1

When I open a binary(in this case it is C:\\Windows\\System32\\notepad.exe), different hex editors show different result each other, for the one same file. I tested it on starting point of section headers, so notice the starting address of 2E 74 65 78 74 00 00 00 (".text...").

  • HxD : enter image description here — Starts at 00000200.
  • UltraEdit : hex image 2 — Starts at 00000200.
  • PEview : enter image description here — Starts at 000001E8.
  • Frhed : enter image description here — Starts at 000001E8.
  • 1
    I suggest to read wikipedia – LotPings Sep 12 at 17:19
  • @LotPings Thanks!! The link is not related with this question, though. – jinbeom hong Sep 12 at 17:25
5

These are different files.

From When is System32 not System32? [emphasis mine]:

In 32-bit Windows there is just one System32 folder which contains many native binaries (or hard links), and there is no way to execute 64-bit code on 32-bit Windows.

With 64-bit Windows, however, we have "Windows On Windows 64" (WOW64) which allows 32-bit processes to run through a wrapper, and there are some things to take into account in this scenario:

  1. Only 32-bit DLLs can be loaded into 32-bit processes, and only 64-bit DLLs can be loaded into 64-bit processes.
    […]

  2. 32-bit processes expect to work seamlessly on 64-bit Windows, so because of (1) we need to have both 32-bit and 64-bit versions of some binaries.
    […]

  3. In order to facilitate (2) but not break native (x64) processes' behaviour, 32-bit processes get certain I/O redirected without their knowledge.
    […]

[…]

For 32-bit processes running on x64 Windows:
- %systemroot%\System32 is redirected to %systemroot%\SysWOW64
[…]

My guess is some hex editors are 32-bit and get redirected to SysWOW64, some are 64-bit and see the "real" System32. Different editors perceive different System32, hence different notepad.exe.

If you copy notepad.exe to a folder that is not affected and analyze the copy then all editors will show the same content. Which file will you see? This depends whether the copying tool is 32-bit or 64-bit.

  • I didn't run the binary(notepad.exe). I just opened it through hex editor. – jinbeom hong Sep 12 at 17:15
  • 1
    You are right. They may consider the file path differently. When I move the binary from System32 to Desktop, they show the same result :) – jinbeom hong Sep 12 at 17:24
  • @jinbeomhong Good idea! I assimilated it into my answer, thanks. But don't forget to move the file back (if you really meant "move"; "copy" is safer). – Kamil Maciorowski Sep 12 at 17:50
  • Thanks! My system is 64 bit Windows. So when i right-click a file in System32 and copy it and right click in Desktop and paste it, the copying tool would be acting as 64 bit process. So the System32 is real System32(64bit file). – jinbeom hong Sep 12 at 17:55
  • Update : Whether i copy a file in GUI on x86 or x64 system seems to be unrelated to copying behavior. When i copy a file in System32 to Desktop, the copied file is actually 64bit file. When i copy a file in SysWOW64 to Desktop, the coped file is actually 32bit file. Of course, third party copying tool would show the different behavior. – jinbeom hong Sep 12 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.