Font related problem in internal viewer

[kra]

Hi,

first of all, I dont think its directly problem of TC but some of you may know the solution hence Im asking.

I use "Lister" (F3) part of TC to view content of PE files. Problem that has just arisen recently is that Lister displays zero byte characters differently on different systems. For a long time Lister displayed 00 byte as a black square on XP-like systems and as a space on Win7-like systems. Something has changed recently and on my PC (Win7) it started displaying 00 bytes as dots. To understand it clearly see pics:

XP: imageshack. us/a/img405/4725/q8gw.jpg
Win7 x64 (my VMWare): imageshack. us/a/img854/2390/jd9o.jpg
Win7 x64 (my working station): imageshack. us/a/img850/7682/khqc.jpg

Im not particularly bothered about XP like OS but Im bothered about the dots - I need spaces (it sounds funny but I have to review dozens of big PE files and for an eye the space character is much easier to read than a dot).

I checked the Lister settings on both Win7 systems that differs but they were same. I also checked the font file used (Fixedsys Regular - vgafix.fon) and they are also same. There is same encoding, same font so I have no idea whats happening here.

Can anyone bring any light into this?

Thanks a lot.

Kra

PS: TC version is 7.55a
PSS: Cant use URLs due to the forum restrictions so I put space between "imageshack." and "us", you need to fix it, apologies for that

[sidefx88]

1) Get a Font editor and replace the DOT character you don't like by an empty space.
2) Assign your edited font on Lister.
3) Problem solved!

[ZoSTeR]

Not to impose but comparing PEs with the Lister just doesn't sound right

Are you looking for a particular string or at an offset? Maybe there's a more effective way...

Updating to TC 8.01 wouldn't hurt either.

[damjang]

I also checked the font file used (Fixedsys Regular - vgafix.fon) and they are also same. There is same encoding, same font so I have no idea whats happening here.

Are you really sure that the 3 fonts from the 3 systems are bit-to-bit identical?

[ghisler(Author)]

Even if the font files are identical, Windows may choose different fonts as "font substitution" depending on the current language (locale settings) and other Windows settings.

[kra]

1) Get a Font editor and replace the DOT character you..

Im afraid there is no "dot character" I can replace. I tried few font editors and there was never a "." on a 0x00 position. Moreover I seem to be unable to install any new font (when I create a new font, I install it just fine but it is never on the font list in notepad/lister etc - even when I have "Hide fonts based on language settings" disabled in Control Panels > Fonts).

Not to impose but comparing..

I didnt write anything about comparison. A notepad-like view is exactly what I need. Upgrading to TC 8.01 didnt help.

Are you really sure that the 3 fonts..

Well, Im not sure if "Fixedsys" font is stored only in one file but when I open Control Panels > Fonts, find Fixedsys and choose "Properties" .. yes, that file is binary identical.

..depending on the current language (locale settings)....

A good hint however I synchronized locale/language in both Win7 systems and problem persists :/

Ive also tried restoring default font settings in Windows but that didnt work either.

I found 2 or 3 similar threads here but they were never solved. So unless any of you have any other ideas I will have to stick to a different font (although the choice is limited since more fonts, eg "Courier" displays dots as well)

[damjang]

I have tested on my TC: I have a winXp on VM and a win7x64. TC is 8.01 x32. The fonts are bit identical. On winXP I see black rectangles but only if selected Encoding->As configured in current font, all the other encoding show a dot. In w7 is always space in all encodings.

[ZoSTeR]

Maybe "Strings" can make your task easier.
Usage in cmd eg:

Code: Select all

 strings.exe somePE.exe > strings_in_somePE.txt 

[kra]

Maybe Strings can make your task easier.

I appreciate your help but Im a malware analyst. I use lister to tell whether file is "bad" or "good". Strings are only partially interesting. Its more about "density" of data that Im interested in. And thus new Font is a big issue .. because Im used to "thickness" of a specified font connected to data density and new Font means all those characters are different in terms of thickness. Im not sure if you understand but anyway, "Strings" is not a solution for me.