GT2 0.35

(c) 1999-2006 by PHaX (philip@nospam.helger.com)

http://philip.helger.com/gt/

Table of Content

1. Introduction
1.1 Disclaimer
1.2 What is GT2
1.3 Where to find GT2
2. Reference
2.1 Commandline switches
2.2 Configuration file
3. ThanX

1. Introduction

1.1 Disclaimer

The free software program provided by PHaX may be freely distributed, provided that no charge above the cost of distribution is levied, and that the disclaimer below is always attached to it.
The program is provided as is without any guarantees or warranty.
Although the author has attempted to find and correct any bugs in the free software program, the author is not responsible for any damage or losses of any kind caused by the use or misuse of the program.
The author is under no obligation to provide support, service, corrections, or upgrades to the free software program.
The author can be reached per email to philip@nospam.helger.com

1.2 What is GT2

GT2 is a file detection utility that detects all kind of file types according to their binary signature.
Example: GT will recognize your ZIP file even if it is named "testfile.avi" if the first 4 bytes in the file are PK\x03\x04 - whatever this means if this doesn't mean anything to you ;-)
It is different from standard Windows filetype detection since it does not consider the file's extension by default.
So if you ever stumble across a file that you don't know what it is, run GT2 on it and you will hopefull know what it is.

1.3 Where to find GT2

GT2 does not create a start menu entry because it is not (yet) an interactive application. It can be accessed from the commandline by typing "gt2" or by selecting "Detect with GT2..." from the Windows Explorer context menu.

2. Reference

Author's note: This reference is just at the beginning. It will take some versions until is contains most of the details, but at least I started :)

2.1 Commandline switches

The following table contains an overview of the supported commandline switches and an short explanation what it does. A commandline switch can be at any position within the commandline as long as it starts with a slash '/' or a minus '-' character. The commandline switch names are case sensitive: /s is different from /S.
If you want to scan a file that starts with a '-' character, you can scan it by prefixing the files name with ".\"
Switch Description
/? Show an overview of all available commandline switches.
/alldrives Scans all drives (both fixed drives and network drives) for the filemask(s) you specified on the commandline. This flag automatically starts at your drive C: and scans all directories for the given filemasks, continues with your next drive until it handled all drives.
If you use this switch, your filemask may not contain any directory (e.g. images\*.gif) nor any direct drive name (e.g. c:\*.tmp).
This switch implies the subdirectory switch (/s).
Note: Currently the file system is scanned for each mask you pass. So if you want to scan for some files it will take some extra time, because each drive is scanned more than once.
This issue will only be fixed on demand (if somebody except me is using this switch).
/allfixed Scans all fixed drives. Fixed means that the disk cannot be removed from the drive. The rest is according to /alldrives above.
/allnetwork Scans all network drives. Network means that the drive is a remote (network) drive. The rest is according to /alldrives above.
/bufsize## Set the internal pre-read buffer size to ##.
Be careful when using this switch because changing it to a value that is too small GT2 will probably fail to detect some files whereas setting it to a value that is too large the execution speed will decrease.
The default value is 4096 bytes.
/cachestats Show caching information after all information was printed. This switch has only informational purposes and does not alter anything. I used it to determine the best buffersize (see /bufsize).
/exemod This switch applies only to EXE files. By default the complete EXE information is listed but with this switch only the modifier/compressor/etc. are printed.
To list the modifieres of all EXE files in the current directory, you can use the following command:
gt2 *.exe /l /exemod
/flushoutput By default, all output of a file is cached and than printed at once, because this is faster than printing each character separately. If you pass this switch, the internal output caching is disabled and each output is printed directly to the desired output device.
This switch will heavily decrease the application speed if you scan many files.
/fte## This is a very high sophisticated switch that applies only to DOS executables (for NE EXEs, PE EXEs or SYS files see below). If sets the signature comparison engine tolerance to ##.
This switch may be helpful if you have a DOS EXE file that is modified/packed by a program that is not recognized by GT. It will increase the scanning tolerance and may give you at least a hint what it could be.
The default value is 3
/ftn## This is a very high sophisticated switch that applies only to NE executables (for DOS EXEs see above, for PE EXEs and SYS files see below). If sets the signature comparison engine tolerance to ##.
This switch may be helpful if you have a NE EXE file that is modified/packed by a program that is not recognized by GT. It will increase the scanning tolerance and may give you at least a hint what it could be.
The default value is 3
/ftp## This is a very high sophisticated switch that applies only to PE executables (for DOS EXEs and NE EXEs see above, SYS files see below). If sets the signature comparison engine tolerance to ##.
This switch may be helpful if you have a PE EXE file that is modified/packed by a program that is not recognized by GT. It will increase the scanning tolerance and may give you at least a hint what it could be.
The default value is 3
/fts## This is a very high sophisticated switch that applies only to SYS files (for DOS EXEs, NE EXEs and PE EXEs see above). If sets the signature comparison engine tolerance to ##.
This switch may be helpful if you have a SYS file that is modified/packed by a program that is not recognized by GT. It will increase the scanning tolerance and may give you at least a hint what it could be.
The default value is 1
/l Switch to listmode. By default the application lists more information when possible (e.g. listing a ZIP files content). This output can be prevented by using this switch.
/listopts When this switch is used, all used switches, both from configuration file and from commandline are printed and the application exits. No file detection ís done, just for informational purposes.
/ncg Do not evaluate the configuration file in the executable directory.
/ncl Do not evaluate the configuration file your profile directory.
/ni Do not display identified files.
The opposite switch is /nu.
When using both /ni and /nu just a summary is printed. So if /nologo and /nofooter are passed too, no output is done while scanning!
/noarcs Do not list the contents of archives if the application stumbles across one it can list. This switch applies to "archive-only" files and to archives in EXE overlays.
/nocolor Do not use any colors. Simply use the commandline colors.
/noerrbox Do not show Message boxes in case of an unexpected error. Write the error to the console as well.
/nofooter Do not display the footer that summarizes the found information. If you don't like it, just put it in the configuration file.
/nologo Do not display the copyright logo at the beginning. If you don't like it, just put it in the configuration file.
/noovr Do not analyze any overlays. An overlay is any data that is appended to the original data.
/noscanext Do not analyze the file's extension.
By default the extension of the file is matched to an internal list of known extensions if it could not be identified.
/noscanname Do not analyze the file's name.
By default the name of the file is matched to an internal list of special names if it could not be identified.
/nu Do not display unidentified files.
The opposite switch is /ni.
When using both /ni and /nu just a summary is printed. So if /nologo and /nofooter are passed too, no output is done!
/outhtml Write HTML output instead of normal plain text. The result is written to stdout and needs to be redirected manually.
Here's an example call how to create an HTML representation of the identification results of all files in the current directory:
gt2 * /outhtml > result.htm
This switch (is experimental and) creates stupid HTML but it can be viewed in any common browser.
/outlinenums Write a line number before each printed line. This flag affects only the standard output. If HTML output is selected via /outhtml this flag is ignored.
/outpause## Pause after each ## lines of output. Only values > 0 are valid. This flag affects only the standard output. If HTML output is selected via /outhtml this flag is ignored.
/outxml Write XML output instead of normal plain text. The result is written to stdout and needs to be redirected manually.
Here's an example call how to create an XML representation of the identification results of all files in the current directory:
gt2 * /outxml > result.xml
This switch (is experimental and) creates stupid XML but it can be viewed in any common browser.
/peall Shortcut for /pesect /pedd and /pever.
/pedd List the data directory of PE EXEs.
/pefixup List the fixup directory of PE EXEs.
/peimp List the imported DLLs of PE EXEs.
/peimp2 List the imported DLLs and the imported functions of PE EXEs.
/peres List the resource directory of PE EXEs.
/peres2 List the resource directory and the contents of the stringtable of PE EXEs.
/pesect List the segment table of PE EXEs.
/pever List the version information of PE EXEs.
/s Search the given filemasks in the current directory and all subdirectories.
/status## This switch lets you customize the status bar while scanning. The string ## can contain the following macros, that are updated after every file is scanned.
$D number of successfully identified (detected) files
$T number of total files found so far
$P current identification percentage (includes the '%' sign)
$F current filename
To scan all files in the current directory and all subdirectories, while displaying the identification percentage and the current filename, use e.g. the following command:
gt2 * /s "/status$P [$F]"
/wf Wait for a key to be pressed after the wrok is done.
This maybe helpful if you use this application as a Shell extension.

2.2 Configuration file

The configuration file is a very handy thing that helps you applying common commandline switches. Every switch that can be passed on the commandline can also be written in the configuration file.
The configuration file is called gt2.cfg and needs to be located in the same directory as the executable file.
The following is an example how the configuration file can look like:
;
; GT2 configuration file
;

/fte0 ; EXE
/ftn0 ; NE
/ftp0 ; PE
/fts0 ; SYS
/nofooter

3. ThanX

I'd like to thank all the people for their support over the past years (in alphabetical order):
This page is copyright (c) 2006 by PHaX