IDA search and replace all occurrences - ida

i am sure this is simple, but...
I want to replace all occurrences of command
push 801h
to
push 802h
how can i do that with Ida6 ?!

Probably the easiest way is by replacing all occurrences of the bytes that represent push 801h with the bytes that represent push 802h in the file, using a hex editor such as Hex-Workshop or 010 Editor.

Related

How to take substring

I have a list, and I need to take only first words including numbers of every row without anything after numbers. How can I achieve that?
A pic is provided
For example:
I have a row like this:
ЛУ 344 ул.Яссауй в районе дома №163 северном направление
As a result I want to get:
ЛУ 344
Left, right won't help because the number of characters can change.
You can use a regex based substring() variant:
substring(the_column from '\w+\s+[0-9]+')
This will extract the first "word characters" followed by one or more spaces followed by one or more numbers
Online example
Maybe split_part() will help.
Or the string_to_array()
Or the substring()
Depends on the use you want and the way you want to get the substring.

How to remove <96> from a .txt file

I receive a .txt file with a lot of <96> which should be space instead.
In vi, I have done:
:%s/<96>//g
or
:%s/\<96>\//g
but it is still there. I did dos2unix, but it still doesn't remove it. Is it Unicode? If yes, how can I remove it? Thank you!
There's a good chance those aren't the four literal characters <, 9, 6 and >. Instead, they're probably the single character formed by the byte 0x96, which Vim renders as <96>.
You can see that by executing (from bash):
printf '123\x96abc\x96def' > file.txt ; vi file.txt
and you should see:
123<96>abc<96>def
To get rid of them, you can just use sed with something like (assuming your sed has in-place replacement):
sed -i.save 's/\x96//g' file.txt
You can also do this within vim itself, you just have to realise that you can enter arbitrary characters with CTRL-V (or CTRL-Q if CTRL-V is set up for paste). See here for details, paraphrased and shortened here to ensure answer is self-contained:
It is possible to enter any character which can be displayed in your current encoding, if you know the character value, as follows (^V means CTRL-V, or CTRL-Q if you use CTRL-V to paste):
Decimal: ^Vnnn, 000..255.
Octal: ^Vonnn, 000..377.
Hex: ^Vxnn, 00..ff.
Hex, BMP Unicode: ^Vunnnn, 0000..FFFF.
Hex, any Unicode: ^VUnnnnnnnn, 00000000..7FFFFFFF.
In all cases, initial zeros may be omitted if the next character typed is not a digit in the given base (except, of course, that the value zero must be entered as at least one zero).
Hex digits A-F, when used, can be typed in upper or lower case, or even in any mixture of them.
The key sequence you therefore want (assuming you want them replaced with spaces) is:
:%s/<CTRL-V>x96/ /g

How do I remove the first or last n characters from a value in q/ kdbstudio?

I've looked into the underscore for drop/cut, but this only seems to remove the first or last n entries, not characters. Any ideas?
Depends on what you're using drop cut on.
Can you provide an example of your values?
Below shows how cut can be used on a sting and then a list of strings.
It uses each right to drop a value from each item.
http://code.kx.com/q/ref/adverbs/#each-right
q)1_"12456789"
"2456789"
q)
q)1_("12456789";"12456789")
"12456789"
q)
q)1_/:("12456789";"12456789")
"2456789"
"2456789"
#Connor Gervin had almost what I wanted, but if you want to cast back to a string, you can use `$(-3)_'string sym from tab

Unicode converted text isn't shown properly in MS-Word

In a mapping editor, the display is correct after the legacy to unicode conversion for DEVANAGARI text shown using a unicode font (Arial Unicode MS). However, in MS-WORD, the display isn't as expected for the same unicode text in the unicode font (Arial Unicode MS) or any other Devanagari unicode fonts. The expected sequence of unicodes are provided as per the documentation. The sequence can be seen on the left-hand side table.
Please let me know where I am going wrong.
Thanks for your help!
Does your map have to insert the zero_width_joiner? The halant (virama) by itself is enough to get the half-consonant (for some combinations) and in particular, it may be that Word is using the presence of the ZWJ to keep them separate.
If getting rid of the ZWJ doesn't help, another possibility is that Word may be treating the individual characters of the text string as individual "runs" of text.
If those first 4 characters are not in a single run, this can happen.
[aside: the way to tell if it's being treated as a single run, is to save the document as an xml file and then open it with something like notepad++ and look at the xml "w:t" element (IIRC) associated with these characters. If they're all in separate w:t elements, it means they're in separate runs. In that case, you might need to copy the text from Word to some other tool (e.g. Notepad++) and then copy it from there and paste it back in Word -- that might cause it to be imported into Word in a single run.

pySerial and reading binary data

When the device I am communicating with sends binary data, I can recover most of it. However, there always seem to be some bytes missing, replaced by non-standard characters. For instance, one individual output looks like this:
\xc4\xa5\x06\x00.\xb3\x01\x01\x02\x00\x00\x00=\xa9
The period and equals sign should be traditional bytes in hexadecimal format (I confirmed this in another application). Other times I get other weird characters such as ')' or 's'. These characters usually occur in the exact same spot (which varies with the command I passed to the device).
How can I fix this problem?
Are you displaying the output using something like this?:
print output
If some of your bytes happen to correspond with printable characters, they'll show up as characters. Try this:
print output.encode('hex')
to see hex values for all your bytes.
At first I liked #RichieHindle answer, but when I tried it the hex bytes were all bunched together.
To get a friendlier output, I use
print ' '.join(map(lambda x:x.encode('hex'),output))