{"id":1337,"date":"2012-10-02T17:38:58","date_gmt":"2012-10-02T17:38:58","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=1337"},"modified":"2012-10-02T17:50:33","modified_gmt":"2012-10-02T17:50:33","slug":"hexdive-0-5-adding-a-bit-of-a-context","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2012\/10\/02\/hexdive-0-5-adding-a-bit-of-a-context\/","title":{"rendered":"HexDive 0.5 &#8211; Adding a bit of a context&#8230;"},"content":{"rendered":"<p>It&#8217;s time for a new version of HexDive!<\/p>\n<p>Today&#8217;s changes introduce many new keywords and some new features + bug fixes:<\/p>\n<p>Keywords:<\/p>\n<ul>\n<li>Delphi package\/library\/unit names (I posted some subset of this list <a title=\"Random stats from 300k malicious samples \u2013 Borland Libraries\" href=\"https:\/\/www.hexacorn.com\/blog\/2012\/07\/02\/random-stats-from-300k-malicious-samples-borland-libraries\/\">previously<\/a>)<\/li>\n<li>Compiler-related strings (not that really useful for malware analysis, but may help to identify the compiler-specific strings)<\/li>\n<li>Copyright banners (I posted some <a title=\"Random stats from 300k malicious samples \u2013 copyright banners\" href=\"https:\/\/www.hexacorn.com\/blog\/2012\/07\/17\/random-stats-from-300k-malicious-samples-copyright-banners\/\">previously<\/a>)<\/li>\n<li>Registry key\/value names (also posted some <a title=\"Random Stats from 1M samples \u2013 RegKeys\" href=\"https:\/\/www.hexacorn.com\/blog\/2012\/07\/20\/random-stats-from-1m-samples-regkeys\/\">previously<\/a>)<\/li>\n<li>More information stealing-related strings (some more software targeted by infostealers, including some old ones e.g. The Bat, ICQ, AOL, etc.)<\/li>\n<li>Game-related strings (to highlight malware targeting various computer games)<\/li>\n<li>A lot new generic malware strings (from the top of the histogram of all strings extracted from 1M+ samples); many of these strings are not categorized yet, but still &#8211; better to have them being picked up than wait for a classification to be complete \ud83d\ude42 &#8211; use -a option to see what &#8216;juicy&#8217; stuff is being picked up<\/li>\n<\/ul>\n<p>New features:<\/p>\n<ul>\n<li>The output produced by -a option now includes physical offsets and may include context (see next point)<\/li>\n<li>I added a new experimental feature that shows context of the strings &#8211; basically, some bytes before and after the string in a file; this should help to quickly assess what&#8217;s the potential usefulness of the string and its context; it may also help to find other strings that are not picked up by HexDive for various reasons and that are stored inside the file within a close proximity of a found string. To see context, use a new command line options &#8216;-c&#8217;. See example below to see how it works in practice and how to use it to quickly locate strings of interest in a hex viewer.<\/li>\n<\/ul>\n<p>Bug fixes:<\/p>\n<ul>\n<li>sometimes some strings were not picked up due to a bug in the processing algorithm; this affected strings that were using mixed lower\/uppercase; should be fixed now; note: this bugfix introduces a side-effect that makes the output a bit noisier (e.g. New, NEW, NeW are being picked up; I may introduce some filtering of the output if it becomes an issue)<\/li>\n<li>sometimes some strings were printed twice &#8211; should be fixed now<\/li>\n<li>strings were not picked up\u00a0 at the end of the file &#8211; should be fixed now<\/li>\n<\/ul>\n<p>You can download current version of HexDive <a href=\"https:\/\/hexacorn.com\/download.php?f=hdive.exe\">here<\/a>.<\/p>\n<p>If your .exe download is blocked, you can try a <a href=\"https:\/\/hexacorn.com\/download.php?f=hdive.zip\">zip file<\/a>.<\/p>\n<p><strong>Example of strings with a context<br \/>\n<\/strong><\/p>\n<p>When ran with -c option, HexDive shows a string with a context:<br \/>\n<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-1340\" title=\"hdive0.5_1\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_1-300x223.png\" alt=\"\" width=\"300\" height=\"223\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_1-300x223.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_1-1024x762.png 1024w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_1.png 1037w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>At the moment, it shows a string in one row, then in a next row the actual context of the string and finally 10 hexadecimal values<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-1341\" title=\"hdive0.5_3\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_3-300x14.png\" alt=\"\" width=\"300\" height=\"14\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_3-300x14.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_3.png 926w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>that you can copy and paste into a Search\/Find in your favorite Hex Viewer<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_4.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-1342\" title=\"hdive0.5_4\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_4-300x103.png\" alt=\"\" width=\"300\" height=\"103\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_4-300x103.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_4.png 410w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>to quickly locate the string of interest and it&#8217;s context without worrying about Unicode\/ANSI\/non-printable values:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_5.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-1343\" title=\"hdive0.5_5\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_5-300x84.png\" alt=\"\" width=\"300\" height=\"84\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_5-300x84.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/hdive0.5_5.png 644w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s time for a new version of HexDive! Today&#8217;s changes introduce many new keywords and some new features + bug fixes: Keywords: Delphi package\/library\/unit names (I posted some subset of this list previously) Compiler-related strings (not that really useful for &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2012\/10\/02\/hexdive-0-5-adding-a-bit-of-a-context\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[23,9,5],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1337"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=1337"}],"version-history":[{"count":7,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1337\/revisions"}],"predecessor-version":[{"id":1347,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1337\/revisions\/1347"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=1337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=1337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=1337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}