The Index
Free Hex Editor Help File

This help file contains information for Free Hex Editor 1.0.156.

Introduction to frhed.

Information about frhed's features, the disclaimer, distribution notes and how to contact the author.

Installation and deinstallation.

How to get frhed running and how to remove frhed from your computer.

Binary file primer.

Information about binary files for beginners.

File operations.

How to open and save files.

The main window.

Explains the various features of the main window.

Moving in the file.

How to move the caret in the file.

Editing the file.

Changing the contents of the file.

Other functions.

Obtaining information, comparing files, setting options.

Using the special syntax.

Description of the special syntax and the data sizes in the program.

Character tables.

Tables of the ANSI and OEM character sets.

Free Hex Editor is Copyright ©Raihan Kibria 2000

Fill with by Pabs (pabs3@hotmail.com)


Other functions

The Edit/Compare from current offset command:

If you need to compare two files then load one into frhed and choose this command. You will first be prompted to choose the file to compare with. Choose a file and then the OK button. Comparison will occur from the current caret offset.

If the chosen file matches the data in the loaded file from the current offset, you will be prompted so. Otherwise you will get a list of areas of difference to choose from. Areas of difference are ranges of bytes which are different in the files. For example:

File 1: 00 01 02 03 04 (loaded file)

File 2: 00 ff ff 03 04

In this case you will  get one area of difference 2 bytes in size from offset 1 to 2. These offsets are measured relative to the current caret position. When you choose an area of difference then it will be selected and displayed in the main window.

The Edit/Get floating point value command:

This will show you the floating point values starting at the current caret position.

The Edit/File properties command:

Choose this to get the filename, path and size of the current file, and also the total number of lines of the hexdump.

The Edit/Apply template command:

Use this command to apply a binary template on the file. A binary template consists of a text file with the extension "tpl" that contains a number of variable type+name combinations, such as this:

BYTE filetype

WORD version

DWORD filelength

This sample template file named "sample.tpl" is included in the frhed directory. When the command is chosen from the menu you will be prompted to choose the template file you want to apply. Frhed will then load that file and use the code in it to give you a structured "interpretation" of the data in the currently loaded file, starting at the current byte. The result will be displayed in the edit-box of a dialogue, from where you can copy the result to the clipboard if necessary. The result looks like this:

File: C:\Data\test.dat

Template file: C:\frhed\sample.tpl

Applied at offset: 15

BYTE filetype = 66 (signed) = 66 (unsigned) = 0x42 = 'B'

WORD version = 30285 (signed) = 30285 (unsigned) = 0x764d

DWORD filelength = 8 (signed) = 8 (unsigned) = 0x8

-> Length of template = 7 bytes.

Following variable types are recognized: (recognition is case-sensitive, so "byte" is not recognized as type "BYTE")

- a byte-size value: "BYTE", "char".

- a word-size value: "WORD", "short".

- a longword-size value: "DWORD", "int", "long", "LONG".

- a float value: "float".

- a double value: "double".

The Edit/Open in text editor command:

This function attempts to call an external text editing program with the current file as argument. Default editor is the Windows Notepad. You can choose the editor in the Options/View Settings dialogue.

The Options/View settings command:

Here you can choose:

- the number of bytes to display per line of hexdump (only applies if "Automatically adjust number of bytes per line" is disabled)

- the number of digits for the offset length

- how to display the values at the caret position, either as signed or as unsigned integer values

- if read-only mode should be automatically set after opening files

If the "Automatically adjust number of bytes per line"-checkbox is checked, then the number of bytes displayed per hexdump line is adjusted in such a way that the whole window width is used at all times.

- the name of the text editor that will be called by the Edit/Open in text editor command.

- the name of the Internet browser that will be called in the About dialogue.

The Options/Color settings/Text color command:

Choose what color the text in the main window should have.

The Options/Color settings/Background color command:

Choose what color the background in the main window should have.

The Options/Color settings/Separator color command:

Choose what color the separators in the main window should have.

The Options/Character set command:

Here you can choose the character set for displaying and writing characters, either ANSI (the Windows character set) or OEM (the DOS character set). The font size in points can also be chosen.

The Options/Binary mode command:

What kind of byte order to use: Either Little-endian, as used in Intel-computers or Big-endian, used for example in computers with a Motorola processor.

The difference between these modes is thus: Consider a longword, which is 4 bytes (named A to D) long.

Longword in processor register = ABCD.

The least significant bit, which has the value 1, is found in byte "D". In a processor register the longword is ordered in this way. If this value is written to a position in memory, then by Intel convention the longword is written in this way, with the growing offsets to the right:

Longword in memory = DCBA.

That is, the bytes making up the longword are written in reverse order as they are found in a processor register.

This means that a file written by a Big-endian machine will contain wrong longword and word values if read by a Little-endian machine without conversion.

The Bookmarks/Add bookmark command:

Choose this to add a bookmark to the bookmark list. The offset of the bookmark will be set to the current position initially. You can also add a description for the bookmark that will also appear in the menu.

The Bookmarks/Remove bookmark command:

Choose this to remove a bookmark from the bookmark list. You will be presented with a list of the bookmarks and have to choose the one to remove.

The Bookmarks/Clear all bookmarks command:

Deletes all bookmarks.


File operations

Creating new files (command File/New)

If frhed is started without parameters or with a nonexistant filename as parameter, then it starts with a new, empty file that is untitled. If a file is already loaded, then choose File/New from the menu. If a file is already loaded and it has been changed, then you will be prompted if you want to lose the changes.

Opening files (command File/Open)

If frhed is started with command line parameters, then the whole string following the program name is considered to be the name of the file to open.

Examples:

frhed filename.dat opens the file called "filename.dat"

frhed a file-name.dat opens the file called "a file-name.dat"

Note: If you put a link to frhed.exe into the "SendTo"-Folder in your Windows main directory then you can open any file from the Explorer with frhed by choosing frhed from the "Send To"-item in the file's context menu.

You can also choose File/Open from the menu. If a file is already loaded and it has been changed, then you will be prompted if you want to lose the changes.

A file can also be dragged (for instance from the Windows Explorer window) into frhed's window to open it. If several files were dragged, then only the first one will be opened.

Opening files partially (command File/Open partially)

If you want to edit a very large file and it's not necessary to load all of it into memory, choose this command. First you will have to choose the file you want to open in a File-Open-dialogue. Then you must enter the offset from which the file will be loaded and how many bytes to load, or you can check the "Open partially from end of file"-radiobutton if you want to load data from the end of the file. Frhed will now be in partially-opened-mode, which means that whenever you choose the "Save"-command, the data will be written back to the position they were loaded from. This mode is indicated by a letter "P" in the window title after the file name.

Saving files (command File/Save and File/Save as)

To save the current file choose File/Save from the menu. If the file has never been saved before, then you have choose File Save as to name the file.

Saving selections (command File/Save selection as)

To save the current selection choose File/Save selection as from the menu.

(also by pabs3@hotmail.com)

Reverting to the saved file (command File/Revert)

When you have made changes to a file, want to change it back and cannot remember the exact bytes in the file then this command will do it for you. (also by pabs3@hotmail.com)

Deleting the current file (command File/Delete File)

This deletes the file currently opened in the editor and closes it. This requires a double confirmation because it could be disastrous. (also by pabs3@hotmail.com)

Exporting the file as a hexdump text (command File/Export as hexdump)

This command is used if you need the hexdump of the file in plain text form, for example if you need to insert it in a word processor document. You can either put the hexdump into the clipboard or into a file, which you will have to choose. The start line of the hexdump has to be specified (in hexadecimal notation without prefix), which you can find on the left side of the window, for example 23c or 134. You must also specify the end line. The values in the dialogue will be initialized so that the whole file will be dumped, if there is nothing selected, or they will be such that the current selection will be dumped.


Editing the file

There are several ways to edit the data in the file. But you will only be able be to change the file in any way if the read-only mode is disabled. To enable or disable the read-only mode choose the Edit/Read-only mode command. If the read-only mode is enabled, there will be "READ" written in the status bar and the menu item will be checked.

Using the keyboard

For overwriting data the overwriting entering mode must be enabled, that means, the status bar must show "OVR" somewhere. Toggle the entering mode with the Insert-key on the keyboard or choosing Edit/Toggle entering mode. You can overwrite the data in the bytes section by moving the cursor to the appropriate position and pressing any of the hexadecimal digits 0-9 and a-f on the keyboard. The nibble the caret is marking currently will be set to that value and the caret will then go on to the next nibble. If the caret is in the bytes section, pressing any alphanumeric key will set the current byte (that wich the caret is marking) to that value, and the caret will go on to the next byte.

For inserting data the status bar must show "INS" somewhere. Entering data now will insert a byte at the current position.

Using menu commands

The Edit/Cut command:

This command is used to remove bytes from the file. These bytes can either be copied to the clipboard (as text with special syntax for non-character bytes) or just deleted. In the dialogue you can choose the start offset where the cutting begins (the byte at that offset is the first to be cut), how many bytes to cut (specify either the offset of the last byte to cut or the number of bytes including the first byte to be cut, and check the appropriate radio button). If the data should be cut to the clipboard, check the checkbox on the bottom of the dialogue box.

If the command is chosen without a selection, then the values in the dialogue will be set so that the byte at the current offset will be cut.

The Edit/Copy command:

This command is used to copy bytes from the file to the clipboard. It is similar to the Edit/Cut command, only the data will only be copied, not removed.

The Edit/Paste command:

This either inserts or overwrites data from the clipboard starting at the current offset. Choose a radio button for the writing mode wished for. You can also choose how many times the current data is written.

If "Paste coded binary values as text" is unchecked, all data in the clipboard is considered to contain special syntax, so <ld:150> will not be written as the text "<ld:150>" but as a longword value of 150. Check the checkbox if you want to paste as text. The binary mode (Little or Big-endian) and character set (ANSI or OEM) is used as set in the options.

The Edit/Paste with dialogue command:

This either inserts or overwrites data starting at the current offset. Choose a radio button for the writing mode wished for. The big edit-box is initialised with the current text content of the clipboard. Since Edit-boxes can not hold very large amounts of data (ca. 64K), please use Edit/Paste to paste such large blocks of memory.You can also choose how many times the current data is written.

If "Paste coded binary values as text" is unchecked, all data in the edit-box is considered to contain special syntax, so <ld:150> will not be written as the text "<ld:150>" but as a longword value of 150. Check the checkbox if you want to paste as text. The binary mode (Little or Big-endian) and character set (ANSI or OEM) is used as set in the options.

The Edit/Append command:

This command appends a number of zero-bytes to the file.

The Edit/Delete command:

This command calls the same dialogue as the Edit/Cut command, only with the "cut to clipboard" checkbox already disabled.

The Edit/Select block command:

With this you can explicitely choose what block of data is to be selected, by specifying start and end offset of the block.

The Edit/Enter decimal value command:

With this you can overwrite data with an integer value of either byte, word or longword size. The start offset is initialized with the current offset, in hexadecimal notation. Note that if you change the start offset, use hexadecimal notation and prefix with "x". You can also choose the number of times to overwrite or insert and the size of the value. The values are initialised with the current offset, the value of the current offset, byte size and 1 time.

The Edit/Manipulate bits command:

If you need to manipulate individual bits in a byte, then go to this byte with the caret and choose the command. Check the appropriate checkboxes for the bits and select OK. The boxes are initialised with the current value.

The Edit/Fill selection with command:

First select some of the bytes in a file then open the Fill selection with dialog from the edit menu or using Ctrl + Shift + F.

First decide if you want to enter the bytes in yourself - this is usefull for small numbers of bytes and if so select Input from the combo box and enter the bytes below it.

Otherwise you may want to fill the selection with a file by selecting File from the combo box and browsing to a file (It MUST exist - this is why only browsing is allowed).

Note that if the selection is larger than the file or the hex string you entered the selection will be filled with multiple copies of your string/file and if it is smaller only a part of the string will be entered into the selection.

Note also that an odd number of hex digits will result in the first nibble of the last byte being the last hex digit entered.

e.g. "ffa" —> "ff af fa …" —> "ÿ¯ú…"

(This doesn’t apply to files as partial bytes cannot be present in files)

Then select the type of assignment operator you want to use -

= - regular assign

|= - perform a bitwise or with the current byte and then assign

&= - perform a bitwise and with the current byte and then assign

^= - perform a bitwise xor with the current byte and then assign

Below are the

File\ Input Bit	Open File Bit	|=	&=	^=
0	0	0	0	0
0	1	1	0	1
1	0	1	0	1
1	1	1	1	0
also by pabs3@hotmail.com)

The File/Insert file command:

This inserts the requested file between the current byte and previous one.

(also by pabs3@hotmail.com)


Moving in the file
Moving the caret in the file

You can move the caret with the arrow keys. Press TAB to toggle the editing mode between byte and character editing.You can also jump to any position by choosing the Edit/Go To command and entering an offset, like "125", which will set the caret position to offset 125 decimal. For relative jumps in the file, for example if you want to go to an offset 150 bytes after the current one, you have to start with "+" as the first character and follow this with either a decimal number or a hex number starting with "x". So to jump 150 bytes forward you have to enter "+150" or "+x96" in hex notation. For backward relative jumps start with "-" (minus) as the first character. To jump directly to the end of the file press Ctrl+End, for the beginning Ctrl+Home.

Frhed can find text and binary values in a file. Choose Edit/Find to do this. In the dialog you can choose if the case of the text parts of the find string are to be ignored and the find direction. To encode binary values, frhed uses a special syntax. Example:

Here is the findstring.<bd:0>FloatValue<fl:-14.56>

This will cause frhed to search for a string "Here is the findstring." followed by a zero-byte, then the text "FloatValue" and a 4-byte float with the value -14.56.

Note that coded binary values will also be transformed by the "match case" option of the Find command, so if you search for a byte with the hex value of 0x41 (this is the upper-case letter "A") with the match-case option disabled, then frhed will also find bytes with the hex value 0x61 (the lower-case letter "a"). Therefore you should always search for discrete binary values with case-matching enabled or you might not get correct results.

Please see Using the special syntax for further information.

The Edit/Find next and Edit/Find previous commands find the next or previous occurance of the findstring last entered in the Find-dialogue, with the match-case option enabled or disabled as chosen in it.

By positioning the mouse cursor on a byte or a character and pressing the left mouse button you can also set the caret position.

You can also move in the file by choosing one of the bookmarks in the "Bookmarks" menu section. The caret will be set to that offset immediately.


The main window

The window's title shows the name of the currently loaded file in square brackets, with an asterisk on it's right side if the file has been changed. If a file is loaded, you will find something like this in the window's client area:

000000  23 42 34 53 56 45 76 45  #B4SVEvE

000008  64 56 0a bc 0a 35 c0 08  dV...5..

000010  06 be 09 07 bb 07 00 00  ........

000018  00 00 00 00 00 00 07 __  .......

On the far left are the offsets of the first byte in the line in hexadecimal notation. You can choose the offset length with the Options/View Settings command. Then come the actual byte values, with vertical separating lines after every fourth byte in the line. You can choose the number of bytes to display per line with the Options/View Settings, and also, if it should be automatically adjusted to the window width. To the far right are the character representations of these values, with dotted lines on the left and right of this section. You can choose the character set for these representations as well as the font size with the Options/Character set command. As you can see, the first byte of the second line of the sample hexdump has the hexadecimal value 64 and the corresponding character is a lower case "d". The position after the last byte of the file is marked with a double underscore "__" in the byte section.

Blinking in the window somewhere is a rectangular caret, if the window is enabled. If it is in the byte section, then it stands on either of the two nibbles (half-bytes). If it is in the character section, then it stands on one character corresponding with one byte. In either case the corresponding other representation is shown inverted in the other section.

On the bottom of the window is the status bar, which displays additional information. In the first section of the status bar you can find the current offset of the byte which the caret is marking in hexadecimal and decimal notation. After that come the bits of the current byte. Also in this section, on the right side, is something like this:

Unsigned: B:35,W:16931,L:1395933731

These are the values of the byte (B:), the word (W:) and the longword (L:) value starting at this offset in decimal notation. These are computed depending on the setting for signed or unsigned values (Choose with command Options/View Settings) and on the binary mode setting, either Little-endian (Intel format) or Big-endian (Motorola format). Choose with command Options/Binary mode.

In the second section of the status bar are indicators for:

- character set: "ANSI" or "OEM".

- entering mode: "OVR" for overwriting or "INS" for inserting on keyboard input. If frhed is in read-only mode, then there will be a "READ" here.

- binary mode: "L" for Little-endian or "B" for Big-endian.

In the third section the file size in bytes is displayed.

The window also has a vertical and a horizontal scrollbar, which can be used to scroll the view. They don't change the caret position.


Introduction to frhed
Introduction to frhed 1.0

What is frhed?

Welcome to the "Free Hex Editor", abbreviated as "frhed". Frhed is a binary file editor for 32-Bit Windows platforms, like Windows 95, Windows 98 and Windows NT.

Features include:

- Native 32 bit Windows application: long filenames supported, editable file size limited only by available system memory.

- small program size (ca. 100K), loads fast.

- Cut, copy & paste binary values. Syntax for describing byte, word, longword, float and double binary values in text form to use with find and paste functions.

- Directly enter hex values or text in main window (overwrite or insert).

- Compare files.

- Search for any combination of text and binary values.

- Bit manipulation.

- Export as hexdump to file or clipboard.

- Automatically adjust bytes displayed per hexdump line to window width, or set bytes per line manually.

- Choose font size, character set (ANSI or OEM), colors of text and background.

- Intel or Motorola binary format.

- Can be used as "Send to"-Target.

- Set bookmarks to easily access offsets in the file.

- Load files partially.

- Load files by dragging them into the window.

- Apply binary templates for structured information.

- Source code is included. (Written with Microsoft Visual C++ 4.0. Does not use MFC, only Win32 API calls and C library calls, uses C++ classes).

- No registration fee required!

Disclaimer

Frhed is supplied on an as-is basis. The author offers no warranty of its fitness for any purpose whatsoever, and accepts no liability whatsoever for any loss or damage incurred by its use. Frhed is not a supported product. The author accepts no commitment or liability to address any problems that may be encountered in using it; however, frhed is continually being developed and improved, so he is always interested to hear about any bugs or deficiencies.

Using And Distributing frhed

Frhed may be freely used for any purpose. You may use it privately or in the course of your work; there is no fee, and no registration is required. You may distribute it to anyone, and you may place it on any archive or bulletin board system. You may not charge anyone for it other than a reasonable fee to cover your distribution costs. Normally, you should distribute frhed in the form as supplied by the author; however, you may repackage it to suit the conventions and needs of an archive or bulletin board system. Frhed may be distributed as part of any commercial product without a prior licence agreement, although no extra cost should be charged for inclusion of frhed. Frhed may be reviewed for any publication, whether in hard copy or electronic form, without the author's prior permission.

Acknowledgements

Thanks to: Dario Bagnoli (bug reports and beta testing), Tom Foth (suggestions), Bo Wannerberg (Win2000 opening bugfix) and Pabs (pabs3@hotmail.com) for the "Fill selection with" command and other features!

Contacting the Author

If you have comments or suggestions please send eMail to:

rkibria@hrz1.hrz.tu-darmstadt.de

Update homepage

Please check for the newest updates of frhed on this webpage:

http://hotfiles.zdnet.com/cgi-bin/texis/swlib/hotfiles/info.html?fcode=000VOX&b=

Personal homepage

You can also find frhed (including the newest beta version) on my personal homepage:

http://www.tu-darmstadt.de/~rkibria

Raihan Kibria


Special syntax

Byte-, word- and longword data can be encoded as follows:

<{Size}{Numeral system}:{Value}>

Size:

b for byte-size (8 bit) value.

w for word-size (16 bit) value.

l for longword-size (32 bit) value.

Numeral System:

d for decimal system.

h for hexadecimal system.

For floating point values set Size and Numeral system to:

"fl" is for float values.

"do" is for double values.

Value:

Enter the value of the datum after the colon.

Examples:

<bd:-15>	means byte-size datum with decimal value -15.

<wh:23f0>	means word-size datum with hexadecimal value 23f0.

<ld:1234567890>	means longword-size datum with decimal value 1234567890.

<fl:2.5>	means float-size datum with value 2.5.

<do:1.8e7>	means double-size datum with value 1.8 * 10^7.

Note: If you want to find or paste a valid special syntax string like <bd:0> as text, then prefix a \ to <. This will turn < into a normal character. Copying a < in the file will insert the \ automatically.

Backslashes ("\") in the file are copied and encoded as double backslashes ("\\").

Data ranges and sizes:

Integers:

Byte:

signed from –128 to 127

unsigned from 0 to 255

Word (2 bytes):

signed from –32,768 to 32,767

unsigned from 0 to 65,535

Longword (4 bytes):

signed from –2,147,483,648 to 2,147,483,647

unsigned from 0 to 4,294,967,295

Floating point types:

Float (4 bytes):

range 3.4E +/- 38 (7 digits)

Double (8 bytes):

range 1.7E +/- 308 (15 digits)


Binary file primer

What are binary files?

All the files on your computer, programs as well as documents, are really large "lists" of numbers. Imagine a numbered list like this one:

0) 24

1) 33

2) 9

3) 0

4) 115

The numbering starts at zero. At each list index there is a number, for example the number 9 is at index "2". The index is usually called "offset". frhed displays the current offset in the lower left corner of it's window. Large files contain many numbers, small files not so many. The numbers in the list can have a value between 0 and 255, for a special reason: Each number is a "byte".

What are bits and bytes?

"Bit" is an abbreviation for "BInary digiT". It can have a value of either 0 or 1. One bit alone is not very useful, because already the number 2 can not be described with it. So you take many bits to describe large numbers. This is how it works:

The normal decimal system you know, with digits from 0 to 9, describes numbers larger than 9 by arranging several digits in such a way that each position in the number means something different.

For example the number "245" means really "2 times 100 + 4 times 10 + 5 times 1". The further left a digit's position in the number, the higher a value it contributes to the number. Every time you go one step left in the number, you multiply the digit there with 1, 10, 100, 1000 and so on and add that value to what you already have. The values you have to multiply the digit *with* can be obtained if you start out with 1 on the far right, then multiply with 10 every time you go left. So you get to multiply with 1, then with 1*10=10, then with 10*10=100, then 10*100=1000 and so on. This is our "base 10" number system.

Now the *binary system* is a "base 2"-system. A binary number might looks like this: 1011

This is not "one thousand and eleven", as it would be in the decimal system. In the decimal system we multiplied the digits at the various positions with a 1, 10, 10*10=100, 10*100=1000 and so on, but this time, in the binary system (also known as "dual system"), we multiply with 1, 2, 2*2=4, 2*4=8, 2*8=16 and so on, starting at the right and doing with a "2" what we did with a "10" before. So the value of the binary number above is "1 times 1 +1 times 2 + 0 times 4 + 1 times 8", giving us the number "11" in our decimal system.

Computers use bits to calculate everything, because they can be modeled as "current on" or "current off" easily. With a packet of 4 bits (called a "nibble") you can describe the numbers from 0 to 15. A packet of 8 bits is called a "byte", and *these* are what the file contains. Each byte can describe a number from 0 to 255.

So, a file is a list (or "array") of "bytes", with each byte at a certain index or "offset". These bytes are what frhed displays in the middle of the screen, but in yet another different number system: the "hexadecimal" system, which is a system with the base 16. So there are 16 digits, the normal ones from 0 to 9, and additionally the letters "a" through "f" with following values:

a = 10

b = 11

c = 12

d = 13

e = 14

f = 15

So the "hex" (short for "hexadecimal") number "f14a" means: "10 times 1 + 4 times 16 + 1 time 16*16(=256) + 15 times 16*256(=4096)", giving a value of 61770 in decimal. The point of using hex numbers is that values of up to 255 (maximum value of a byte) can be described by employing up to 2 hexadecimal digits, which gives a neat and ordered output on hex editors such as frhed.

On the right side of the frhed window there are "normal" letters, punctuation symbols and so on. This is because each byte can be seen as an index to a symbol in a "character set". This means that the computer stores for example the letter "a" as a number with the value 97 ("61" in hex notation), the comma "," as a number 44 and so on. So if you write a text on the computer and save it to disk, then the file will contain a number of bytes, each byte signifying a letter, other symbol, or a special code number for "End of line" or "Tabulator" and such. But there are several character sets in use (for example Windows uses either the ANSI or the OEM character set): In one character set the number 97 might mean the letter "a", but in another it could be used for the apostrophe.


Character tables

The ANSI character set:

The OEM character set:


Installation

Extract the contents of the Zip-file to a directory. Nothing else is required, you can start frhed by creating a shortcut to frhed.exe in the start menu or putting the shortcut in the "Send to"-folder and then sending files to it.

If you don't need the source code, delete the directory "Source".

To deinstall just delete the directory that contains frhed. Frhed saves all preference data (colors, MRU list etc.) in the registry under "HKEY_CURRENT_USER\Software\frhed\v1.0.xxx\n", where xxx is the current version and n is the instance number. If you start frhed 2 or more times, then the frhed windows ("instances") have completely separate preference sets, that is different color settings, MRU lists and so on. You can delete the key "HKEY_CURRENT_USER\Software\frhed" with the "Regedit" program that comes with Microsoft Windows.