[WLX] fileinfo 2.23 x32/x64 (May 2017)

[LonerD]

it's not the plugin that moves your cursor but the system.

Plugin has some hidden buttons or interface elements with 'default' option, such as 'default pushbutton' or something else

[Dalai]

it's not the plugin that moves your cursor but the system.

Plugin has some hidden buttons or interface elements with 'default' option, such as 'default pushbutton' or something else

That doesn't contradict anything, does it? I agree that there's some invisible default element in the plugin's GUI, but it's still the system moving the cursor. The plugin is the trigger, but this system setting is "the cause", if you will.

Regards
Dalai

[VSB]

Hi all!

I have a small patch, that updates function names undecoration to that, which used in internals of MS CRT 140 (VC++ 2015) as __unDName.
It requires 2 addition DLL's (one for 32 bit one for 64) and small edit in plugin wlx (change import from imagehlp.dll to my own DLL)

Also I'll try to add support for GCC mangling by 2 more DLL compiled with MinGW via abi::__cxa_denamgle.

I'm planning to finish this work at next week, when VS 2015 RTM will be available.

[TomTomturnaround]

Hello there,

I've been looking for a tool to extract (unicode-)text-info, like version numbers and so on, from binary files.

Since I am a heavy TC-user I started looking in the TC-neighbourhood first and soon came across the fileinfo plugin, which seemed to even exceed my needs.

So I downloaded it and first tried to install the DL-64bit version as I am using Win7_64_ultimate as OS.

The install process went fine, no error message, and everything seemed ok. I checked the plugin-options and found it to be there and also checked the ListerPlugin_entry in wincmd.ini, it was there, too.

And yet, somehow I seem to be too stupid to use this plugin. I tried for half an hour but no way brought up any new kind of information. Using F3 on all kinds of files (exe, dll, apk, Manifest-xml and so on) brought up the old and trusted view of the TC internal viewer with initial option "binary". No additional tabs or menu-entries visible as the window header said "Lister" without the additional entry "fileinfo".

I tried to look in the TC-main menu, especially in the "show"-section, for any new entry to invoke the fileinfo-display. No success. And, oh yes, another hot candidate, the right-mouse-button context_menu on a filename in TC only showed the usual "View (Lister)"-entry upon which the normal, trusted internal viewer of TC opened and showed the usual binary view.

Can anyone here give me a hint on how to switch between the normal binary viewer internal to TC and the view of the fileinfo-plugin? Perhaps I will be ashamed afterwards, because it would have been so easy - but for the moment I seem to be out of options.

TomTom

[petermad]

2TomTomturnaround
Try this:

Press F3 to open Lister, then press 4 one or more times to cycle through the plugins that supports the chosen filetype.

You can also try my Extended menu for TC (see signature) - it has a "Lister" menu item, where you can force the use of several popular plugins, herunder the FileInfo plugin.

[Dalai]

2TomTomturnaround
You can cycle through the Lister plugins using the 4 key (or the corresponding menu item) when the Lister window is open.

AFAIK FileInfo only loads binary files that are executables in PE, MZ, NE etc. format (which are EXE, DLL, SYS, MUI and so on), but not any binary files. So, if you are looking for a way to extract any readable text from any binary file, you should take a look at the Sysinternals Strings utility or Process Explorer which has a similar feature.

Regards
Dalai

[Hurdet]

Do it have a x64 version of unupx.dll plugin?

[TomTomturnaround]

Thanks a lot, guys, the "4"-key finally did the trick!

Only question is - how is anyone supposed to know? AFAIK there is no mention of this in the usage-instructions.

@Dalai Thanks also for the hints about alternatives. You've got it right. FileInfo seemingly does not work on Android-apk-files or the "Manifest.xml" files therein, which happen to contain the relevant version numbers.

In particular interesting is the hint on SysInternalSuite, which I happen to have installed. I wasn't aware of that feature in "strings"-utility although it doesn't actually help either because the description says, it will extract unicode strings of length 3 and greater - and therefore won't show the crucial number after "version" either. And what about ProcessExplorer? To my knowledge it only works for actively running processes and doesn't display anything within archives or .xml-files?

The only solution so far seems to use the standard-viewer, actively switch to unicode-view and then search for "vers(ion)".

@Hurdet what do you mean by "unupx.dll"? I seemingly do not have one in my "Windows"-directory-tree nor could I find it in my TC/plugins-dir-tree.

Should it be there? Which program/package brings it with it? And how would I know it's an x64-version? In which dir is it supposed to be installed?

TomTom

[petermad]

2Hurdet

Do it have a x64 version of unupx.dll plugin?

No - only unaspack.dll64

[milo1012]

FileInfo seemingly does not work on Android-apk-files or the "Manifest.xml" files therein, which happen to contain the relevant version numbers.

Are you talking about the standard "versionCode" and "versionName" entries?
You can use my APK-wdx plug-in for this exact purpose, plus a lot more information.

And BTW, there is no way that the Strings utility or fileinfo would work even in theory,
as APK files are merely renamed Zip files and therefore won't contain any readable strings in a raw/binary view.

[Dalai]

In particular interesting is the hint on SysInternalSuite, which I happen to have installed. I wasn't aware of that feature in "strings"-utility although it doesn't actually help either because the description says, it will extract unicode strings of length 3 and greater - and therefore won't show the crucial number after "version" either.

You can specify the minimum length of readable characters as a parameter (-n IIRC).

And what about ProcessExplorer? To my knowledge it only works for actively running processes and doesn't display anything within archives or .xml-files?

My bad. You can view the strings of running processes, in memory and the image on disk, but that only works for Windows executables (EXE, DLL etc), too.

Oh, btw: you can change the order of the Lister plugins in TC's settings, so that you don't have to cycle through them (that often) with the 4 key.

Regards
Dalai

[TomTomturnaround]

Are you talking about the standard "versionCode" and "versionName" entries?
You can use my APK-wdx plug-in for this exact purpose, plus a lot more information.

Long live the TC-forum! It once again has proven to be a reliable source of competent help.

I was completely unaware of this fine add-on and it does exactly what I've been looking for in the current situation. Although I do not plan to interfere with the standard ability of TC to "walk into" a zip/apk-file like into a directory.

So I chose to install the wlx64-version as a lister plugin and now that I know that "4" is the "magic-spell"-key here, it all works like a charm. In particular I also appreciate the ability to pre-view the icons contained in an apk.

Many thanks for taking the effort to produce this tool, as I see it also as a valid contribution to increased Android security. Because looking into an apk of questionable origin before installation might give you valid clues if this version may possibly have been tampered with, as "foreign" or missing icons or a lack of typical strings (as compared to a prior version) would be indicative of possible malware disguised as a "Trojan horse".

Thanks again for all the competent help
TomTom

[gora]

Plugin causes crash TC!

Сигнатура проблемы:
Имя события проблемы: APPCRASH
Имя приложения: TOTALCMD64.EXE
Версия приложения: 8.5.2.1
Отметка времени приложения: 00000000
Имя модуля с ошибкой: fileinfo.wlx64
Версия модуля с ошибкой: 2.2.2.0
Отметка времени модуля с ошибкой: 5598549e
Код исключения: c0000005
Смещение исключения: 00000000000254df
Версия ОС: 6.1.7601.2.1.0.256.1
Код языка: 1049
Дополнительные сведения 1: 8c80
Дополнительные сведения 2: 8c805b3dd562fe01a7f69ed28c5b8369
Дополнительные сведения 3: 61c4
Дополнительные сведения 4: 61c43cc6c9519fd22c9ab623412198ee

1 Select the file unaspack.dll64
2 Press F3
3 Select the tab "Image File Header"
4 Crash

[Hurdet]

Often crash when in "Image file header" of x64 dll or exe files.
F.e.: UNRAR64.DLL

[Horst.Epp]

Plugin causes crash TC!

Сигнатура проблемы:
Имя события проблемы: APPCRASH
Имя приложения: TOTALCMD64.EXE
Версия приложения: 8.5.2.1
Отметка времени приложения: 00000000
Имя модуля с ошибкой: fileinfo.wlx64
Версия модуля с ошибкой: 2.2.2.0
Отметка времени модуля с ошибкой: 5598549e
Код исключения: c0000005
Смещение исключения: 00000000000254df
Версия ОС: 6.1.7601.2.1.0.256.1
Код языка: 1049
Дополнительные сведения 1: 8c80
Дополнительные сведения 2: 8c805b3dd562fe01a7f69ed28c5b8369
Дополнительные сведения 3: 61c4
Дополнительные сведения 4: 61c43cc6c9519fd22c9ab623412198ee

1 Select the file unaspack.dll64
2 Press F3
3 Select the tab "Image File Header"
4 Crash

Not confirmed, doesn't crash here
TC 8.52a x64 under Windows 10 (TH2)
Fileinfo 2.2.2.0 July 2015