ÚÄÄ-úú : ³ þ GetEQExe 3.49 þ ³ : úúÄÄÄú ú ÚÄÄ-úú ³ þ What is GetEQExe? ³ GetEQExe is a program to compare the startup code of COM files, DOS ³ executables or Windows PE executables or normal files. ³ ³ You can use GetEQExe for ³ comparing up to 10 EXE startup codes, ³ comparing up to 10 normal files, ³ ripping code out of a file ³ ³ GetEQExe does not care if the files is readonly or not. ³ ³ Homepage: http://surf.to/phax ³ eMail: phax@writeme.com ³ ³ Please mail any suggestions for improvement to me. : ÚÄÄ-úú ³ þ The switches: ³ ³ ð Available options: ³ /BIN create binary output -> to rip startup code ³ /BIT compare bits instead of bytes ³ /DIFF print only not identical bytes ³ /ENDn goto n bytes before the end of the file ³ /EXT extended output (maybe interesting) ³ /FILL also print equal bytes in /DIFF mode ³ /GOTOn start comparing at filepos n (default = CS:IP [EXE]; 0 [else]) ³ /HELP activate the help system ³ /MACROxyz execute the macro "xyz" ³ /MAGICn set the magic number for the Pascal output file (default = 0) ³ /MAXn set the maximum filesize (default = infinite) ³ /MINn set the minimum filesize (default = 0) ³ /NOCFG do not use the configuration file ³ /NODIS do not "disassemble" ³ /NOPAS do not create a Pascal include files ³ /NOCON do not write anything to STDOUT ³ /NONE do not compare new executables (NE/PE) ³ /OVER overwrite the Pascal file without asking ³ /NAMEfile set the Pascal filename "file" (default = "_outexe.inc") ³ /PASLENn set the maximum number of bytes in the Pascal file (default = 80) ³ /STOPBn stop comparing after n bytes (default = infinite) ³ /STOPMn stop comparing after n matches (default = infinite) ³ ³ GetEQExe also supports a configuration file called "GETEQEXE.CFG". ³ There you can put the following switches: ³ /BIN ³ /BIT ³ /MAXn ³ /MINn ³ /NODIS * only if you have a registered version ³ /NOHEAD ³ /NOPAS ³ /NOCON ³ /OVER ³ /NAMEfile ³ /EXT * only if you have an extended output version ³ Every switch has to be in an extra line. ³ ³ ð Available methods: ³ /ADDIPn add IP to old one (subtract if n < 0; relative) ³ /SETIPn Change IP to n (absolute) ³ ³ ð Available macro commands (case sensitive): ³ c do a long call at the current position (only EXE files) ³ f do a far jump at the current position ³ j do a jump/call at the current position ³ k do a 32 bit jump/call at the current position ³ m do a MOV jump at the current position ³ o goto overlay position of DOS EXE ³ _ seperator for macro commands ³ Between every command may be numbers which tell the number of bytes to ³ skip. See examples for details. See JMP/CALL sections for details. ³ ³ ð The following switch combinations are invalid: ³ /ADDIP and /SETIP -> either set IP or add something to IP ³ /ADDIP and /END -> either add something to IP or relative goto ³ /ADDIP and /GOTO -> either add something to IP or absolute goto ³ /GOTO and /SETIP -> either set IP or absolute goto ³ /GOTO and /END -> either absolute goto or relative goto from end ³ /END and /SETIP -> either set IP or relative goto ³ /BIN and /BIT -> no binary output and bit compare ³ /BIN and /EXT -> no binary output and extended output ³ /BIN and /DIFF -> no binary output if scan for differences ³ /NOCON and /NOPAS -> that would mean no output anyway ³ /NOPAS and /PASLEN -> cannot set pascal len if no pascal file is made ³ ³ ð The following switches are required when the first one is used: ³ /DIFF -> /NOPAS -> if /DIFF is used /NOPAS is automatically set ³ /BIN -> /NODIS -> if /BIN is used /NODIS is automatically set ³ /BIT -> /NOPAS -> if /BIT is used /NOPAS is automatically set ³ ³ /DIFF- -> /FILL- -> if /DIFF is not used /FILL is disabled : ÚÄÄ-úú ³ þ Some examples ³ GETEQEXE a.exe b.exe c.exe d.exe ³ compare the startupcode (at CS:IP) of a.exe, b.exe, c.exe and d.exe ³ ³ GETEQEXE a.exe b.exe c.exe d.exe /MACROj ³ goto CS:IP, evaluate one jump, then compare ³ ³ GETEQEXE a.exe b.exe c.exe d.exe /MACRO10j ³ goto CS:IP, skip 10 bytes, evaluate one jump, then compare ³ ³ GETEQEXE ?.exe /MACRO10 ³ compare all files that match the filemask ?.exe, ³ goto CS:IP, skip 10 bytes, then compare ³ ³ GETEQEXE a b c d /MACRO10 ³ the same as above. ".EXE" is the default extension ³ ³ GETEQEXE /MACRO5jj a b c d ³ goto CS:IP, skip 5 bytes, evaluate 2 jumps, then compare ³ ³ GETEQEXE /MACRO5j10j a b c d ³ goto CS:IP, execute macro "5j10j", then compare ³ macro: skip 5 bytes, evaluate jump, skip 10 bytes, evaluate jump ³ ³ GETEQEXE /GOTO128 /MACRO1m6j a.com b.com c.com d.com ³ goto position 128, execute macro "1m6j", then compare ³ macro: skip 1 byte, evaluate a MOV jump, skip 6 bytes, evaluate jump ³ ³ GETEQEXE /NOCOM /ADDIP5 /MACRO7j15j a b c d ³ will cause an error because it is not allowed to use /ADDIP and ³ /MACRO at the same time because if you use a macro you can include ³ the /ADDIP command in the macro: /MACRO12j15j : ³ þ Ripping code out of a file: ³ GETEQEXE file_to.rip /GOTO512 /STOPB75 /BIN /NOPAS > result.bin ³ rip 75 bytes from file_to.rip at position 512 (starting at 1!) ³ create binary output and write it to result.bin : ÚÄÄ-úú ³ þ JMP/CALL/... section ÃÄÄ-úú ³ The JMP/near call command: ³ JMP 1980h ³ or ³ CALL 1980h ³ ³ Valid jumps and calls are: ³ $74 JE - jump if equal ³ $74 JNE - jump if not equal ³ $E3 JCXZ - short jump if CX is zero ³ $E8 CALL - unconditional call ³ $E9 JMP - unconditional jump ³ $EB JMPS - unconditional short jump ÃÄÄ-úú ³ The MOV; JMP commands: ³ MOV BP, 1980h ³ JMP BP ³ ³ Valid registers (here: BP) are: ³ $B8 - AX ³ $B9 - CX ³ $BA - DX ³ $BB - BX ³ $BC - SP ³ $BD - BP ³ $BE - SI ³ $BF - DI ³ ³ Note: GETEQEXE does not validate the JMP command. It just takes the ³ value and jumps there. ÃÄÄ-úú ³ The long CALL command: ³ CALL 4027h:5622h ³ ³ Supported CALL commands: ³ $9A - CALL ÃÄÄ-úú ³ The JMP FAR command: ³ explanation 2 come :( : ÚÄÄ-úú ³ þ Some history of GetEQExe: ³ ³ 3.49 - fixed bug in /BIN command if /OUT is used ³ some minor enhancements which were done while developing GT ³ excluded 0 byte files ³ 3.48 - fixed internal type problem with Win32 version ³ 3.47 - added switch /BIT (bit compare support) ³ improved documentation ³ 3.46 - fixed problem with help system in Win32 variant ³ 3.45 - tried to add support for UNC pathes ³ fixed problem with path handling of Win32 version ³ 3.44 - added support for NE self loading modules ³ 3.43 - fixed severe bug with PE and NE executables :( ³ 3.42 - first Windows version finished! ³ 3.41 - enhanced output format for /DIFF so that equal bytes are marked ³ when using /FILL ³ 3.40 - added support for LE EXEs ³ 3.30 - changed internally to new output method ³ 3.29 - added switch /OVLAY ³ 3.28 - added switch /FILL ³ 3.27 - improved help system (removed "methods" section) ³ added possibility to write syntax to file ³ 3.26 - added switches /MIN and /MAX to set filesize limitations ³ 3.25 - if E9h was found and macro "k" was used "r" is suggested ³ fixed small string bug ³ 3.24 - fixed memory bug when comparing PE EXEs which can cause crashes ³ fixed very stupid bug which disabled the correct handling of macros ³ which was in since 3.21 or so ³ fixed range check error with negative jumps ³ 3.23 - fixed bug if switch /NOPAS was used ³ fixed strange output bug - TPs write function does not work ????? ³ 3.22 - fixed bug with error that printed bytes. the wrong pos was used ³ added "jne" $75 to the valid "j" macro jumps ³ 3.21 - split up source code into several units (better readable) ³ fixed strange runtime error ³ 3.20 - fixed problem with new executables where the relocation offset ³ in the header was between 24 and 64 ³ fixed problem that /STOPBn always read one byte too much ³ added $74 (JE) to the valid short jumps for macro "j" ³ fixed bug in long called handling - offset was missing ³ now every file has its own PE object table handler ;) ³ removed /AAUTO switch - was not tested and made code too difficult ³ some internal code restructures ³ optimized disassembler module for size (saved ~1800 bytes) ³ fixed stupid crach when not comparing PE EXEs ³ 3.14 - added switch /NONE to disable scanning for NE/PE executables ³ 3.13 - fixed problem with ET_COM/ET_NONE type -> now it's all ET_COM ³ added possibility to disable switches with the "-" char at the ³ end (e.g. "/nodis-"). used to overwrite switches in the cfg file ³ 3.12 - now start counting at 0 ³ 3.11 - fixed stupid bug with PE EXE detection ³ fixed stupid bug with COM/non EXE files ³ 3.10 - no abort if it is a new executable or a linaer executable ³ fixed bug with huge offsets of PE executables (word -> longint) ³ added explicit detection of new and linear executables ³ removed /ADDCS and /SETCS ³ /ADDIP and /SETIP are only valid for COMs and DOS EXEs ³ now can compare new executables startup code ³ Pascal file is deleted if no equal bytes are inside ³ 3.04 - added output to switch /MAGICn ³ 3.03 - added switch /STOPEn ³ if no more space is on the drive for the Pascal file, it will ³ automatically be canceled ³ 3.02 - fixed problem with FindFirst - adding path manually ³ fixed stupid bug if called without parameters ³ 3.01 - added message if output is redirected and /NOCON is used ³ added output of two message if switches are automatically set ³ removed that no pascal file is created if only one file was found ³ if no file matches the given masks, anothe message appears ³ 3.00 - no Pascal file is created if /V is used ³ no Pascal file is created if only one file is in use ³ new FindFirst/Next/Close support for Delphi ³ added headline for help system ³ fixed big bug in C/ACS and I/AIP handling ³ changed to long name commands ³ code clearings ³ more general command line handling ³ now aborting if new Pascal filename is invalid ³ fixed problem in commandline handling with long names and values ³ removed all single command modifier (/A*) - should use macros ³ updated documentation ³ error if /NODIS and /BIN used at the same time ³ 2.94 - fixed small problem with output of equal bytes on abort ³ removed switch /F - now automatic detection ³ 2.93 - added switch /A32J and according macro "k" ³ added output of PE Entrypoint RVA ³ 2.92 - changed from Get/SetFAttr to FileMode setting ³ splitted switch /S into /SB and /SM ³ 2.91 - fixed range check error with CS:IP output ³ 2.90 - fixed problem if no files were opened ³ added output of equal bytes found ³ 2.89 - fixed problem if value of /E was too high ³ made it compile with Free Pascal ³ 2.88 - added switch /E - comparing at the end of the file ³ added extending of path from switch /Fpath ³ 2.87 - now I have asm code for every byte (except F1h) ³ added switch /ND - no disassembler ³ 2.86 - added a little assembler output (maybe helpful??) ³ fixed problems with offset of new executable ³ 2.85 - added error code on jmp/call otu of file border ³ added some information to the output ³ improved configuration file handling ³ 2.84 - made better output and smaller code ³ disallowed comparison of COM and EXE files ³ 2.83 - generalized the MOV jumps ($B8 - $BF) ³ advanced documentation ³ added output of the bytes at the position of a wrong jump ³ 2.82 - added switch /B for binary output ³ added $E3 to the valid jumps (JCXZ) ³ fixed bug with the switches AIP/I and ACS/C ³ 2.81 - removed switch /Y ³ allowed usage of /I within PE files ³ 2.80 - hope I fixed type problem with E8 and E9 jumps ³ made better code in PE entrypoint detection ³ 2.79 - fixed problem with automatic filename extension if a directory ³ with the same name exists ³ 2.78 - if first identical byte is a jump -> print comment ³ if nothing was found, Pascal file will be deleted ³ Changed error message if file was not found ³ 2.77 - removed switch /ACOM - now automatic detection ³ added error messages if file is NE, LE or LX otherwise continue ³ 2.76 - added $BE as valid move jump ³ added check if it is really a PE or not ³ 2.75 - disabled many switches in the configuration file ³ 2.74 - fixed bug in calculation of PE entry point ³ now using the values in the object table ³ added possibility to capture startup code of a single file ³ added switch /NH ³ 2.73 - added automatic support for portable executables !! ³ added switch /Y to move entrypoint of PE's ³ released to the EXE mailinglist ³ 2.72 - fixed bug that only allowed to use /F :( ³ code clearings - smaller code ³ advanced output of /X ³ now an error occurs if file has no overlays and switch /AOVR is set ³ 2.71 - fixed bug in loop handling ³ added output of config file switches ³ added support for filemasks (/F) ³ 2.70 - removed bug in output ³ 2.69 - added configuration file support ³ optimized code a little bit ³ first public release ³ 2.68 - now attributes are restored on error ³ now using string constants -> saved ~1 KB ³ made complex but small parameter handling ³ 2.67 - added check for redirection ³ added documentation ³ added additional commandline parameter check (NP, NS) ³ added error if Pascal file exists ³ added switch /O ³ removed with /AIP and /I ³ 2.66 - added faster print method : ³ prior version were not documented because I never though that I'll ³ ever release this piece of difficulty ... : ÚÄÄ-úú ³ þ GetEQExe is Copyright (c) 1997 - 2000 by PHaX (phax@writeme.com) : --- EOF ---