What are HEX editors and why are they needed?
Linux Overview
A HEX editor is an application designed to change data where it is represented as a sequence of bytes. For this, the hexadecimal number system is used. Moreover, it can be either a utility - part of some software, or a full-fledged program. The popularity of HEX editors is high now. And not only among programmers, but also among ordinary users
. Therefore, creators strive to make it easier and more convenient to work with their products. Some of them will be described below.
. In addition, it allows you to view information that many programs usually hide. WinHex supports all known file systems (FAT16, FAT32, NTFS, etc.) and reads 20 data types. It has the functions of editing RAM, cloning disks, analyzing, comparing, merging and splitting files, a 256-bit encryption algorithm, etc. However free version
lacks most of these opportunities.
Hex Workshop The next editor pleases with extensive, flexible settings, and, surprisingly, low system requirements
. Therefore, it opens large files without problems, which other programs may have problems with. In addition, the advantages of Hex Workshop include: importing and exporting information blocks, deleting, comparing and copying binary data, viewing the structure and searching for code fragments. Of the minuses: lack of a Russian-language interface and paid access to.
full version
UltraEdit Next up is another simple and convenient program
Other features of UltraEdit include: built-in FTP client, editing and block text selection, support for Telnet and SSH protocols, AutoComplete functions, code folding, playback and recording of macros, etc. Another shareware and non-Russian product.
HexCmp
This program has two important features. It uses the hexadecimal system and is capable of comparing binary files. It has advanced features such as color highlighting and synchronized scrolling, and also has a panel containing information about posts in various formats.
The application supports selective comparison. By moving between individual blocks and using scrolling, you can select the necessary parts of the files. In addition, HexCmp allows you to compare files in text format. You can assign hotkeys to commands to make it convenient to work from the keyboard. The only problem is the fee that developers ask for the license.
Hexplorer
This free program open source. Moreover, it includes several factors that make it an excellent image editor. Simply put, Hexplorer allows you to look at a graphical recording from the binary code side.
Its main functions include:
- Pseudo-random number generation;
- Record macros to automate tasks;
- Unlimited command history;
- View images;
- Finding repeating patterns in data.
ⅩⅥ32
Free distribution is main feature and this hex editor. ⅩⅥ32 is portable application. Its data is not written to the registry, so you can use it directly from a flash drive.
The program easily works with large files. Has a function automatic filling, character conversion, quick search of algorithms, modification of text into a hexadecimal string, etc. But there are also disadvantages - open file stored in memory and there is no command history.
PSPad
And finally, a free HEX editor designed for both ordinary users and programmers. It does not require installation, supports different file types, languages and syntax highlighting.
The program is capable of working with several projects simultaneously. Supports macros, spell checking, HTML preview and text comparison with highlighting of differences. It is also noted that there is an FTP client that allows editing directly from the web server, as well as a built-in CSS editor.
So, the HEX editor is a useful thing, but narrowly focused. This is not office or entertainment software on every day. But one day it may come in handy, and then you can either use one of the proposed options or look for others.
People have the impression that only professionals and programmers can work with hex editors, and for the average person this is something unnecessary and incomprehensible. In fact, this is a convenient tool that will definitely come in handy for gamers and ordinary users if they need to fix an error or bug in the utility. At its core, the editor is a hexadecimal code decoder. You and I use 10-digit to write numbers, the machine uses 2-digit code to encode all information, and then it’s all converted to hexadecimal to make it easier for the user to understand. In fact, editors are more likely to be needed by beginners, because professionals use multifunctional utilities with the ability to use several paradigms at once, if they need them for programming. Let's figure out which calculators and converters are best to choose.
The simplest and most popular hex editor in the world, with the ability to convert code to other encoding systems, as well as read binary files systems. All functionality Hex Editor Neo is about opening files, making some changes and saving in the same or another format, as the user wishes. However, there is one convenience - the history of changes that remains even after closing the utility. So, you won’t have to come to any of your own decisions again. They will be like this, you can return tomorrow to that part of the code that you didn’t have time to complete today right in front of you on the screen. This Hex editor is convenient for beginners and professionals.
HxD Hex Editor
A free, but still quite powerful editor for binary files that supports basic encodings, such as ANSI or ASCII, is often used as an addition to more functional calculators and converters. It accepts files without size restrictions, and most importantly, it allows you to change RAM, immediately recording any innovations on the HDD. And the convenient and ergonomic interface, thought out by the creators, once again simplifies the user’s work. In HxD Hex Editor there is no classic clutter of tools and everything is arranged using a simple shutter system, for this you can download the hex editor.
lacks most of these opportunities.
One of the simple editors suitable for computers with any hardware. It was its low demands on system resources and its user-friendly interface, albeit with some influx of Microsoft object design from the early 2000s, that made the program so popular as a portable editor. If you need to load the utility onto a flash drive, and then deal with the problem in the code on the spot, then best solution You just can’t find it, because the application also has a portable version with even lower system requirements. And also there is mobile version, and you can download hex workshop directly to your smartphone.
. Therefore, creators strive to make it easier and more convenient to work with their products. Some of them will be described below.
This hex editor is shareware, which means you will have to pay for the main part of the functionality. However, basic editing of files of several formats and conversion from one encoding system to another are available without payment. This allows you to try out all the delights of the editor absolutely free, and only then decide whether to buy it. The main advantage is a hodgepodge of functionality; you won’t find such a rich environment for work anywhere else.
HexCmp
This hex editor is worth downloading if you often have to compare several files with each other in order to find an error or change made by your colleague. In addition to conveniently displaying mismatched parts, the utility also provides the simple functionality of a regular editor and converter, as well as the basic set of a gentleman in such programs.
Hex editor online
If you need to quickly make a couple of changes to the hex code and not bother with installing applications, then online editors are also suitable. However, keep in mind that their functionality is extremely poor. Here are links to similar online solutions:
Converter Hex to DEC, BIN and vice versa
Any of the above utilities is suitable as a hex to dec, hex to bin converter. Just upload the file into them and select “save as”, and then select the appropriate format, and the utility itself will convert all the data into the required extension, after which you can open the file of the appropriate type. 
An online calculator like this can be extremely useful when you need to quickly make calculations in the 16th number system. Here is a link to a convenient and good online Hex calculator:
Conclusion
Choose any utility described as desired or use online analogues if the need does not arise often. hex editor neo – will become best choice both for beginners and professionals.
Good day everyone.
For some reason, many people believe that working with hex editors is the domain of professionals and that novice users should not try them. But, in my opinion, if you have at least basic PC skills and an idea of why you need a hex editor, then why not?!
Using a program of this kind, you can change any file, regardless of its type (many manuals and guides contain information on changing a particular file using a hex editor)! True, the user needs to have at least a basic understanding of the hexadecimal system (data in the hex editor is presented precisely in it). However, basic knowledge it is taught in computer science classes at school, and probably many have heard and have an idea about it (therefore I will not comment on it in this article). So, here are the best hex editors for beginners (in my humble opinion).
1) Free Hex Editor Neo
One of the simplest and most common editors for hexadecimal, decimal and binary files for Windows. The program allows you to open any type of file, make changes (the history of changes is saved), conveniently select and edit a file, debug and analyze.
It is also worth noting that good level performance coupled with low system requirements for the machine (for example, the program allows you to open and edit fairly large files, while other editors simply freeze and refuse to work).
Among other things, the program supports the Russian language and has a well-thought-out and intuitive interface. Even a novice user will be able to figure it out and start working with the utility. In general, I recommend it to everyone who is starting their acquaintance with hex editors.
2) WinHex
This editor, unfortunately, is shareware, but it is one of the most versatile, supporting a bunch of different options and features (some of which are difficult to find among competitors).
In disk editor mode, it allows you to work with: HDDs, floppy disks, flash drives, DVDs, ZIP disks, etc. Supports file systems: NTFS, FAT16, FAT32, CDFS.
I can't help but note convenient tools for analysis: in addition to the main window, you can connect additional ones with various calculators, tools for searching and analyzing the file structure. In general, it is suitable for both beginners and experienced users. The program supports Russian language ( select the following menu: Help / Setup / Russian ).
WinHex, in addition to its most common functions (which support similar programs), allows you to “clone” disks and delete information from them so that no one can ever recover it!
3) HxD Hex Editor
A free and quite powerful binary file editor. Supports all major encodings (ANSI, DOS/IBM-ASCII and EBCDIC), files of almost any size (by the way, the editor allows, in addition to files, to edit RAM and directly write changes to the hard drive!).
You can also note a well-thought-out interface, a convenient and simple function for searching and replacing data, a stepped and multi-level system backup copies and kickbacks.
After launch, the program consists of two windows: on the left is the hexadecimal code, and on the right is the text translation and the contents of the file.
Among the minuses, I would highlight the lack of Russian language. However, many functions will be clear even to those who have never learned English...
4) HexCmp
HexCmp - this small utility combines 2 programs at once: the first allows you to compare binary files with each other, and the second is a hex editor. This is a very valuable option when you need to find differences in different files, it helps to explore the different structure of the most different types files.
By the way, places after comparison can be painted in different colors, depending on where everything matches and where the data is different. The comparison happens on the fly and very quickly. The program supports files whose size does not exceed 4 GB (quite enough for most tasks).
Except ordinary comparison, you can make comparisons in text form (or even both at once!). The program is quite flexible, it allows you to customize the color scheme and specify buttons quick call. If you configure the program appropriately, you can work with it without a mouse at all! In general, I recommend that all beginning “checkers” of hex editors and file structures should read it.
5) Hex Workshop
Hex Workshop is a simple and convenient binary file editor, which is distinguished primarily by its flexible settings and low system requirements. Thanks to this, it can be used to edit quite large files that simply do not open or freeze in other editors.
The editor's arsenal has all the most required functions: editing, search and replace, copying, pasting, etc. In the program you can perform logical operations, conduct a binary comparison of files, view and generate various checksums files, export data to popular formats: rtf and html.
The editor also has a converter between binary, binary and hexadecimal systems. In general, a good arsenal for a hex editor. Perhaps the only negative is that the program is shareware...
After the end of the series with the article “ The best tools pentester" the editor received many letters asking for a selection of hex editors. Of course, what is interesting is not the ability to edit binary data, but additional features like automatic recognition data structures and code disassembly. To make an overview, we found out the opinions of the people who most often have to tinker with such tools - virus analysts. And this is what they told us.
Any hex editor allows you to examine and modify a file at a low level, operating with bits and bytes. The contents of the file are presented in hexadecimal format. This basic functionality. However, some editors offer users much more, allowing them to figure out exactly what is what in that incomprehensible set of characters that appears when opening a file. To do this, ASCII and Unicode strings are automatically extracted, known patterns are searched, basic data structures are recognized, and much more. There are quite a few hexadecimal editors, but if we decided to consider them in the context of studying malware samples, it is easy to highlight some of them. Only a few turn out to be really useful for analyzing malicious code and examining infected documents (say, PDF).
McAfee FileInsight
FileInsight is a free hex editor for Windows from McAfee Labs. The product, of course, fulfills all standard functionality, accompanying similar software, offering a convenient interface for viewing and editing files in hexadecimal and text modes. But this is just a drop in the ocean if you look at all its functionality. It’s worth starting with the fact that FileInsight is capable of parsing the structure of executable binaries for Windows (PE files), as well as OLE objects Microsoft Office. Not only that, but the user is offered a built-in x86 disassembler. Just select the part of the file that you want to view as readable code, and FileInsight will show this fragment as a listing of assembly instructions. The disassembler is especially useful when looking for shellcode in malicious files. Other options that reversers will appreciate include the ability to import structure declarations. To do this, the program just needs to specify a header file with declarations like:
struct ANIHeader (
DWORD cbSizeOf; // Num bytes in AniHeader
DWORD cFrames; // Number of unique Icons
DWORD cSteps; // Number of Blits
};
In this case, the program itself will parse such structures. However, many intuitive algorithms for code processing are offered by default. We are talking, first of all, about decoding many obfuscation methods (xor, add, shift, Base64, etc.) - built-in scripts make such crypto protection a one-two punch. It should be noted here that the object of research does not necessarily have to be a binary; it can also be an ordinary web page that arouses suspicion. The program allows you to automate many actions using simple JavaScript scripts or Python modules, of which many have already been written. Alas, with all its advantages, FileInsight also has a serious drawback, which is the inability to process large files. For example, if you try to feed a file of 400-500 MB in size to the utility, the error “Failed to open document” appears.
Hex Editor Neo
There are two versions of this hex editor from HDD Software - a simple free version and an advanced commercial version. The freeware version is a solid, but unremarkable HEX editor that has a cool, customizable interface with support for different color schemes. No more. But the professional version of Hex Editor Neo provides several useful options that can be extremely useful when analyzing binaries. For example, the user gets the opportunity to decode code encrypted using the most common algorithms. In addition, it becomes possible to view and edit local resources such as NTFS streams, local disks, process memory, and RAM. The most complete version also includes support for a scripting language, which allows you to automate many processes using scripts in VBScript and JavaScript. But the best part is that you have a built-in disassembler at your service that works with x86, x64, and .NET binaries! Another feature - quick creation patches based on a comparison of two binaries. Sounds impressive, but is it better than FileInsight? Probably not. FileInsight looks more functional overall. On the other hand, any, even the free version of Hex Editor Neo works great even with very large files and allows you to search for ASCII and Unicode strings. The disassembler here is not limited to just the x86 platform, and the built-in resource editor is very convenient. There's a lot to think about.
FlexHex
FlexHex is a powerful commercial hex editor from Heaventools Software that includes many of the same features found in Hex Editor Neo. The only thing missing here is, perhaps, script support. But this full-featured editor handles binaries, OLE files, physical disks and alternative NTFS streams. The latter is especially important because FlexHex allows you to edit data that other editors may not even see. In addition, you can immediately feel the focus on working with large amounts of information: no matter the size of the file, navigation through it is carried out without any lags or brakes. For even greater convenience, there is a system of convenient bookmarks. At the same time, FlexHex continuously keeps a history of all operations - you can cancel any action simply by selecting it from the list of changes (undo-list is not limited)! FlexHex supports all necessary operations with binary data, searching for ASCII and Unicode strings. If you need to process a structure with a previously known format, setting its parameters is not difficult using special tools. As a result, we get an excellent hex editor, but still much inferior to FileInsight. The only notable option is OLE file processing, but there are problems here too. Several times when trying to open an infected OLE, the program crashed with the error “The docfile has been corrupted.”
010 Editor
010 Editor is a well-known commercial product developed by SweetScape Software. If we compare it with the previous three tools, it can do everything: it supports working with very large files, provides cool capabilities for operating with data, allows you to edit local resources, has a scripting system for automating routine actions (more than 140 various functions at your service). And 010 Editor also has a twist, a unique feature. The editor takes care of everyone thanks to the ability to parse various file formats using its own library of templates (the so-called Binary Templates). Here he has no equal. Many enthusiasts around the world are working on templates, hammering out various format and data structures. As a result, the process of navigating through different file formats becomes transparent and understandable. This also applies to the processing of Windows binaries (PE files), Windows shortcut files (LNK), Zip archives, Java class files and much more. Many people were able to realize the beauty of this feature when the famous security specialist Didier Stevens created a template for parsing PDF files for 010 Editor. Together with other utilities, this has greatly simplified the analysis of infected PDF documents, which for the last six months have not ceased to amaze with the number of places from which the reader program can be exploited. We add here a cool tool for comparing binaries, a calculator with C-like syntax, converting data between ASCII, EBCDIC, Unicode formats, and we get a very attractive tool with unique features.
Hiew
Hiew, in terms of distribution method, is not much different from its colleagues - this is also a commercial product developed by our compatriot Evgeny Suslikov. Having a long history, the program is greatly loved by many specialists in information security. There are quite obvious reasons for this - powerful capabilities for researching and editing the structure and content of executable files of both Windows (PE) and binaries for Linux (ELF). Another very useful feature for reverse engineering is the built-in x86-64 assembler and disassembler. The latter even supports ARM instructions. Needless to say, the editor perfectly digests large files and allows you to edit logical and physical drives. Many tasks are easily automated through a system of keyboard macros, scripts, and even an API for developing extensions (Hiew Extrenal Modules). But before you rush into battle, keep in mind that the Hiew interface is a DOS-like window, which is quite inconvenient to work with if you are not used to it. But you can experience all the charm of old school.
Radare
Radare is a set free utilities for the Unix platform, which provide cool features for editing files in HEX mode. It includes the hex editor itself (radare) with the ability to open local and deleted files. The program analyzes executable files various formats, both Linux (ELF) and Windows (PE). In addition to editing, the Radare package includes a tool for comparing binary files (radiff) and a built-in assembler/disassembler. And personally, a tool for generating shellcodes (rasc) came in handy a couple of times. Any operations can be easily automated and customized using a script system. Of the minuses, again, we can note the lack of a GUI interface - all actions are carried out from command line, but you can fully work with the utilities only after reading the documentation. On the other hand, the site has visual screencasts demonstrating both the main points and little secrets (like connecting a Python plugin).
So what should you choose?
We've looked at several powerful hex editors that include useful options to analyze suspicious files. Of all the products, FileInsight stands out, which, despite all its functionality (and it is truly impressive), remains free. 010 Editor provides a large number of templates to handle the most different files, including PDF documents. This is a mega feature that should not be neglected. I use these two editors all the time; For the work of an analyst, perhaps they are best suited. If we talk about working under the Unix platform, then, of course, we cannot forget about Radare. The package offers very powerful features, although it is difficult to use due to the fact that it runs from the command line. Hiew is also not very friendly, although its capabilities certainly allow you to perform the most different operations with binaries. Besides, Hiew is a choice large quantity real pros, and this is worth a lot (and means a lot). As for Hex Editor Neo, it's worth picking up if you're interested in the ability to disassemble x86, x64 and .NET code.
Hex editor CI Hex Viewer
The program is designed for viewing and editing raw binary data. Contains professional tools for quickly, easily and securely handling hexadecimal data.
Only non-commercial use is allowed free of charge.
CI Hex Viewer allows you to work with various data sources, including physical and virtual disks, disk images, disk partitions, files and individual file fragments.
Requirements
- OS: Microsoft Windows, Linux, Mac OS.
- Windows: starting from NT 5.1 (Windows XP/2003) and higher.
- Mac OS: from version 10.6 and higher.
- Linux: Ubuntu Linux 9.10 (or compatible) and higher.
- Intel Architecture, 32-bit (IA-32, x86).
- AMD64 (x86-64).
- Hard drive: at least 20MB of free space.
- RAM: no less than 256MB.
- Other software: any web browser available.
Possibilities
Structures
Functions for working with binary data:
- Easily editable templates with simple and understandable programming syntax (code) for specifying any type of file and storage.
- Setting up a structure template with the ability to specify the necessary structure parameters and exact data forms.
- Automatic application of templates for all files and storages of the same type.
- A struct context checker that provides hints about the components of a struct template, making it easier to navigate.
RAID build
RAID functions:
- The RAID-Builder utility built into the free Hex editor offers several functions for quickly and correctly building an array. The user only needs to specify the required RAID parameters. You can refine the assembly results by using a hexadecimal editor for any of the array components.
- Automatic RAID build saves time. The built-in RAID configurator function offers instant assembly of the array if all its components are present.
- Parity utility is a ready-made solution for everyone RAID arrays with parity check. The program provides the result of a parity calculation for the sum of several separate components.
- Logical operations such as XOR and GFmul require no user action. Ready calculations for data parity are provided.
- RAID levels include JBOD, RAID0, RAID3, RAID4, RAID5, RAID6. In addition, the software supports working with complex levels such as RAID10, RAID0+1, RAID50 and the like.
- Working with custom RAID configurations.
- Binary and raw data analysis is available for unassembled RAID arrays.
Convenient editing tools and secure data modification mode
CI Hex Viewer provides the following tools:
- It is possible to work with any data sources, including physical disks, virtual storage, disk images, disk partitions, files, and even any fragments of the listed sources.
- The search and replace tool, based on multiple methods including advanced hexadecimal search with customizable syntax, provides accurate data search results.
- The data replacement pattern makes it easier to share between repositories. The program copies an exact range of data from the source to the target storage in a given area.
- The automatic build tool allows you to create a single file from an unlimited number of different disks and files.
- Mode safe editing data guarantees maximum protection from data corruption due to accidental editing errors, and, as a result, prevents possible data loss. In addition, the product allows you to create new file or virtual storage for secure data editing.
Additionally
Features to improve user convenience and save time:
- Easily view binary data with tools for jumping to different positions, for highlighting areas of data, and for a variety of different copying and saving operations.
- Customizable user interface with the ability to specify a hexadecimal data representation field.
- Inspector for viewing and editing data, both in hexadecimal and text format.
- Data source settings and status information to speed up the data analysis process, depending on the information already collected by the program.
- Supports more than twenty encodings to cover a wide range of possible text representations to search for the required data formats.
- Convenient data comparison using the Data Comparison tool, which gives the result of an analysis of all matches and differences in the binary data of disks, files and any of their parts.
- The Parallel Search tool provides the ability to conveniently separately search for the necessary information on several sources simultaneously.