                               -         :
                                 GetEQExe  
                               :         

-
  What is GetEQExe?
   GetEQExe is a program to compare the startup code of COM files, DOS
   executables or Windows PE executables. It was written while I developed
   GetTyp, a file identification program.

   GetEQExe scans 1 - 10 files and compares their startup code. The output
   goes to STDOUT and to a Pascal file which contains the appropriate
   byte field in Pascal hex ($..). Bytes that are not equal are replaced
   with the value $00 (zero).

   GetEQExe does not care if the files is readonly or not.

   GetEQExe also supports a configuration file called "GETEQEXE.CFG".
   There you can put the following switches:
     /B
     /Fpath
     /NH
     /NP
     /NS
     /O
     /Pfile
     /X
   Every switch has to be in an extra line.

   Please mail any suggestions for improvement to phax@writeme.com
:

-
  The switches:

  Available options:
   /B           create binary output -> to rip startup code
   /Fpath       give a filemask to search for
   /H           activate the help system
   /Mn          set the magic number for the Pascal output file (def = 0)
   /NC          do not use the configuration file
   /NP          do not create a Pascal include files
   /NS          do not write anything to STDOUT
   /O           overwrite the Pascal file without asking
   /Pfilename   set the Pascal filename "filename"
   /Qn          set the maximum number of bytes in the Pascal file (def = 80)
   /Sn          stop comparing after n matches (def = )
   /Tn          start comparing at filepos n (def = CS:IP [EXE]; 0 [COM])
   /V           print only not identical bytes
   /X           extended output (maybe interesting)
   /Zmacro      execute the macro "macro"

  Available methods:
   /ACALL       check out a long call first (Turbo Pascal) (can use with /I)
   /ACOM        Compare as normal file (without EXE header)
   /ACSn        add CS to old one (subtract if n < 0; relative)
   /AFAR2       check out a far call (JMP FAR [xxyy]) (can use with /I)
   /AIPn        add IP to old one (subtract if n < 0; relative)
   /AMOV        use MOV method to identify a jump (MOV xx yy; JMP xx)
   /AOVR        compare EXE overlays
   /Cn          Change CS to n (in paragraphs; absolute)
   /In          Change IP to n (absolute)
   /Jn          check up to n jump levels (/J => /J1) (E8, E9, EB)

  Available macro commands (case sensitive):
   c    do a long call at the current position (only EXE files)
   f    do a far jump at the current position
   j    do a jump/call at the current position
   m    do a MOV jump at the current position
   _    seperator for macro commands
   Between every command may be numbers which tell the number of bytes to
   skip. See examples for details. See JMP/CALL sections for details.
:

-
  Some examples
   GETEQEXE a.exe b.exe c.exe d.exe
       compare the startupcode (at CS:IP) of a.exe, b.exe, c.exe and d.exe

   GETEQEXE a.exe b.exe c.exe d.exe /j
       goto CS:IP, evaluate one jump, then compare

   GETEQEXE a.exe b.exe c.exe d.exe /j /i10
       goto CS:IP, skip 10 bytes, evaluate one jump, then compare

   GETEQEXE /f?.exe /i10
       compare all files that match the filemask ?.exe,
       goto CS:IP, skip 10 bytes, then compare

   GETEQEXE a b c d /j /i10
       the same as above. ".EXE" is the default extension

   GETEQEXE /i5 /j2 a b c d
       goto CS:IP, skip 5 bytes, evaluate 2 jumps, then compare

   GETEQEXE /z5j10j a b c d
       goto CS:IP, execute macro "5j10j", then compare
       macro: skip 5 bytes, evaluate jump, skip 10 bytes, evaluate jump

   GETEQEXE /acom /z1m6j a b c d
       execute macro "1m6j", then compare
       macro: skip 1 byte, evaluate a MOV jump, skip 6 bytes, evaluate jump
       the default extension is ".COM", the comparison starts at filepos 0

   GETEQEXE /ns /i1 /z7j15j a b c d
       will cause an error because it is not allowed to use /I and /Z at
       the same time because if use a macro you can include the /I in the
       macro command (/z8j15j)
:

-
  JMP/CALL/... section
-
   The JMP/near call command:
     JMP 1980h
   or
     CALL 1980h

   Valid jumps and calls are:
     $E3 JCXZ  -  short jump if CX is zero
     $E8 CALL  -  unconditional call
     $E9 JMP   -  unconditional jump
     $EB JMPS  -  unconditional short jump
-
   The MOV; JMP commands:
     MOV BP, 1980h
     JMP BP

   Valid registers (here: BP) are:
     $B8 - AX
     $B9 - CX
     $BA - DX
     $BB - BX
     $BC - SP
     $BD - BP
     $BE - SI
     $BF - DI

   Note: GETEQEXE does not validate the JMP command. It just takes the
         value and jumps there.
-
   The long CALL command:
     CALL 4027h:5622h

   Supported CALL commands:
     $9A - CALL
-
   The JMP FAR command:
     2 come :(
:

-
  Some history of GetEQExe:

 2.86 - added a little assembler to the output (maybe helpful??)
        fixed problems with offset of new executable
 2.85 - added error code on jmp/call otu of file border
        added some information to the output
        improved configuration file handling
 2.84 - made better output and smaller code
        disallowed comparison of COM and EXE files
 2.83 - generalized the MOV jumps ($B8 - $BF)
        advanced documentation
        added output of the bytes at the position of a wrong jump
 2.82 - added switch /B for binary output
        added $E3 to the valid jumps (JCXZ)
        fixed bug with the switches AIP/I and ACS/C
 2.81 - removed switch /Y
        allowed usage of /I within PE files
 2.80 - hope I fixed type problem with E8 and E9 jumps
        made better code in PE entrypoint detection
 2.79 - fixed problem with automatic filename extension if a directory
          with the same name exists
 2.78 - if first identical byte is a jump -> print comment
        if nothing was found, Pascal file will be deleted
        Changed error message if file was not found
 2.77 - removed switch /ACOM - now automatic detection
        added error messages if file is NE, LE or LX otherwise continue
 2.76 - added $BE as valid move jump
        added check if it is really a PE or not
 2.75 - disabled many switches in the configuration file
 2.74 - fixed bug in calculation of PE entry point
          now using the values in the object table
        added possibility to capture startup code of a single file
        added switch /NH
 2.73 - added automatic support for portable executables !!
        added switch /Y to move entrypoint of PE's
        released to the EXE mailinglist
 2.72 - fixed bug that only allowed to use /F :(
        code clearings - smaller code
        advanced output of /X
        now an error occurs if file has no overlays and switch /AOVR is set
 2.71 - fixed bug in loop handling
        added output of config file switches
        added support for filemasks (/F)
 2.70 - removed bug in output
 2.69 - added configuration file support
        optimized code a little bit
        first public release
 2.68 - now attributes are restored on error
        now using string constants -> saved ~1 KB
        made complex but small parameter handling
 2.67 - added check for redirection
        added documentation
        added additional commandline parameter check (NP, NS)
        added error if Pascal file exists
        added switch /O
        removed with /AIP and /I
 2.66 - added faster print method
:

-
  GetEQExe is Copyright (c) 1997 - 1998 by PHaX (phax@writeme.com)
:                                 --- EOF ---
