- Address slide.
- When displaying data, BE is showing a particular
definition at a given address.
This address is shown on the title.
Address sliding is a mechanism whereby this address may be advanced
forwards or backwards.
- Certain data items are required to exist at addresses which
are multiples of 2, 4 or other numbers.
This is often because certain processor architectures run slower
accessing mis-aligned data, or are unable to do so.
- Caching is the practice of keeping a local copy of (less easily
accessible) data, for speedier access.
For example, when BE uses a memory extension
as a means of editing some data not in a file, the memory extension
may cache some of the data in memory.
If the user does a full refresh (using the R key), this
cached data is discarded, so any data which is subsequently displayed
definitely comes from the actual data, rather than the cached copy.
Also, when the user uses BE to modify data, the data in the cache
may be updated, and the real data may not immediately be updated.
If the user flushes the data, any pending
changes (in the cache) are written back into to the real data.
- Current offset.
- As a definition is being defined, the
current offset indicates the byte offset within it that the next
field will be placed.
Typically in a C structure, each field immediately follows the previous
field (subject to alignment restrictions).
In a C union, all the fields can overlay each other, sharing the
BEs definitions are flexible enough to handle all these cases.
- Data display attributes.
- Each data field on display has some
data display attributes which govern the way in which the fields data
is fetched from memory (ie: the endianness),
and the way it is displayed.
- A definition is like a C structure or union definition.
It is made up of a number of fields.
A definition is defined via the
def keyword in the
- Disassembler extension.
- A BE disassembler extension is a peice of (possibly user written) code
which BE can call upon to disassemble raw bytes of data into
some instruction set.
Typically disassembler extensions exist as DLLs or shared libraries.
- Multibyte numeric values can be stored within the data with the
most or least significant byte first or last.
If the least significant byte is first, then the data is typically
referred to as little endian, or in the Intel byte order.
If the most significant byte is first, then the data is typically
referred to as big endian, or in the Motorola byte order.
- Typically refers to a numeric expression, such as
Wherever BE prompts for a number, any numeric expression may be
Basic arithmetic is supported, along with
symbol table lookup and support for
See the section on numbers
for more details.
- Extended Regular Expression.
- This is a powerful form of a search pattern, which allows for
searching for several alternatives at once, zero or one occurance
of a pattern, or one or more, or zero or more, and character classes.
- A number of fields together form a definition.
Fields in a definition can be made to overlay each other or not, thus
acheiving the effect of C structures or unions.
It is possible to tell BE to display the fields in a variety of ways,
via the use of data display attributes.
- BE may hold data in a memory cache for speed
of access, and may choose to 'make the changes good' in response to a
The @W key will try to flush any cached data.
The W key can be used to flush cached data from a single
BE prompts you as to whether you wish to flush any unsaved changes
- Initialisation file.
- When BE runs it locates and processes an initialisation file which
includes within it all the definitions of all the
structures within the data.
- Level of detail.
- When displaying a field, BE displays it to
a specific level of detail.
This level of detail may be adjusted using the + and -
Increasing the level of detail can result in the fields of
definitions being displayed, or
pointers being followed and the fields in the
'pointed-to' definitions being displayed, or elements of an array being
- Long jump.
- The ARM instruction set only includes a branch instruction which can
only jump a certain distance forwards or backwards in memory.
The ARM C compiler typically generates code which uses this branch
To branch long distances, a trick can be done whereby the normal
branch is made to branch to an instruction which loads the
instruction pointer from the word of memory immediately following.
This trick means that the mapping of addresses to function names using
the symbol table doesn't work properly.
By using the long jump
data display attribute, BE is told to take
this mechanism into account, when displaying code addresses symbolically.
nolj keywords are used for this
map keyword in the
initialisation file defines a mapping between
numbers and strings.
Essentially it is a way of mapping numbers back to more a readable
enumerated type form.
map MAPNAME "MAPLETSTRING" syntax may be used in any
expression in the
initialisation file or at any time BE prompts you
for a number, and it evaluates the the numeric equivelent of the
enumerated type named value.
Data displayed via mapping tables can be edited via the M key.
- Memory section.
- In any given invokation of BE a number of filename arguments
are specified, and each of these constitutes a memory section,
because the data from the file covers a section of the
BE can also edit data, where the data is provided to BE via
a memory extension, invoked with some parameters.
- Memory space.
- Every byte of data BE can edit is presented to BE at an address
in the BE memory space.
- Memory extension.
- A BE memory extension is a peice of (possibly user written) code
which provides access to the data on demand.
Typically memory extensions exist as DLLs or shared libraries.
- Named constant.
- BE keeps a small collection of named constants.
These can be created by use of the
-S name=val command
line argument, or through the
keywords in the initialisation file.
- Null pointer.
- Is a pointer whose numeric value indicates that the pointer doesn't
actually point to another data item at this time.
Typically the numeric value 0 is used to represent this.
BE has a data display attribute which indicates
whether the numeric value 0 represents a null pointer.
nonullptr are used.
When the user presses Enter on a pointer value, BE pops up
the data in the 'pointed to' definition,
unless the value is 0, and null-pointer attribute is present.
- Parent definition(s)
- Often definitions include other definitions.
Thus any given definition will have 0 or more parent definitions which
When displaying a definition @P will pop-up a list of all those
definitions which use the current definition on display.
- A pointer is typically a numeric value which somehow gives the
address of another definition in the data.
ptr DEFN is used in a
field definition to indicate that a numeric
field identifies the address of another definition.
- Pointer glue.
- When one PowerPC function calls another function via a function
pointer this function pointer is actually the address of a 12 byte
The caller loads the address of the glue block and calls a routine
This loads the TOC register from bytes 4 to 7 in the glue block and
branches to the code specified by bytes 0 to 3 in the glue block.
This mechanism is much like
__loadds in 16 bit Intel code,
in that it ensures the callee can access its own global data, even if
it is a seperate library or module.
- Power address slide.
- This is a form of address slide, whereby
BE can be made to automatically address slide until certain patterns
(which can be Extended Regular Expressions)
appear in the decoded data.
- Navigation of the data being edited starts by displaying a list of
some of the data, and bringing up other lists.
You effectively build up a stack of lists, and can step back to
an earlier list.
This stack of lists, or thread of investigation, is referred to as a
session, and BE maintains 10 independent sessions, which may be
switched between via @0, @1, ... @9.
- When displaying a definition, BE normally
displays all the fields.
However it is possible to display all the fields of a definition in
a single one line summary, by increasing the
level of detail of display.
In this case, only non-suppressed fields are displayed.
When viewing a structure definition with one
field to a line, suppressed fields are shown
in round brackets.
suppress keyword may be used in the
initialisation file on a field, or
the @S and @N keys may be used interactively.
- Symbol table
- Is typically provided from a file via the
command line argument.
It is a list of names (the symbols) and their values.
Typically these are code or data addresses for functions or
variable within an executable program.
BE can use this information so it can display addresses in
symbol+offset form, or so it can allow you to type
addr "symbol" in an expression and
have BE substitute the numeric value of the symbol.
- Validity check.
- Any field can have a validity check expression
associated with it, either using the
valid "EXPR" syntax
in the initialisation file, or by pressing the
V key whilst on the field.
Fields with validity checks have either
shown next to them, depending upon whether the check passes.
Fields failing their validity check are suppressed when viewing a
structure definition in single line summary form.
This feature can be used to effectively give conditional decode.
- Zero terminator.
- When strings are stored in memory or in files, often a 0 byte
is appended to indicate the end of the string.
BE can be told to stop displaying string data (or not) when it hits a
0 byte via the 'stop at zero terminator'
data display attribute, specified using the
nozterm keywords in the