in file. That XXXXXXXX is what you have to edit.

Have Phun