 |
 |
This page describes content of the BARfly
Silver and BARfly Gold builds. |
|
Editing in raw view is for advanced users only. Unlike the other views,
which give you a good idea of what fields you are editing in the node data, you
might feel somewhat "lost" in raw view. Raw view does not identify
any fields in the node data--it simply shows the node data content exactly as
it exists in memory.
The following table describes the keystroke map for raw view.
| Arrow Keys |
Move raw cursor. |
| Page Up |
Scroll raw data one page up. |
| Page Down |
Scroll raw data one page down. |
| Home |
Scroll to start of raw data (first page). |
| End |
Scroll to end of raw data (last page). |
| Tab |
Toggle between integer side (left) and character side (right). |
| Insert |
Unorganized blocks: Toggle insert mode.
All other nodes: Not used.
|
| Delete |
Unorganized blocks: Delete character.
All other nodes: Zeroize character. |
| Backspace |
Unorganized blocks: Delete previous character, moving
raw cursor back.
All other nodes: Zeroize character. |
| 0-9 |
Integer side: Number entry.
Character side: Character entry. |
| A-F |
Integer side: Number entry.
Character side: Character entry. |
| Other Keys
|
Integer side: Not used.
Character side: Character entry. |
Insert Mode
The Insert key toggles insert mode in raw view. Insert
mode is a state in which all number entry and character entry operations have
the effect of moving the data in front of the raw cursor forward automatically.
In fact, most word processing applications default to a state of insert
mode. In raw view, of course, you might want to edit data in-place
without bumping data forward like you would expect for text in many
applications. If insert mode is off, number entry and character entry
operations replace the current word, instead of moving data forward.
Insert mode is only allowed for unorganized blocks, which can be increased or
decreased in size with little difficulty. Insert mode defaults to on
for unorganized blocks.
Organized blocks and data structures must maintain the same size throughout
the editing process. Insert mode is forced to off for organized blocks
and data structures.
Deleting Words
The Backspace and Delete keys can be used to
delete or zeroize the word at or before the raw cursor. Whether deletion
or zeroization takes place depends on the type of node being edited.
Unorganized blocks allow for word deletion; structures and
organized blocks do not and instead perform zeroization.
Character entry in raw view
With the character side selected (inverted-color block on right side, underscore
on left side), you can edit a word simply by typing characters.
You can only enter printable characters this way. If you
want to enter unprintable characters, press Tab to switch to
the integer side.
Insert mode determines whether words are bumped forward when you type. If
insert mode is on, the words after the raw cursor move forward as you type in
characters. If insert mode is off, the raw cursor still moves forward,
but the words in front of the raw cursor stay put, causing overwrites to occur.
If the word size is 8-bit, each character you type updates a single word.
If the word size is 16-bit or greater, you must type more than one character to
complete the word. As you type, the integer side is updated
with each character entered.
Number entry in raw view
With the integer side selected (inverted-color block on left side, underscore on
right side), you can edit a word by typing digits associated with the word's
numerical base.
If the numerical base is hexadecimal (the default), you can
enter the numerals 0-9, as well as the letters A-F.
For decimal base, you can only enter the numerals 0-9.
For octal base, you are limited to 0-7, and
for binary base, only 0 and 1.
Insert mode determines whether words are bumped forward when you type. If
insert mode is on, the words after the raw cursor move forward as you type in
characters. If insert mode is off, the raw cursor still moves forward,
but the words in front of the raw cursor stay put, causing overwrites to occur.
The number of digits you must enter to complete the word depends on the
maximum number of digits needed for word characterization.
This depends on the base and word size specified in the raw view
settings. By default, you only need to enter two digits, to characterize
an 8-bit word size in hexadecimal base (number's range is 00 to FF). For
16-bit words in decimal base, you must enter five digits (number's range is
from 00000 to 65535). You will need to enter 64 digits if you have chosen
to edit a 64-bit word in binary base!
As you type digits, the character side is updated. Please realize that if
you were expecting a specific character result, it might not look exactly
like you had intended until you have typed every digit.
BARfly does the best it can to display a word as it currently exists, but it
can't read your mind!
Byte order (endian-ness)
When you edit in raw view, you must be aware of a very important issue in binary
file processing: byte order. Suppose you have a
four-byte hexadecimal integer: 0xABCDEF12. How does the integer
appear in raw view?
Well, it might appear as AB CD EF 12, or it might appear as
12 EF CD AB. This is because byte order of multi-byte words
is not universally standardized. If the most significant byte, or the
"big" end of the number, comes first in memory (which is the "AB"
side of the number), the number is called "big-endian."
If the least significant byte, or the "little" end of the number,
comes first in memory (which is the "12" side of the number), the number is
called "little-endian."
Many individuals design file formats, on many different machines, some of which
generate numbers in big-endian, and others which generate numbers in
little-endian. BARfly does not automatically know whether the word
represented in raw view is big-endian or little-endian. This
task is left to the user.
You can "flip" the interpreted byte order of the contents displayed in raw view
by changing the byte order setting in Options.Raw View.
If nothing about the multi-byte words you are looking at makes sense, sometimes
changing the byte order is all that you need to do.
Generally speaking, byte order is consistent within the contents of a single
file. It naturally follows that a designer of a particular
data format would want to use the native byte order of the machine used for
development. Therefore, if one word is little-endian or big-endian in the
file, the rest of the file nearly always has the same byte order.
Interpreting more complex types in raw view
Trying to interpret more complex types than just unsigned integers in raw view
is possible, but often not worth doing. BARfly does a much better job
with its schema-based handling of fields in subnode, dump, and text
views. However, if you want to figure out how bytes in raw view
physically match up to their easier-to-read equivalents in other views, the
following information might help.
Signed Integers
Unsigned integers are reported in raw view, but what about signed
integers? What do they "look like?"
In fact, not even signed integer implementation is standardized. But the
most common implementation, which is the preferred implementation in BAR, is
known as two's-complement. The name derives from the
ability to invert the sign of the integer by performing two easy "complement"
operations: a bitwise NOT, and an increase of the number by one (with any
carried digits beyond the size of the word thrown away).
If the highest bit of a two's-complement integer is zero, the
number is positive, and looks the same as an unsigned integer in raw
view. But if the highest bit is one, the number is
negative, and its absolute value can only be determined by performing a two's
complement on the word. The following table describes how this is done.
| Word Size (bits) |
Word Represented in Raw View |
Actual Value |
| 8 |
255 |
1 - 256 = -1 |
| 8 |
130 |
130 - 256 = -126 |
| 16 |
54321 |
54321 - 65536 = -11215
|
| 16 |
65000 |
65000 - 65536 = -536 |
| 32 |
3000000000 |
3000000000 - 4294967296 = -1294967296 |
| 32 |
4000000000
|
4000000000 - 4294967296 = -294967296
|
Floating-point Values
Floating-point type implementation is not universal, but the most common one,
which is the preferred implementation in BAR, is in the form of IEEE 754
floating-point format. The BAR "float" type
represents an IEEE 754 4-byte single-precision floating-point number,
and the "double" type represents an IEEE 754 8-byte
double-precision floating-point number.
These floating-point formats are well-documented, but it is not worth it most of
the time to interpret their values in raw view. This is because
floating-point numbers are implemented with a specific number of bits allotted
to a mantissa, a specific number of bits allotted to an exponent, and one bit
allotted to identify the sign of the number. As these fields are not even
aligned on byte boundaries, it is a far better choice to let BARfly interpret
the numbers for you in subnode or dump view.
There is one assumption, though, that you can often make: The number 0.0
is usually represented as all zeroes.
Click here for information about changing raw view
settings.
Click here for general information about raw view.
See also: [Editing data in the data
display view] [Editing - Subnode view]
[Editing - Dump view] [Editing
- Text view] [Editing - Raw view] [Copying
and pasting data]
|
