convert bytes from readfile to hexadecimal

Index > Windows > convert bytes from readfile to hexadecimal

Author

Thread

patchariadog

Joined: 24 Mar 2013
Posts: 94

patchariadog 24 May 2014, 16:35

I am sorry to ask kind of a noob question, but I can't seem to figure this out.
I am reading a file and then was going to display the hex in a richtextbox. I read the file (8192 8kb buffer) and then I tried using wsprintf but it did not work.
here is the code i tried.

Code:

invoke ReadFile, [hFile],filebuffer,8192, BytesWritten, 0 
cinvoke wsprintfA,buffer1,"%X",[filebuffer]
invoke MessageBoxA,NULL,buffer1,title,MB_ICONINFORMATION+MB_OK

.data
filebuffer dd ?
buffer1 dd ?
BytesWritten dd ?
hFile dd ?

it sometimes gives me the first 4 bytes of the file in reverse order. sometimes it gives me 0

so can someone show me how to read the whole 8192 bytes of the file and convert the 8192 bytes into hex so I can display it on the richtextbox? Im not sure if I need to use a different api or what.

(its for a little hex editor)

thanks you!

24 May 2014, 16:35

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 24 May 2014, 20:24

You specified a DWORD which will contain 4 bytes. You want to use a BYTE instead.

First read the size of the file, and iterate through all the bytes one by one.

OR

NOTE: The largest data type is the best to use.

Code:

iterations = filesize / sizeof.DWORD; 
remaining= filesize MOD sizeof.DWORD; 

DWORD buffer;

for(i = 0; i < iterations; i++)
{
      read_File(hFile, buffer, sizeof.DWORD); // You just read 4 bytes here
      
      for(x = 0; i < sizeof.DWORD; x++)
        printf(".02X%", buffer[i]);
}

Then you check if there are any remaining bytes, if so, read those remaining bytes. In this case will be less than 4 (sizeof.DWORD)

24 May 2014, 20:24

patchariadog

Joined: 24 Mar 2013
Posts: 94

patchariadog 24 May 2014, 20:38

I still don't quiet understand. this looks like c++ code so it is hard to compile. also I know how to loop through the file, I just don't get why I can't read 8kb in a buffer and then convert that at once. I know if you do this for text files it works. I am just trying to figure out the fastest way to open a file and read it and display its hexadecimal.

thanks for all the help

24 May 2014, 20:38

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 24 May 2014, 21:27

This will print DWORDs because of the way you are pointing to your data.

Code:

cinvoke wsprintfA,buffer1,"%X",[filebuffer]

It seems like you want to convert the bytes all at once.

Here is an API to do that for you ALL AT ONCE. You'll have to do the memory allocations yourself.

http://msdn.microsoft.com/en-us/library/windows/desktop/aa379887(v=vs.85).aspx

Code:

format pe gui 4.0

include 'win32ax.inc'

entry  main

section '.data' data readable writeable


        bin_data      db 'hello world in hexadecimal'    ; binary data
        bin_data_len  = $ - bin_data
        BUF_LEN       = 1024
        pszHexBuffer  db BUF_LEN   dup(0)  ; will contain converted bytes in hex. Twice the size of the original buffer at least (Read documentation about the last _In_Out parameter)
        dwBuffLen     dd BUF_LEN

section '.code' code readable executable

main:

        push    dwBuffLen
        push    pszHexBuffer
        push    0x0000000b  ; CRYPT_STRING_HEXASCIIADDR
        push    bin_data_len
        push    bin_data
        call    [CryptBinaryToStringA]

        push    0
        push    0
        push    pszHexBuffer
        push    0
        call    [MessageBoxA]

        push    0
        call    [ExitProcess]

section '.idata' import data readable

library user32,'user32.dll',\
        kernel32,'kernel32.dll',\
        crypto, 'Crypt32.dll'

import crypto,\
       CryptBinaryToStringA,'CryptBinaryToStringA'

include 'api/user32.inc'
include 'api/kernel32.inc'

24 May 2014, 21:27

patchariadog

Joined: 24 Mar 2013
Posts: 94

patchariadog 25 May 2014, 02:28

Hi typedef

thank you so much that is exactly what I was looking for
I had no clue about that api

I was wondering if there is a way to separate the data after I get all the data in the one string
so I could have memory address string, hex string and ascii string

basically I am trying to ask if there is a substring function for assembly/
if this were c++ I would usually do something like this

Code:

;str contains the data

std::string address = str.substr (0,4);
std::string hex = str.substr (8,32);
std::string ascii = str.substr (42,16);

;print it however

;then I would just loop through using a counter

I have yet to figure out how to substring in assembly

thanks

25 May 2014, 02:28

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum