
  Hiew release 6.86                                    Dedicated to my wife...


 Visit  http://webhost.kemtel.ru/~sen  for news

 Release 6.70 notes 

        Crypt is 32bit now.  Crypt-program (*.cry) is writing in text  format.
Old binary format from 5.01 support by current version 6.7x only !  Added  two
new operation: AND, OR. Count lines of program up to 32.  You can use  comment
line begin with ';'.

 Release 6.60 notes 

        Little-endian ELF support
        EDUMP - common dumper for NE/LX/LE/PE/ELF - files

 Release 6.29/6.30 notes 

        32-bit console version for Windows.
        PEDUMP.EXE - dumper for PE-files.
        All utilities compiled for DOS, OS/2, Win32

 Release 6.15 notes 

        With this release HIEW is SHAREWARE. See register.txt for details.

 Release 6.00 notes 

The following enhancements have been added to release 6.00:

- "crypt" has been removed (it will be a separate project)
- command line file list switching moved to CtrlF11/CtrlF12.
- Alt- functions moved to Alt-Fn (except Alt-P, Alt-H, Alt-=). see
hiew.hlp for details.
- history has been added for string input (PgDown) and file section
(pess Backspace to see menu, Tab to switch to the next file in the
history).
- "ActionAfterWriteSavefile" removed from the ini-file.
- "NextFileSaveOffset" (save current offset for the next file)
removed by "NextFileSaveOffset"(save all conditions for the next file)

 Release 5.30 notes 

  LX-executables support added:
- viewing of LX-heades
- viewing of tables of objects
- support for the reference table for some types of relocations.
- added new utilite "LXDUMP.EXE" for those, who want to view LX-files
more detailed.

 Release 5.21 notes 

  NE-executables support added:
- viewing of NE-heades
- viewing of tables of objects
- support for the reference table for some types of relocations.
- added new utilite "NEDUMP.EXE" for those, who want to view NE-files
more detailed.

 Contents 

  1. About HIEW
  2. Assembler mode
  3. Basing
  4. Block operations
  5. Status bar
  6. Keys
  7. Bookmarks
  8. Jumps (call/jmp) in the disassembler mode
  9. Search/replace operations
 10. Crypt operations
 11. INI file
 12. SAV file
 13. XLT file structure
 14. Command line
 15. History

 About HIEW 

        Basically HIEW is a hex viewer for those who need to change some bytes
in the code (usually 7xh  to 0EBh).   Hiew is  able to  view up 4G-length
files in text/hex modes and in Pentium(R) Pro disassembler mode.

    Features:

  Text/hex mode editor
  Built-in Pentium(R) Pro assembler
  Ability to create new files
  Search and replace in the blocks
  Context-sensitive help (HIEW can operate without help file HIEW.HLP)
  Search of assembler commands using pattern
  Version 5.02 compiled for OS/2, EXE for DOS is used as a stub

 Assembler mode 

        "Byte/word/dword/pword/qword/tbyte"    may    be    abbreviated     to
"b,/w,/d,/p,/q,/t,".  All numbers are hex, so the letter "h" is optional.  You
can use math operations (i.e.  mov  bx, [123+23-46h] = mov bx,[100h]).   Error
messages are very brief  (invalid  command,  syntax  error,  invalid  operand,
missing/invalid size).  Unconditional JMP will be translated to 0E9 XX XX,  so
if you want near jump (0EB), you need  to type jmp short xxxxx (or jmps  xxxxx
).

        There is 386  assembler in HIEW  version 5.00 or  later, so check  all
jumps carefully because you may get unwanted long jump in 8086 code.

        WARNING!  The same command can  be assembled differently depending  on
the assembler you're using.

 Basing 

        Base is a constant  that is added  to offset and jump  addresses.
If current offset is YY and you need XX, you should type base "*XX"  (asterisk
is required!). You can use Ctrl-F5/Ctrl-F5 as *0.

 Block operations 

        Block operations works only  in "Hex" and  "Decode" modes.  You  can
mark blocks without switching to Edit  mode. The Marked block  can be  written
to the file using PutBlk(F2).
        If you want to append the block to the end of the file, you should type
"FFFFFFFF" offset.  You can insert the block to the current file from  another
file using GetBlk (CtrlF2).  The block will be inserted starting with the
current offset.

        With release 6.10 if there is no marked  block in  current file,
the block is choosen from the history files, where it can be found.


 Status Bar 


 xxx% Filename.ext dFRO    NE xxxxxxxx xxx -------- YYYYYYY HIEW X.XX (c) SEN

            
 percent                 current               file length in bytes
 indicator               offset       
 (only if BAR=P        V                  1: status of the bookmarks:
  in HIEW.INI)         NewExe type          '-' free
                V                       >   '1...8' corresponding position
         filename                            is currently occupied
                                              '*' current
 find direction <ٳ                         2: "<Editor>" = Edit mode
                                     
                    V                 
         search area:                 > 1: Text mode: number of the first
     F - current file                        column
     B - block                            2: Decode mode: measurement of
     A - list argv**                         operands and addresses
                                             (prefix 'a' shows automatically
                     V                         recognized size of code)
                 status of the file:
                 R - opened in Read mode
                 W - opened in Write mode
                 U - modified
                      
                      V
                    O - overwrite block
                    I - insert block


 Keys 

        All keys are described  in HIEW.HLP  (press Alt-H).   HIEW.HLP may  be
modified.  The first line of HIEW.HLP must be "[HiewHelp 5.01]".  Semicolon ';'
means a comment.   The corresponding section  (from
[xxxx] till [yyyy]) will be  displayed by pressing Alt-H.   HIEW.HLP  must
be  terminated  with [End].


 Bookmarks 

        Bookmarks are
for saving/restoring of the current screen.  Press '+' to
save the state of current screen.  Eight screens can be saved.  To restore any
saved screen, press Alt-1...Alt-8 correspondingly.  There are special bookmarks
for every mode (Text/ Hex/Decode).

 Jumps (call/jmp) in the disassembler mode 

        Now jumps are more configurable.  Jumps can be specified in HIEW.INI in
the jumpTable array. This line (in terms of C Language) consists of digits and
letters.
The first character ('0' in HIEW 4, 'Z' in HIEW 5 day 28) is used to undo jump.
After reading from keyboard the character will be converted to the upper case,
then will be searched in the jumpTable.   Default values  of jumpTable  are
'1'-'9', then 'A'-'Z'.

 Search/replace operations 

        If search string was entered  in ASCII field, case-insensitive  search
will be performed.  If you  want to  perform case-sensitive  search, move
cursor to the HEX field and press Enter.

        You can search assembler commands (F7).

        Now search/replace can be restricted to the selected  block (F4 during
entering the search/replace string).

        In the disassembler mode  assembler  commands can be searched with
wildcards. The wildcard character  is '?'.
        For example, DECODE <F7><F7> 'mov ax, ?' will look for 'mov ax,1234h",
"mov ax,sp", etc.

                                 ***NB***
        strings compares without conversion! Please, indicate all leading
        zeroes! 'cmp ?,0ab' for byte, 'cmp ?,000ab' for word, etc...


        With release  5.83  multiline  assembler  commands can be searched
with delemiter sign ';'
        For example: "push ?10; call ?; add ?"

        will find:                      will not find:
        --------                        ---------
        push 00010                      push 00010
        call 01234:05678                push 00011
        add  sp,00006                   add  ax,00006


        With release 6.10 search/replace can be performed in all
files from command line.  This feature starts to work when "fillArg"
option is selected by pressing "F4" in the search/replace input.


 Crypt operations (F7/F8 in Edit) 

        Crypt operations are used for crypting/decrypting the code/data with a
rather  simple  crypt  algorithm.   Code/data   will   be   crypted   by   the
bytes/words/dwords (to change the size ot the unit, press F2).  Crypt  routine
must be terminated with "LOOP numberLine" operator.

              Available commands:

        Reg mode    : neg,mul,div
        Reg-Reg mode: mov,xor,add,sub,rol,ror,xchg,and,or
        Reg-Imm mode: mov,xor,add,sub,rol,ror,and,or
        Imm mode    : loop

        All 8/16/32 bit registers are available, except AL/AX/EAX that will be
filled with the (de)crypted byte/word/dword.

   The differences from the standard assembler:
      * there are no jumps;
      * 'loop' means 'jmp/stop'
      * the operands of 'rol/ror' commands must have the same size, i.e.
          ROL AX,CL not allowed.
      * 32bit registers not available for command 'div','mul'

   Example:
     a. XOR byte with 0AAh:
        1. XOR  al,0aah
        2. LOOP 1

     b. XOR word with mask increment
        1. MOV  dx,0
        2. XOR  ax,dx
        3. ADD  dx,1
        4. LOOP 2

     c. divide byte by 2
        1. MOV  cl,2
        2. MOV  ah,0            ; register AH use for DIV
        3. DIV  cl

     d. formula calculate: ax=(ax*3)/2
        1. MOV  bx,3
        2. MOV  cx,2
        3. MUL  bx              ; result store into (DX:AX)
        4. DIV  cx              ; divide (DX:AX) by CX

 INI file 

        INI file must be located in HIEW.EXE home directory.  INI file can be
specified with "/INI=<inifile>" key in the command line.
   The first line in HIEW.INI is always "[HiewIni 5.03]" !
   Blank lines and comment lines (beginning with ';') are ignored.

-----8<------ Example HIEW.INI -------8<-------

    [HiewIni 5.03]
;
;       Startup
;                                        ; legal values

; startup mode
;
 StartMode               = Text          ; Text | Hex     | Code

; beeper
 Beep                    = On            ; On   | Off

; percent indicator
 Bar                     = Left          ; Left | Right   | Percent

; wrap/don't wrap long lines
; Auto=Off for textfile, On for binary
 Wrap                    = Auto          ; Auto | On      | Off

; tabulation
; Auto=On for textfile, Off for binary
 Tab                     = Auto          ; Auto | On      | Off

; step for Ctrl-Left, Ctrl-Right in textmode
 StepCtrlRight           = 20            ; 1 - 128

; Show/Don't show mouse cursor
 DisableMouse            = On            ; On   | Off

; table symbols for branch call/jmp
 JumpTable               = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"

; Select symbol "linefeed": automatic     0x0a / 0x0d / 0x0d:0x0a
 Linefeed                = Auto         ; LF  | CR  | LFCR              v5.10

; Automatic definition of code size of LX-executables
 AutoCodeSize            = On            ; On   | Off                   v5.41

; Flush keyboard buffer before reading a key
 KbdFlush                = On            ; On   | Off                   v5.50

; View Offset for NE/LX/PE as local/global (toggle Alt-G)
 ShowOffset              = Local         ; Local | Global               v5.51

; Mask for displaying offset in the pattern search
 RunningOffsetMask       = 0xFF          ; 0 - 0xFFFFFFFF               v5.53

; Xlat table index in hiew.xlt ( 0 - As Is )
 XlatTableIndex          = 0             ; 0 - 15                       v5.85

; sort in filelist
 FlistSort               = Name         ; none |Name |Ext |Time |Size   v5.90

; reverse sort in filelist
 FlistSortReverse        = Off          ; On    | Off                   v5.90

; show hidden files in filelist
 FlistShowHidden         = Off          ; On    | Off                   v5.90

; save current state( mode, offset, bookmarks, etc) for the next file
 NextFileSaveState      = Off          ; On    | Off                    v6.00

; Scanning code step for search with pattern and search reference
;                                       / by command  / by one byte
 ScanStep                = Command      ; Command     | Byte            v6.00

; Write savefile at exit
 SaveFileAtExit          = Off          ; On | Off                      v6.00

; Location of savefile
; first char '$' as hiewdir, ex.: "$\hiewsav"
 Savefile                = "hiew.sav"                                   v6.00

; numeric base for calculator
 CalcBaseNumber          = 16          ; 10 | 16                        v6.30

; info bar
 InfoBar                 = Off         ; On | Off                       v6.40

; ON  - get block from file at cursor
; OFF - get block from file at top block
GetBlockAtCursor   = On            ; On    | Off                        v6.40

; reopen file after edit in read-only mode
ReopenAfterEdit    = Off           ; On    | Off                        v6.40

; confirm for "Truncate file", "Delete block", "Copy/Move block"
ConfirmDestructiveOperations = On  ; On    | Off                        v6.40

; Number of showed opcode bytes in decode mode
OpcodeShowBytes    = 14            ; 0-14                               v6.50

; starting mode for line edit
LineEditMode       = Overwrite     ; Overwrite | Insert                 v6.50

; starting mode for blockcopy/blockmove
BlockMode          = Overwrite     ; Overwrite | Insert                 v6.50

; code highlighting
CodeHighlighting   = On            ; On | Off                           v6.80

; Files list (F9) reread always
FilelistRereadAlways = Off         ; On    | Off                        v6.82

; Show info message, ("prepare relocations" etc...)
InfoMessage = Off         	   ; On    | Off                        v6.83

;
;       Colors
;
 ColorCodeMnemonic       = 0x1B                                         v6.80
 ColorCodeNumber         = 0x1D                                         v6.80
 ColorCodeMemory         = 0x1A                                         v6.80
 ColorCodeName           = 0x1E                                         v6.80
 ColorCodeRegister       = 0x17                                         v6.80
 ColorHeaderEditWin      = 0x50                                         v6.50
 ColorHeaderEditNorm     = 0x5F                                         v6.50
 ColorHeaderEditBold     = 0x0F                                         v6.50
 ColorHeaderEditBChange  = 0x0E                                         v6.50
 ColorHeaderEditChange   = 0x5E                                         v6.50
 ColorInfoBar            = 0x70                                         v6.40
 ColorMain               = 0x1B       ; main color
 ColorCurrent            = 0x71       ; current byte
 ColorMark               = 0x5E       ; block color
 ColorEdit               = 0x1E       ; file editing
 ColorEditOut            = 0x1D       ; non-file editing
 ColorError              = 0x4E       ; error messages
 ColorMsg                = 0x2E       ; messages
 ColorTitle              = 0x70       ; status bar
 ColorKbNum              = 0x07       ; keys
 ColorKb                 = 0x30       ; key is active
 ColorKbOff              = 0x37       ; key is inactive
 ColorBar                = 0x02       ; progress indicator
 ColorWin                = 0x70       ; input dialog
 ColorWinBold            = 0x7F       ;  - " -  selected
 ColorWinInput           = 0x3F       ;  - " -  input field
 ColorMenu               = 0x30       ; menu frame
 ColorMenuText           = 0x31       ;  - " - field
 ColorMenuBold           = 0x0F       ;  - " - text
 ColorHelp               = 0x20       ; help frame
 ColorHelpText           = 0x2E       ;  - " - field
 ColorHelpBold           = 0x0F       ;  - " - text

; ---+--- End of Inifile ---+---

--------8<--------8<--------8<--------


 SAV file 

        If executed without any parameters, HIEW looks for SAV-file in the
current directory ("HIEW.SAV" or the value of 'savefile' statement in HIEW.INI)
and restores the previously saved (Ctrl-F10) state.


 XLT file structure 

typedef  struct{
   BYTE  sign[ 9 ],             // "HiewXlat",0
         unused[ 5 ],
         versionMajor,          // 0x05
         versionMinor;          // 0x40
   }XLAT_HEADER;

typedef  struct{
   BYTE  title[ 16 ],           // show in F8
         tableOut[ 256 ],       // for output
         tableIn[ 256 ],        // for input
         tableUpper[ 256 ];     // for search with ignore case
   }XLAT;

 Maximal count xlat-table is 7

 Command line 

 Hiew [/SAV=<savefile>] [/INI=<inifile>] [/s]filemask ...[/s][filemask]

      /SAV=<savefile>                  - location for savefile
      /INI=<inifile>                   - location for inifile
      [/s] filemask ... [/s][filemask] - more files, include pattern

      Option /s toggle search with subdirectories:
 hiew /s *.dll *.exe /s *.txt -> search .dll and .exe with subdir and
                                 .txt only in current catalog

 Thanks 

 Special thanks to:
        Alexander Orechov as best beta-tester
        Alexander Volok
        Arkady Kapustinsky for ELF-files support
        Ilfak Guilfanov for NE-files support
        Kaspersky Labs, AVP research team for common support
        Michail Korneff for english translation of dox
        Roman Potapov for attach to unix
        Vladimir Ibatulin as bug-finder

 Thanks for beta-test:
        Elias Bachaalany
        Erwann Corvellec
        Konstantin Zhdanov
        Michael Orechov
        Nicola Krasnoyarsky

 Thanks for Q&A:
        Ruslan Kantorovych
        Tadashi Yamakawa

 Thanks to:
        Alexei Kulencov
        Andrew Shipinsky
        Kirill N. Joss
        Stas Mechanoshin
        Vladimir Kalashnikov

 History  

 5.03aa  3/10/95 - OS/2: DosSleep( 1L )
                 - Invisible cursor
 5.10ee 22/12/95 - fix: wrong jump with Jc 7E/7F
                 - fix: invalid opsize, if previous byte is 0x0F
                 - save screencopy to the file
                 - "linefeed" option in INI-file
                 - replace is perfomed with a full buffer (was: 1 byte )
                 - OS/2: Hiew gets keys with KbdCharIn (was: getch() )
                     DosSleep(1) removed
 5.11bb 24/01/96 - fix: call/jmp PWORD ptr
 5.13   01/02/96 - fix: wrong marking of secondary string
                   fix: crash during scrolling up, if previous code is
                      24 one-byte commands (for example 24 NOPs )
                   fix: OS/2: trap during the creation of file
 5.14   09/04/96 - fix: ( from 5.13 ) unnecessary prefix 0x66
                 - fix: wrong assembling of [EBP]
                 - fix: arriving of 0x0A during (Pg)Up
                 - leading zero added to all digits in decode mode
                 - pattern search looks like search in decode mode
 5.15   12/05/96 - fix: pattern search truncates pattern string
 5.16   28/05/96 - fix: pattern search can't find "mov ax,?"
 5.20   17/06/96 - NE-executable: Header & segment table
 5.21   27/06/96 - NE-executable: support of TransSegment calls
 5.22   01/07/96 - Fill block
 5.23   12/07/96 - NE-executable: support of entry table
 5.24   30/07/96 - fix: crash after replace in decode mode
 5.30   20/12/96 - Support of LX-executables (header, object table, call/jmp)
                 - Named ordinals in NE- and LX-executables
                 - fix: invalid percent bar during displaying of long files
                 - fix: assembling of relative jmp/call > 8000
                 - fix: Saving of hiew.sav before edition disables write operation
 5.31    9/01/97 - Alt-O in decode: show/don't show ordinal names
                 - fix: incorrect far jump/call in exe-MZ (from 5.30)
 5.40   29/01/97 - F4 in NE/LX header: goto the top of NE(LX) image
                 - F8 in text: selection of translation table
                 - Alt-G: toggle Global/Local offset in NE(LX) files
 5.41   31/01/97 - "AutoCodeSize" in INI-file: automatic definition
                     of code size (32/16) of LX
                 - Alt-R: Reload file
                 - fix: russian 'p'
 5.50   10/02/97 - support of PE-executable (header, object table)
                 - "KbdFlush" in INI-file: flush keyboard buffer
 5.51   27/02/97 - jmp/call are showed as local ones
                 - import of names from NT's PE
                 - input (F5) local offset, if first symbol is '.'
                 - insert "call"/"jmp" before system functions
                 - "ViewOffset" in INI-file
 5.52    4/03/97 - for the local offset in NE/LX/PE pattern search is perfomed
                   only in code segment
 5.53   18/03/97 - "RunningOffsetMask" in INI-file
                 - bug in HIEW.XLT fixed: wrong table of upper symbols
 5.60   10/04/97 - option /s in command line
                 - fix: loosing of double prefix 66(67)
                 - fix: assembling of relative jmp/call > 8000 bytes
                     (fix in 5.30 is incorrect)
                 - fix: jmp/call with prefix 67
 5.61    2/06/97 - new releases of NEDUMP.EXE and LXDUMP.EXE (ability to show
                     named ordinals from hiew.ord)
                 - assembles "rep cmpsd" as F3 66 A3 ( was: 66 F3 A3 )
                 - for the binary files 'line feed' defined as CR/LF
                 - length of line in decode mode increased
 5.65   24/07/97 - xor with a string added in crypt mode
 5.66    4/08/97 - fix: trap in Win'95 - unnecessary free()
 5.67   14/01/98 - fix: wrong translation of big blocks
 5.70   13/03/98 - fix: text files, beginning with 'NE'...
                 - calculator with parenthesises and priorities (Alt-=)
                 - Pentium(R) Pro (dis)assembler (includes floating and MMX)
 5.71   30/03/98 - shows import of delphi exe
 5.80    7/04/98 - support of LE-modules
                 - new release of LXDUMP.EXE (supports LE)
 5.81   10/04/98 - bugfixed release of 5.80
 5.82   28/04/98 - internal changes
 5.83    7/05/98 - fixed bug (5.70): crash with a long string in Crypt mode
 5.84   13/05/98 - Alt-9 restores the last edited position
 5.85   10/06/98 - fix: prtScr into existed file
                 - F5 in FindInput: go to the last position
                 - "XlatTableIndex" in ini-file
 5.90    9/07/98 - List of files
                 - "FlistSort" in ini-file
                 - "FlistSortReverse" in ini-file
                 - "FlistShowHidden" in ini-file
                 - "NextFileSaveOffset" in ini-file
                 - command line parameter "/SAV=<savefile>" (was: "/FS=")
                 - new parameter in command line "/INI=<inifile>"
                 - fix: lose of the first empty line in the text
 5.91   17/08/98 - Alt-R in Filelist (reread catalog)
                 - fix: swithing to the beginning of the EXE-image
                 - include DEXEM.EXE - DualEXEcatableManipulator (NE/LX/LE)
                    ( replace stub, split old-exe & new-exe, ...)
 5.92   21/09/98 - Alt-S in decode: toggle scancode step (byte/command)
                 - "timeslice" in Windows
                 - import of PE has been changed
                 - fix: empty filelist in the command prompt
                 - fix: restore current offset from .sav
 6.00   19/10/98 - "ActionAfterWriteSavefile" has been removed from ini-file
                 - "NextFileSaveOffset" has been removed from ini-file
                 - no more crypt, sorry...
                 - support of NLM-module
                 - history of files (Backspace, Tab)
                 - history input (PgDown in edit input string)
                 - Ctrl-* marks all
                 - "SaveFileAtExit" in ini-file
                 - "ScanStep" in ini-file
                 - "Savefile" in ini-file
                 - "NextFileSaveState" in ini-file
                 - DEXEM.EXE v1.50 supports PE
 6.01    9/12/98 - crypt returned !
                 - Info moved to Ctrl-Alt
                 - fix: trap while scanning PE with zero virualSize
                     in the PE-section
 6.02   26/01/99 - fix: wrong canonization of names from CD
                 - auto switching of ascii/hex in search string input removed
                 - scale in info
                 - dos version compiled for 80286
 6.03    3/03/99 - Decode: Alt-F7(Auto) moved to Alt-F9
                 - Alt-F7 swithes search direction
                 - help moved to F1
                 - save search position durind the change of modes
                 - (OS/2 & KbdFlush=off) updates screen when keys aren't pressed
                 - Dexem.exe  v1.51
                 - Lxdump.exe v2.02
 6.04   26/03/99 - fix: jmp 0xFFFFFFFF haven't displayed target
                 - fix: division by zero with 'A%0' in calculator
                 - fix: incorrect assembling of Jxx in 32bit mode
                 - fix: backward search with '0xFF 0xFF 0xFF... 0xFF' :-)
                 - 32bit mode: 'mov SegReg,Reg16' displays instead of 'Reg32'
                 - multiline search with pattern in decode mode (undocumented since 5.83)
                 - syncronize toggle flag of search direction
                 - search conditions are saved during swithching to the next file
                 - key '/' in decode mode: current offset at top
 6.10   24/05/99 - multifile search/replace in the files from command string
                 - selection of marked block from the history file for GetBlock
                 - fix: in multiline assembler search
 6.11    2/07/99 - fix: crash with the big block filling
 6.15    7/07/99 - SHAREWARE version
 6.16   19/08/99 - update english doc
 6.20   19/08/99 - Pentium-III(R) dis/assembler
                 - Alt-F10 - Leave current file
                 - fix: goto for local offset above .80000000
 6.29   24/12/99 - Win32 console
  (public beta)  - in filelist: CtrlPgUp - go parent dir
                 - fix: pattern-search failed in new-exe files with
                    non-sorted segments
                 - fix: crash on novalid LX
                 - detail dumper for PE-files PEDUMP v1.00
 6.30   21/02/00 - suffix 'T' for decimal input, 'H' for hex
                 - "CalcBaseNumber=" in ini-file
                 - nextfile/prevfile moved for marked files into filehistory
                 - for PE: call on jmp showed target call
                 - return's stack for goto/search/edit/cref on Ctrl-Backspace
                 - hex-mode for search-input by 3 bug (invalid hex-digit)
                    switch automatic into ascii-mode
                 - in history last selected stay top
                 - for OS/2, Win32 diskerror handler
                 - fix: Win32: on numpad missing digit for numlock-on
                 - fix: codesize=16 for MZ-stub into dual executable files
 6.31   11/03/00 - fix: numlock & grey numpad
 6.32   29/03/00 - fix: change codesize by turn off autocode
 6.33    1/04/00 - fix: crash on invalid(no nulled name) import PE
 6.40   24/04/00 - AMD 3DNow! dis/assembler
                 - Block insert (Insert toggle for Ctrl-F2)
                 - Block delete (Shift-F2)
                 - Block copy (Shift-F5)
                 - Block move (Shift-F6)
                 - InfoBar (Shift-F1), "InfoBar=" in ini-file
                 - "GetBlockAtCursor=" in ini-file
                 - "ReopenAfterEdit=" in ini-file
                 - "ConfirmDestructiveOperations=" in ini-file
 6.50   16/05/00 - NewExe Headers editor
                 - change to numbers of opcode bytes
                   ("OpcodeShowBytes=" in ini-file, Ctrl-Left/Rigth in decode)
                 - "LineEditMode=insert/overwrite" in ini-file
                 - "BlockMode=insert/overwrite" in ini-file
 6.54   16/06/00 - fix: keyword 'insert' not recognize into ini-file
                 - fix: first char clearing all line for line insert mode
                 - fix: find with pattern from 16bit don't switch into 32bit
                 - fix: findInput: 0 truncate text line
                 - fix: don't show latest chars for text/hex findInput
                 - fix(6.29): lost hi-byte for address in assembler (16bit)
                 - PE import show at F7 into PE header view
                 - F7 moved at F10 into PE header view
                 - NE/LX flags ala Michael Hering
                 - PEDUMP 1.01
 6.55   20/06/00 - fix(6.54): crash on long function name for PE import
 6.60   24/12/00 - fix: crash in edit for newexe headers: if first symbol is
                    noncorrect
                 - fix: crash on PE-files with latest non-zeroed record in
                    import table
                 - fix: crash for increase of field 'entries modref' for NE
                 - fix: crash on backward multifiles search
                 - fix: stay online for 'open read' for multifiles search
                 - common return's stack for all modies
                 - table of word/dword jumps (Shift-F9)
                 - jump to word/dword under cursor
                    (Alt-F11,Alt-f12,Shift-F11,Shift-F12)
                 - crypt for block (Alt-F3)
                 - export show for newexecutable files (F8-F9)
                 - block save as hex/decode text (Shift-F4)
                 - delete file in filemanager (Del, of course :-)
                 - set base is turn off local offsets
                 - little-endian ELF support
                 - the infobar has only blocksize at marking process
                 - PE header: timestamp as text string
                 - EDump 1.00
 6.65   17/03/01 - fix: crash on novalid-NE into make export list
                 - fix: clear flag 'Replace All' for filArg replace
                 - remove Shift-F1 for text mode (infobar toggle)
                 - ESC for (R)etry/(A)bort as abort
                 - PE Delay Import support
                 - PE: add 'push imm32'/'mov exx imm32' for jumps
                 - common return's stack for jumps/backstack
                 - exchange keys BACK & CTRLBACK
                 - EDump 1.01
 6.70    2/06/01 - fix: error in processing PE delay import table
                 - SSE2 ( Pentium-4(R) ) dis/asm
                 - Crypt-32
                 - PE: automatic calculation of SizeOf...
                 - PE: named call from export table
                 - DEXEM 1.53
                 - EDUMP 1.11
 6.75   28/07/01 - fix: imul xx,imm
                 - fix: crash on double truncate of big file
                 - fix: long import/export names
                 - infobar = ON by default
                 - newexe's loading errors showed once
                 - self-loading NE support
                 - EDUMP 1.20
 6.76    8/09/01 - fix: PE with nonstandart directory size
                 - fix: crash on NE with bad relocations
                 - fix: keyboard layouts & GreyAlt
                 - fix: blank name export function
                 - EDUMP 1.21
 6.80    7/11/01 - code highlighting ("CodeHighlighting=" in ini-file)
                 - "fword" ("f,") instead of "pword" ("p,")
                 - xlat don't touch borders
                 - fix: crash on old verison of sav-file
                 - fix: crash on big delay import table
 6.81   30/12/01 - up/down arrows for jmp/call
                 - fix: LE DDB service table is close background windows
 6.82   23/03/02 - "FilelistRereadAlways=" in ini-file
                 - first '$' as hiewdir for "Savefile=" in ini-file
                 - fix: show number for call to internal export
                 - fix(LX/LE): wrong offset of iterated pages
                 - EDUMP 1.31
 6.83   31/10/02 - fix: PE: imports for different section dir/thunk
                 - fix: LX: entry table with 1-byte size
                 - fix: NE: fail reloc-refer, when target below call
                 - fix: notebook's PgUp PgDn
                 - fix: crash on highcoloring for name with '['
                 - "InfoMessage=" in ini-file
 6.85    4/07/03 - fix: savefile is different for 16/32-bit platforms 
                 - fix: NE newexe offset is zero in show header for some files
                 - fix: crash on delay import table invalid
                 - key ESC avalilable for block operations
                 - save frame/current offsets for cycle hex-code-text-hex
                 - Available local offset for edit asm
		 - (Win32) Undecorate import name
                 - (win2000,winXP) screen is resize if it's big (oh! at last!)
                 - EDUMP 1.36
 6.86   30/10/03 - fix: F11,F12 not work
                 - fix: decode FE /2../6 as invalid command
                 - fix: mov r32,segreg (was only r16)
                 - fix: smsw r32 (was only r16)
                 - PE: import table and import names can placed at various section
                 - PE: invalid target VA for jmp/call show as '----X'

  Eugeny Suslikov  <sen@kemtel.ru>  
