Does this editor have a way to display the ASCII bytes in CP437 glyphs? I grew up reading binary files in DOS that way and I can read the glyphs much faster than the corresponding hex values; in contrast, using dots for the non-printable characters doesn't really tell me much.
You can download additional assets in the settings and then interpret data as encoded in various formats. I don't see CP437 in the list but the file format for encodings is straightforward, you can probably create a mapping easily.
The problem with CP437 is that FF, 00, and 20 are all empty space and look the same. Then there's the question about that ambiguous character that's either German Sharp S or Beta.
They’re talking about CP473 character 225, (hexadecimal E1), which resembles both β and ß (depending on the exact font), and was frequently used as a stand-in for both.
I tried ImHex…found it way too complex for most of what I wanted to do. I’m still a huge fan of Hex Fiend on macOS - simple, fast, does what I want. I still haven’t found the perfect “simple” hex editor on Windows.
Interesting, I find HxD on Windows to be the absolute peak of hex editors with no real parallels on macOS or Linux. Which is a shame because I never use Windows.
Hex Fiend for instance is my hex editor on macOS, but why does it insist on reflowing the lines when I expand the window? I might just want to work with it maximized to avoid visual distractions, but I still only want lines to be 16 or 32 bytes long, and definitely not some weird size that will make things not line up.
I use HxD in Wine because I can't find anything that works better. I use and really like Imhex for what it is but it's a different kind of tool imho - more of a plugin canvas for analysis than just a hex editor with some bells and whistles.
Just wanted to mention that Hex Fiend is simply the fastest editor ever (on Mac). I threw gigabytes-sized files at it and it still manages to open them instantly, to the extent that I also use it as a plaintext editor in some extreme cases.
This is the other thing with HxD and I think it's very important for a hex editor, it handles huge amounts of data in the correct way. HxD can open entire block devices, or per-process/whole system RAM, and it all works without bogging down.
I've tried a lot of lesser hex editors that get cooked the moment you try to open a 4GB file. I don't know if the field I'm in skews this, but most of the time if I'm looking at a file in a hex editor, it's relatively large and I need to find a tiny amount of information in it.
Reminds of the old days, when reverse engineering game binaries were a thing. Finding hex strings, no-op'ing if conditions, adding jmp instructions. Many heroes forgotten with time as more and more of software onboarded the cloud offerings. I wonder how much of it is still relevant and in what fields?
Any editor, to be fluid and quick at today's screen resolution, needs hardware rendering. The days of drawing things pixelwise, especially any complex formatting, are noticeably slow.
busybox hexedit is an editor. It's fast for viewing and editing in hex. No GPU required. No need for ncurses either. toybox hexedit adds optional colors.
Yes, if you ignore what I wrote and cut the conditions short, you can change the conclusions. Yet I still don't think you're understanding how even console hardware tends to work.
Busybox hexedit is not drawing pixels. What do you think is drawing those glyphs on the screen? Very few font renderers are pixel based software, even for tiny systems, since that's slow (and font blitters are soooo cheap to embed).
Another way to see it - where in the hexedit code is the font drawing? In busybox? Oh, it relies on something else to do it, and even most of those are hardware accelerated. Here's the hexedit code [1]. Start there, walk back through how it prints, how that is implemented in busybox, how busybox defers that to hardware, back into various supported platforms, look at the chip sets, and voila... Hardware accelerated in most cases (I don't see one offhand that does pixel writes any more).
Pretty much all console hardware now is hardware accelerated. If you log into a device and run SSH from a larger machine, those glyphs are hardware accelerated.
So which combinations do you claim have no hardware acceleration (and if possible, meet other conditions I actually listed, like modern screen resolutions)?
The MIPS router that I connect to via SSH does not have a GPU. Nor does the laptop I use to connect to it. I am not a gamer and I have never purchased an expensive graphics card. The first "GPU" went on sale in 1999. In that time period, I used VGA textmode^1 to do hex editing. I still use textmode today. I do not run X11/Wayland/whatever. I do not use a terminal emulator. I am not interested in Unicode; I deliberately avoid UTF-8 where I can. In all the time i have been using computers, I have not needed hardware acceleration for editing hex. I do not forsee that changing before I die.
Your laptop most certainly has a GPU, even if it's not a dedicated one. All modern desktop environments use GPU acceleration, it's just that integrated GPUs are good enough for anything but the most demanding games. They are also enough for ImHex
The UI is built using Imgui (hence the Im prefix) which is a Ui framework for computer graphics programs.
Though, a couple nits:
1. An OpenGL requirement doesn’t necessitate a GPU. There are software implementations of OpenGL but they tend to be rather mediocre at best for performance.
2. Many platforms now assume some kind of GPU. It’s fairly rare to need a GUI tool without also having a GPU available. Of course there are niches for it, but those aren’t also likely to be running a hex editor and tooling locally.
'GPU' doesn't mean discrete, power-hungry graphics card either (not that you said it did).
OpenGL calls for basic desktop rendering can be reliably handled by the integrated graphics in the CPU. In which case OpenGL can almost be viewed as a parallel instruction set / DSL.
> There are software implementations of OpenGL but they tend to be rather mediocre at best for performance.
This is because OpenGL is made so that you need to run a program to calculate color of every pixel, even if all you want is to copy a glyph. Obviously it will be slow unless you have hundreds of core running in parallel. Software implementations should either learn to convert shaders to non-parallel optimized loops, or something other than OpenGL should be chosen as a basis for rendering GUI.
Also, ImGUI (which is an immediate mode toolkit) is a weird choice for GUI program, isn't it better to use retainted mode library that updates only parts of the window that have changed?
I will stick to 010 Editor for now[1], it's the most amazing hex editor I've tried in my life. I'm not fond at all of the GUI framework (Dear ImGui) that this new projects uses. It's meant for embedded systems with tiny screens and no window manager, not full-fledged desktop environments where the small elements and the complete lack of UI integration makes for a very awkward experience.
This is an absolutely great project. I had a lot of fun tinkering with the ROM of my Philips smart clock.
It has a built-in DSL that looks like Rust (without memory management, though – so it's very lightweight), and with that, it's possible to visualize and extract structural data from binary streams. That's really fun and cool.
It also has a visual editor to make simple calculations with no code. It didn't feel polished at the time I tried it. Strangely, writing code in DSL was more intuitive and easier for me.
There's, unfortunately, a million similar implementations for this basic concept. 010 Binary Templates, Hex Workshop structures, Okteta structures, Kaitai Struct Definitions. Heck, I made my own Go struct tag DSL that does this, before I realized just how many times it had already been done before.
The thing that's complicated of course, is that while it is a good idea and the basic idea is incredibly similar across implementations, there are just enough different concerns to make it hard to have one universal standard that can cover all of the use cases. It's hard enough to have a single parsing framework that handles both text parsing and binary format parsing well, but you also would need to consider the ability to incrementally parse/stream, read/write support, support arbitrary transformations, some formats need pointers, offsets, indices, and of course to what degree such a descriptor should be declarative versus imperative (declarative is better, but it gets increasingly hard to capture all details entirely in a purely declarative manner.)
I too have been working in this space for a while. Then I found out about kaitai stuct, lost some steam but regrouped. I do have some novel ideas and my dsl is less verbose than theirs :)
This looks pretty neat. Would it be a good idea to develop a hex editor as a project? It doesn't look too hard for a simple one, but if one wants there is a lot of room for practice, like parsing all fileformats, from executionable image to doom wads too some proprietary file format, and I'm there is a lot room for tools that help RE too.
I remember reading something where the author said the first project they implement when trying to learn a new language is to implement a hex editor. Said it ticked a lot of boxes as far file handling, GUI, text layout, memory management, etc.
I really like this area of computer culture. RE, writing kernel modules, figuring out how stuff works and making stuff do what it was not designed to do aspects. However, legal avenues to do so are far in between and it requires a huge amount of time and help from peers.
>However, legal avenues to do so are far in between and it requires a huge amount of time and help from peers.
I reverse engineer things for a living and I have many peers worldwide who do the same. My main field of work is malware analysis.
For recreation, in my country it's explicitly legal to reverse engineer things you own, with a purpose of making it work on your system (think: fixing a windows XP game so it works on windows 10). This is a very broad loophole, and let's you reverse engineer things in most cases when they "feel" like they should be legal.
You don't need a project to be "legal" to have some fun :)
Publish under a pseudonym with no links to your real identity, use dedicated communities that disregard DMCA takedowns. As long as you don't want to earn money this way, the worst that will happen is that your target notices your work and deploys vmprotect on their releases.
File formats are great fun to RE. I worked at a place that used a proprietary business management app. One day I was bored and started looking at its data files with a hex editor and saw some patterns like the titles of records in the app were spaced at exact multiples of X bytes apart on the data file. Oh! Fixed width records! Huh, look at that: right after the title, the next two bytes look like the hex value of the record number show in the app. Guess that's how it stores those! If I click this checkbox, this one byte changes from 0x00 to 0x01. Hey there! After enough experimentation I had the whole thing mapped to structs in code and was able to build reports that the original app couldn't support.
There wasn't anything illegal about that. I'm sure the vendor would've preferred we pay them to make reports for us but nothing legally prevented it.
Just don't publish it, and you can kinda do whatever. Remember, just because you build or learn something doesn't mean you have to broadcast it. Edification can be its own reward.
This is an amazing app. I had some data to reverse engineer just a few days ago, happened to try imhex and within a couple hours I had a description with some slightly complex data structures. The format language is quite easy to learn if you program in anything and it supports lots of weird cases. I just wish it had some more date/time formats built-in, but otherwise no complaints.
This seems interesting and is coincidentally exactly what I need right now.
My trusty file, strings, hexdump and xxd all failed me.
I was going to use ghidra, but it's quite the beast and I haven't had any time to learn it yet.
Gonna give this a try tonight.
Ghidra is, for the most part, not a hex editor. It’s meant for reverse engineering - mainly decompilation, but it’s useful for patching as well. The debugger is new and takes some getting used to (I’m still using GDB + Ghidra), but the disassembler and decompiler are top-notch.
Hex Fiend does data structures and file formats now too, using parsers written in TCL. I’d probably rate Hex Fiend as being in the middle too, especially if you’re going to put xxd at the low end :)
Personally, for file format parsing I like to use Hachoir (specifically Hachoir-wx for GUI file structure browsing), which is a somewhat obscure bit of software that I’ve made some contributions to.
Light mode is easier to read thanks to black-on-white text I think (I need to use bigger fonts in dark mode for the same readability). But to avoid issues with brightness I set monitor brightness to the minimum and set the background to light yellow ("solarized") rather than plain white.
> No one complains that reading something on paper burns out your retinas. A light mode shouldn't either.
The problem is that modern monitors are optimised for max brightness, not minimum. On my monitor I work on 0% brightness during the day. More is too bright already. During the night I turn down the contrast for lack of other options. That screws up colour depth though. Dark mode helps a ton too. A monitor that could display accurate colours at low brightness would be amazing but nobody cares enough to make one.
One is above my ThinkPad P1 or X1 Extreme in landscape mode, the other to the left in portrait mode. I use all three displays.
I calibrated all three displays with an X-Rite (now Calibrite) Display Pro using DisplayCAL software.
For the two external monitors, the calibrator came up with these settings:
Brightness: 27
Contrast: 70
Gamma: Gamma 1
The specific RGB settings are slightly different between the two. One is:
Red: 56
Green: 43
Blue: 40
And the other:
Red: 39
Green: 42
Blue: 42
This settings make light modes very comfortable on both monitors, either during the day or at night with the room lights on. They are on a dimmer so I can adjust the lighting for comfort.
For photo editing or watching a video, I crank up the brightness on the landscape monitor to 85.
I do something similar on my phone, a Samsung S24 Ultra. I use light themes and turn the phone brightness way down so it matches these other displays - unless I'm out in the sun and then I turn it way up.
I also turn up the brightness near max to look at photos or watch videos. Because of this, YouTube is the one app where I use a dark theme. This works well with the increased brightness.
That's interesting. It's exactly the monitor I have. But I'm very sensitive to light. During the day 0% brightness is bright enough for me already.
The problem for me is that I live in a very hot country but I don't have air conditioning. At night I leave the balcony doors wide open but I don't like to keep any lights on which attract bugs. The lights from the street are enough to move around by. Even with dark themes and the contrast and brightness set way down the LG is still a bit too bright for comfort. And when an app opens that doesn't do dark mode.. ouch
I also have an old crt terminal (a Dec VT520) and I can set that so dim I can barely read it under those circumstances without being bothered by pwm or loss of fidelity.
Ps I really lament the lack of 24" 4K models on the market these days :'( 27" is a bit too big
Ah yes, having to keep the room dark would certainly change things.
I wonder if you have tried some of the custom settings under Picture/Picture Mode and Picture/Color Adjust? Picture Mode has a couple of dark room settings, and Color Adjust may let you turn down the brightness farther than the normal brightness setting allows.
Agree completely on the 24" vs. 27", especially because I use one of my monitors in portrait mode. 27" would be way too tall!
Ah I tend to not use those kinds of modes at all. They're generally just preconfigured lists of settings that you can adjust yourself too. But I just tried them. My own "Custom" mode is darker than the dark room picture modes already :')
And that is what I use during the day - lol. This screen really is bad at low light performance. For the price (I think I paid 220 euro for it) I can forgive that because it's pretty decent in other ways.
ImHex has been my primary hex editor for around a year and a half, nothing bad to say about it. By far the most advanced open-source hex editor. Kind of renders 010 Editor obsolete. The dev is exceptionally active as well. I was asking about a bug in his discord once and he patched it as we spoke.
Whelp, I tried my best to install imhex into my arch system with no success; the AUR packages fail to build and the -bin crashes with a glfw error. The AppImage runs but doesn't save settings after exit. This sucks, because it seems like a very nice project.
I still use HXD for most cases, but whenever I need to work with encoded text, I use a fork of MadEdit instead. MadEdit has no problem with multibyte characters, whether it's UTF-8, UTF-16, or Shift-JIS.
It is hard to find the link for Windows download, most people (especially us dumb Windows users) want to find a link and download, not scroll a bunch then go to another page then scroll some more and make a decision about which one of 20 links they need. It is not that hard, especially for most people on HN but it does add friction to people trying your software. This is a very common thing with other projects so not just picking on this one.
Finally, when it does load on my Windows machine (using MSI installer and after convincing Microsoft that it is safe to run and bypassing their warning) it loads up super tiny on my 4k laptop screen and is unusable. I suppose I could mess about with the compatibility and scaling settings but I kind of lost interest after all of the above.
I tell you all this because obviously a lot of work went into this tool and from the screenshots it looks beautiful and useful, but is let down by the process involved to get it to run, at least on my machine.
Really weird criticism. If you're confused about how GitHub works, you might follow the link to their website[0] (when you click on "Release" in the readme) and then scroll down to find a "Download for Windows" button.
At least on desktop, there's also a link to the main site in the About section of the repo. This might actually be a better link for the HN submission, as I bet there's a non-zero intersection of hex editor users and people who completely do not understand Git whatsoever (assuming they've even heard of it).
> it loads up super tiny on my 4k laptop screen and is unusable. I suppose I could mess about with the compatibility and scaling settings but I kind of lost interest after all of the above.
Oh, it’s this one. I tried it a couple of years ago and it did this, and was somewhat awkward to fix IIRC.
This is how most open source projects do things, 1. because they are not users, and 2. they don't have UX teams and upper management to force them to make it easier to use for people.
Be lucky you get binaries at all, there are many projects that don't provide any at all, and are quite hostile to anyone asking for them!
On another hand, no upper management to push ads and dark patterns. The more old school or even ugly a project looks like, the more I end up trusting it.
Why would I do that unless I have a strong reason to use it rather than just move on with my day? A link is posted on HN for some cool software, it is already annoying to install it due to Microsoft complaining about it, then when I first run it, it opens up a tiny window an is asking if it can upload information. I don't expect to spend time figuring out its issues. I can't be the only one using a 4K display on Windows.
> Why would I do that unless I have a strong reason to use it rather than just
> move on with my day? A link is posted on HN for some cool software, it is
> already annoying to install it due to Microsoft complaining about it, then
> when I first run it, it opens up a tiny window an is asking if it can upload
> information. I don't expect to spend time figuring out its issues. I can't be
> the only one using a 4K display on Windows.
Spoken as a true reverse engineer, you should ask for a refund.
Hey, I'd just like to tune in here real quick. I've been using this username since I was like 10, long before I really understood what Nazis are. By the time I learned about this, I've already had this username for years and changing it everywhere would have been a ton of work.
As a native German speaker, this association is really not something people generally make. I'd mostly just like to state that I'm probably as far away from being a right extremist as I can be.
Such a dumb complaint. “Werwolf” is the regular German word for “werewolf” which occurs in every single novel that writes about werewolves (including the German translation of Stephanie Meyer's popular werewolves-and-vampires stories), and going by Levenshtein distance, “WerWolv” as a username is no closer to the German “Werwolf” than English “Werewolf” is.
You know the Nazis had plans called blue, red, yellow, pine tree, Icarus, heron, sea lion, northern lights, typhoon, Isabella, Hercules, etc? Should all those words now be stricken from the German lexicon because stupid Americans aren't able to consider that a German-speaker would use a common German word appropriately?
As someone who for few years regularly was in position where the correct german term for role I performed included the word Führer... Maybe they are avoided outside of german language, and maybe some of them in more colloquial german, but official/formal terminology? That's the thing with general terms.
Ah. Yeah, perhaps, but that was a normal, common word that the bad guys used because it sounded scary, but which still has its original meaning. It's not a word I'd primarily associate with those particular bad guys.
I get what you’re saying. I wouldn’t pick it for myself. Still, he’s from Switzerland where German is a local language, and that’s a normal German word outside the Nazi usage. It wasn’t one of the ones they invented themselves.
I think it’s closer to, say, “beer hall”, which isn’t inherently Nazi even though “beer hall putsch” was their thing. They can still have beer halls.
Isn't "Werewolf", a common D&D monster (well, actually probably uncommon or even rare in D&D world, but you get what I mean), has the same pronunciation? I guess the Nazis just picked something that sound scary and stealthy.
You are aware that there are languages other than English, and that the author is Swiss?
It may even blow your mind that Google searches are not in fact the same for other people, and can vary in time, location, and the individual searching for something.
So perhaps you should explicitly say what your concern is?
ImHex has so far been the best hex editor I’ve used for a few reasons. Some of these exist in other editors but rarely all together.
1. File templates mean that it auto highlights sections of known file types.
2. It shows how selected bytes may be interpreted as pretty much every common data type that I would want and does so simultaneously.
3. It’s significantly faster than other editors for me when I use large files
On the downside, the imgui ui gets buggy sometimes but it’s replaced my use of other viewers like HexFiend, hexa etc…
Well, 010 Editor also checks all three. So:
4. Unlike 010 Editor, it does not take you $150 and is FOSS so you can easily patch it to do whatever you need.
After briefly having used both, the main difference besides layout and aesthetics, is that 010 has a bigger repo of premade templates.
Ask your favorite LLM to translate .bt to .hexpat
https://github.com/WerWolv/ImHex
Oooh that looks slick, thanks for the tip!
I'm guilty of not reading the article more often than not, but posting the exact link of the article in a comment is next-level.
Wow, that's embarrassing :/
It was more funny than anything.
Uh that is literally the link that is posted, that this thread is about.
Does this editor have a way to display the ASCII bytes in CP437 glyphs? I grew up reading binary files in DOS that way and I can read the glyphs much faster than the corresponding hex values; in contrast, using dots for the non-printable characters doesn't really tell me much.
You can download additional assets in the settings and then interpret data as encoded in various formats. I don't see CP437 in the list but the file format for encodings is straightforward, you can probably create a mapping easily.
https://github.com/WerWolv/ImHex-Patterns/tree/master/encodi...
The problem with CP437 is that FF, 00, and 20 are all empty space and look the same. Then there's the question about that ambiguous character that's either German Sharp S or Beta.
I break ties by using ๐ for NULL which declutters output with lots of null bytes, and ⍽ for non-breaking space because I saw the glyph on Wikipedia.
I will fight anyone who claims that a beta and an eszett look the same.
They’re talking about CP473 character 225, (hexadecimal E1), which resembles both β and ß (depending on the exact font), and was frequently used as a stand-in for both.
Oh damn, I forgot about that code page... You're right, it's a mix between the two.
I tried ImHex…found it way too complex for most of what I wanted to do. I’m still a huge fan of Hex Fiend on macOS - simple, fast, does what I want. I still haven’t found the perfect “simple” hex editor on Windows.
Interesting, I find HxD on Windows to be the absolute peak of hex editors with no real parallels on macOS or Linux. Which is a shame because I never use Windows.
Hex Fiend for instance is my hex editor on macOS, but why does it insist on reflowing the lines when I expand the window? I might just want to work with it maximized to avoid visual distractions, but I still only want lines to be 16 or 32 bytes long, and definitely not some weird size that will make things not line up.
+1 for HxD, been using it on Windows for a long while now, and it's the best he editor I've tried. Haven't tried ImHex yet, mind.
I use HxD in Wine because I can't find anything that works better. I use and really like Imhex for what it is but it's a different kind of tool imho - more of a plugin canvas for analysis than just a hex editor with some bells and whistles.
Just wanted to mention that Hex Fiend is simply the fastest editor ever (on Mac). I threw gigabytes-sized files at it and it still manages to open them instantly, to the extent that I also use it as a plaintext editor in some extreme cases.
I use HxD as well. It is an interesting and fast tool.
This is the other thing with HxD and I think it's very important for a hex editor, it handles huge amounts of data in the correct way. HxD can open entire block devices, or per-process/whole system RAM, and it all works without bogging down.
I've tried a lot of lesser hex editors that get cooked the moment you try to open a 4GB file. I don't know if the field I'm in skews this, but most of the time if I'm looking at a file in a hex editor, it's relatively large and I need to find a tiny amount of information in it.
+1 for HexFiend. Their template format is straightforward to extend. I’ve used it to analyze many different file formats.
I also tried ImHex briefly. I have a ton of respect for the project, but found for my needs it was like using a cannon to kill a housefly.
Have you tried Hiew?
No, hadn’t heard about it. Seems interesting, sort of “vim for hex” like. I might give it a spin.
Actually ncedit for hex.
You must be from ex-USSR.
Reminds of the old days, when reverse engineering game binaries were a thing. Finding hex strings, no-op'ing if conditions, adding jmp instructions. Many heroes forgotten with time as more and more of software onboarded the cloud offerings. I wonder how much of it is still relevant and in what fields?
> ImHex requires a GPU with OpenGL 3.0 support in general.
Why does a hex editor require OpenGL? (and therefore a GPU?)
Is there a good reason why it needs OpenGL or is it just for l33t-ness?
> Why does a hex editor require ... a GPU?
Any editor, to be fluid and quick at today's screen resolution, needs hardware rendering. The days of drawing things pixelwise, especially any complex formatting, are noticeably slow.
See this [1] for example
[1] https://www.sublimetext.com/blog/articles/hardware-accelerat...
"Any editor..."
busybox hexedit is an editor. It's fast for viewing and editing in hex. No GPU required. No need for ncurses either. toybox hexedit adds optional colors.
> "Any editor..."
Yes, if you ignore what I wrote and cut the conditions short, you can change the conclusions. Yet I still don't think you're understanding how even console hardware tends to work.
Busybox hexedit is not drawing pixels. What do you think is drawing those glyphs on the screen? Very few font renderers are pixel based software, even for tiny systems, since that's slow (and font blitters are soooo cheap to embed).
Another way to see it - where in the hexedit code is the font drawing? In busybox? Oh, it relies on something else to do it, and even most of those are hardware accelerated. Here's the hexedit code [1]. Start there, walk back through how it prints, how that is implemented in busybox, how busybox defers that to hardware, back into various supported platforms, look at the chip sets, and voila... Hardware accelerated in most cases (I don't see one offhand that does pixel writes any more).
Pretty much all console hardware now is hardware accelerated. If you log into a device and run SSH from a larger machine, those glyphs are hardware accelerated.
So which combinations do you claim have no hardware acceleration (and if possible, meet other conditions I actually listed, like modern screen resolutions)?
[1] https://github.com/mirror/busybox/blob/2d4a3d9e6c1493a9520b9...
The rationale is in the part you forgot to quote.
And you are comparing apples with oranges. busybox hexedit is not a GUI app.
When I am in textmode on the laptop and I run ssh client I am not using a GPU. There is no need for it.
I am not playing video games. I am not interested in "AI".
I do not need a GPU to use a hex editor. That would be a waste of electricity.
The MIPS router that I connect to via SSH does not have a GPU. Nor does the laptop I use to connect to it. I am not a gamer and I have never purchased an expensive graphics card. The first "GPU" went on sale in 1999. In that time period, I used VGA textmode^1 to do hex editing. I still use textmode today. I do not run X11/Wayland/whatever. I do not use a terminal emulator. I am not interested in Unicode; I deliberately avoid UTF-8 where I can. In all the time i have been using computers, I have not needed hardware acceleration for editing hex. I do not forsee that changing before I die.
1. Pixels, not glyphs
Your laptop most certainly has a GPU, even if it's not a dedicated one. All modern desktop environments use GPU acceleration, it's just that integrated GPUs are good enough for anything but the most demanding games. They are also enough for ImHex
The UI is built using Imgui (hence the Im prefix) which is a Ui framework for computer graphics programs.
Though, a couple nits:
1. An OpenGL requirement doesn’t necessitate a GPU. There are software implementations of OpenGL but they tend to be rather mediocre at best for performance.
2. Many platforms now assume some kind of GPU. It’s fairly rare to need a GUI tool without also having a GPU available. Of course there are niches for it, but those aren’t also likely to be running a hex editor and tooling locally.
'GPU' doesn't mean discrete, power-hungry graphics card either (not that you said it did).
OpenGL calls for basic desktop rendering can be reliably handled by the integrated graphics in the CPU. In which case OpenGL can almost be viewed as a parallel instruction set / DSL.
> There are software implementations of OpenGL but they tend to be rather mediocre at best for performance.
This is because OpenGL is made so that you need to run a program to calculate color of every pixel, even if all you want is to copy a glyph. Obviously it will be slow unless you have hundreds of core running in parallel. Software implementations should either learn to convert shaders to non-parallel optimized loops, or something other than OpenGL should be chosen as a basis for rendering GUI.
Also, ImGUI (which is an immediate mode toolkit) is a weird choice for GUI program, isn't it better to use retainted mode library that updates only parts of the window that have changed?
ImGUI is quite popular for many tools unrelated to graphics. I’d recommend checking out the gallery posts on the repo for Dear,Imgui for examples.
I believe even tools like NVIDIA’s Omniverse are based upon Imgui
FYI, from the project's Readme:
> In case you don't have a GPU available, there are software rendered releases available for Windows and macOS
they probably just picked the opengl renderer for imgui
I will stick to 010 Editor for now[1], it's the most amazing hex editor I've tried in my life. I'm not fond at all of the GUI framework (Dear ImGui) that this new projects uses. It's meant for embedded systems with tiny screens and no window manager, not full-fledged desktop environments where the small elements and the complete lack of UI integration makes for a very awkward experience.
[1] https://www.sweetscape.com/010editor/
Yeah, just the crappy aliased font rendering alone makes this painful to use for me.
In Extras -> Settings -> Font you can select any OS font to use in place of the default and it will apply AA to it (inc. if the UI scale is >1x)
This is an absolutely great project. I had a lot of fun tinkering with the ROM of my Philips smart clock.
It has a built-in DSL that looks like Rust (without memory management, though – so it's very lightweight), and with that, it's possible to visualize and extract structural data from binary streams. That's really fun and cool.
It also has a visual editor to make simple calculations with no code. It didn't feel polished at the time I tried it. Strangely, writing code in DSL was more intuitive and easier for me.
Cool, a bit like Wireshark protocol dissectors then?
There's, unfortunately, a million similar implementations for this basic concept. 010 Binary Templates, Hex Workshop structures, Okteta structures, Kaitai Struct Definitions. Heck, I made my own Go struct tag DSL that does this, before I realized just how many times it had already been done before.
The thing that's complicated of course, is that while it is a good idea and the basic idea is incredibly similar across implementations, there are just enough different concerns to make it hard to have one universal standard that can cover all of the use cases. It's hard enough to have a single parsing framework that handles both text parsing and binary format parsing well, but you also would need to consider the ability to incrementally parse/stream, read/write support, support arbitrary transformations, some formats need pointers, offsets, indices, and of course to what degree such a descriptor should be declarative versus imperative (declarative is better, but it gets increasingly hard to capture all details entirely in a purely declarative manner.)
^ Insightful!
I too have been working in this space for a while. Then I found out about kaitai stuct, lost some steam but regrouped. I do have some novel ideas and my dsl is less verbose than theirs :)
I have a DSL in go with cli tooling at https://github.com/martinlindhe/feng/
Related:
ImHex – A Hex Editor - https://news.ycombinator.com/item?id=32287902 - July 2022 (70 comments)
ImHex – A Hex Editor - https://news.ycombinator.com/item?id=25353965 - Dec 2020 (78 comments)
This looks pretty neat. Would it be a good idea to develop a hex editor as a project? It doesn't look too hard for a simple one, but if one wants there is a lot of room for practice, like parsing all fileformats, from executionable image to doom wads too some proprietary file format, and I'm there is a lot room for tools that help RE too.
I remember reading something where the author said the first project they implement when trying to learn a new language is to implement a hex editor. Said it ticked a lot of boxes as far file handling, GUI, text layout, memory management, etc.
Yeah it sounds like a plan. I'll try it out!
Looks good! I usually stick to 010 Editor for it's wildcard search, but ImHex does that and more, I'm sold. Will be testing it out a bit more
what're the odds of two dead 0x users showing up at the same time in a thread previously without comments. gave me a chuckle
a thread about a hex editor? kinda high
I really like this area of computer culture. RE, writing kernel modules, figuring out how stuff works and making stuff do what it was not designed to do aspects. However, legal avenues to do so are far in between and it requires a huge amount of time and help from peers.
>However, legal avenues to do so are far in between and it requires a huge amount of time and help from peers.
I reverse engineer things for a living and I have many peers worldwide who do the same. My main field of work is malware analysis.
For recreation, in my country it's explicitly legal to reverse engineer things you own, with a purpose of making it work on your system (think: fixing a windows XP game so it works on windows 10). This is a very broad loophole, and let's you reverse engineer things in most cases when they "feel" like they should be legal.
This applies to the entire EEA, fortunately!
Reversing for the purpose of integrations is commonly also legal.
You don't need a project to be "legal" to have some fun :)
Publish under a pseudonym with no links to your real identity, use dedicated communities that disregard DMCA takedowns. As long as you don't want to earn money this way, the worst that will happen is that your target notices your work and deploys vmprotect on their releases.
File formats are great fun to RE. I worked at a place that used a proprietary business management app. One day I was bored and started looking at its data files with a hex editor and saw some patterns like the titles of records in the app were spaced at exact multiples of X bytes apart on the data file. Oh! Fixed width records! Huh, look at that: right after the title, the next two bytes look like the hex value of the record number show in the app. Guess that's how it stores those! If I click this checkbox, this one byte changes from 0x00 to 0x01. Hey there! After enough experimentation I had the whole thing mapped to structs in code and was able to build reports that the original app couldn't support.
There wasn't anything illegal about that. I'm sure the vendor would've preferred we pay them to make reports for us but nothing legally prevented it.
Just don't publish it, and you can kinda do whatever. Remember, just because you build or learn something doesn't mean you have to broadcast it. Edification can be its own reward.
It's publishing what you've learned not ok?
If you've never done at least a tiny bit of "illegal" RE, are you even a true hacker? ;)
are there illegal schools teaching kernel module writing?
Yes. A silly example I encountered just yesterday, looking for usermodehelper invocation examples: https://gist.github.com/muratdemirtas/31b46c459c9c2e285ed71b...
Commenter asks:
> also, question: Why is it called linux_keylogger?
i don't see how that's illegal - it's only a crime if you install it on somebody's computer to steal their information. knives aren't illegal.
Yes, it's not literally illegal, otherwise Microsoft would be in even more trouble. I just thought it was amusing.
(but also, carrying sensibly sized knife is illegal where I live)
This is an amazing app. I had some data to reverse engineer just a few days ago, happened to try imhex and within a couple hours I had a description with some slightly complex data structures. The format language is quite easy to learn if you program in anything and it supports lots of weird cases. I just wish it had some more date/time formats built-in, but otherwise no complaints.
This seems interesting and is coincidentally exactly what I need right now. My trusty file, strings, hexdump and xxd all failed me. I was going to use ghidra, but it's quite the beast and I haven't had any time to learn it yet. Gonna give this a try tonight.
What do you need Ghidra for?
Ghidra is, for the most part, not a hex editor. It’s meant for reverse engineering - mainly decompilation, but it’s useful for patching as well. The debugger is new and takes some getting used to (I’m still using GDB + Ghidra), but the disassembler and decompiler are top-notch.
It’s also useful for defining data structures and carving them up, which (for me) is the role now filled by ImHex.
If HexFiend/xxd are at one end of the spectrum, ghidra at the other, I imagine ImHex and tools like Kaitai are in the middle
Hex Fiend does data structures and file formats now too, using parsers written in TCL. I’d probably rate Hex Fiend as being in the middle too, especially if you’re going to put xxd at the low end :)
Personally, for file format parsing I like to use Hachoir (specifically Hachoir-wx for GUI file structure browsing), which is a somewhat obscure bit of software that I’ve made some contributions to.
Huh interesting, thanks for the recs!
Username checks out
> people who value their retinas when working at 3 AM.
You just need a well lit room to use light mode.
Light mode is easier to read thanks to black-on-white text I think (I need to use bigger fonts in dark mode for the same readability). But to avoid issues with brightness I set monitor brightness to the minimum and set the background to light yellow ("solarized") rather than plain white.
> > people who value their retinas when working at 3 AM.
> You just need a well lit room to use light mode.
Who wants a well-lit room at 3 AM?
Agreed, and also turn down your monitor brightness if needed so the light background matches a piece of paper on your desk.
No one complains that reading something on paper burns out your retinas. A light mode shouldn't either.
I always assumed that ImHex only supported dark mode, but it turns out that it does support light mode too!
> No one complains that reading something on paper burns out your retinas. A light mode shouldn't either.
The problem is that modern monitors are optimised for max brightness, not minimum. On my monitor I work on 0% brightness during the day. More is too bright already. During the night I turn down the contrast for lack of other options. That screws up colour depth though. Dark mode helps a ton too. A monitor that could display accurate colours at low brightness would be amazing but nobody cares enough to make one.
Excellent point. Of course it will vary with different monitors.
I have a pair of LG 24UD58-B 4K 24" monitors mounted on monitor arms:
https://www.amazon.com/dp/B01LPNKFK0/
One is above my ThinkPad P1 or X1 Extreme in landscape mode, the other to the left in portrait mode. I use all three displays.
I calibrated all three displays with an X-Rite (now Calibrite) Display Pro using DisplayCAL software.
For the two external monitors, the calibrator came up with these settings:
The specific RGB settings are slightly different between the two. One is: And the other: This settings make light modes very comfortable on both monitors, either during the day or at night with the room lights on. They are on a dimmer so I can adjust the lighting for comfort.For photo editing or watching a video, I crank up the brightness on the landscape monitor to 85.
I do something similar on my phone, a Samsung S24 Ultra. I use light themes and turn the phone brightness way down so it matches these other displays - unless I'm out in the sun and then I turn it way up.
I also turn up the brightness near max to look at photos or watch videos. Because of this, YouTube is the one app where I use a dark theme. This works well with the increased brightness.
That's interesting. It's exactly the monitor I have. But I'm very sensitive to light. During the day 0% brightness is bright enough for me already.
The problem for me is that I live in a very hot country but I don't have air conditioning. At night I leave the balcony doors wide open but I don't like to keep any lights on which attract bugs. The lights from the street are enough to move around by. Even with dark themes and the contrast and brightness set way down the LG is still a bit too bright for comfort. And when an app opens that doesn't do dark mode.. ouch
I also have an old crt terminal (a Dec VT520) and I can set that so dim I can barely read it under those circumstances without being bothered by pwm or loss of fidelity.
Ps I really lament the lack of 24" 4K models on the market these days :'( 27" is a bit too big
Ah yes, having to keep the room dark would certainly change things.
I wonder if you have tried some of the custom settings under Picture/Picture Mode and Picture/Color Adjust? Picture Mode has a couple of dark room settings, and Color Adjust may let you turn down the brightness farther than the normal brightness setting allows.
Agree completely on the 24" vs. 27", especially because I use one of my monitors in portrait mode. 27" would be way too tall!
Ah I tend to not use those kinds of modes at all. They're generally just preconfigured lists of settings that you can adjust yourself too. But I just tried them. My own "Custom" mode is darker than the dark room picture modes already :')
And that is what I use during the day - lol. This screen really is bad at low light performance. For the price (I think I paid 220 euro for it) I can forgive that because it's pretty decent in other ways.
ImHex has been my primary hex editor for around a year and a half, nothing bad to say about it. By far the most advanced open-source hex editor. Kind of renders 010 Editor obsolete. The dev is exceptionally active as well. I was asking about a bug in his discord once and he patched it as we spoke.
Whelp, I tried my best to install imhex into my arch system with no success; the AUR packages fail to build and the -bin crashes with a glfw error. The AppImage runs but doesn't save settings after exit. This sucks, because it seems like a very nice project.
Should be fixed with 1.35.3 now. There was a permissions issue leading to config folders not being created.
Sadly this program seems to segfault on Wayland.
Try the web version: https://web.imhex.werwolv.net
Working fine with me under Wayland, on Ubuntu 24.04 + Gnome 46
Gave me a flashback to my middle school days when I used a hex editor to modify my saved game files.
I still use HXD for most cases, but whenever I need to work with encoded text, I use a fork of MadEdit instead. MadEdit has no problem with multibyte characters, whether it's UTF-8, UTF-16, or Shift-JIS.
This looks awesome. I’m spending the majority of my time reversing an old game and mostly still use hexdump.
The pattern language is sick, it has really helped my learning. I love this program.
I will just stick with 010 Hex editor for now. Still I will keep an eye on this.
Not to be confused with the Reverse Engineer's Hex Editor, rehex
https://github.com/solemnwarning/rehex
I love the kawai logo
It is hard to find the link for Windows download, most people (especially us dumb Windows users) want to find a link and download, not scroll a bunch then go to another page then scroll some more and make a decision about which one of 20 links they need. It is not that hard, especially for most people on HN but it does add friction to people trying your software. This is a very common thing with other projects so not just picking on this one.
Finally, when it does load on my Windows machine (using MSI installer and after convincing Microsoft that it is safe to run and bypassing their warning) it loads up super tiny on my 4k laptop screen and is unusable. I suppose I could mess about with the compatibility and scaling settings but I kind of lost interest after all of the above.
I tell you all this because obviously a lot of work went into this tool and from the screenshots it looks beautiful and useful, but is let down by the process involved to get it to run, at least on my machine.
For now, I will keep running HxD.
Really weird criticism. If you're confused about how GitHub works, you might follow the link to their website[0] (when you click on "Release" in the readme) and then scroll down to find a "Download for Windows" button.
0. https://imhex.werwolv.net/
At least on desktop, there's also a link to the main site in the About section of the repo. This might actually be a better link for the HN submission, as I bet there's a non-zero intersection of hex editor users and people who completely do not understand Git whatsoever (assuming they've even heard of it).
> it loads up super tiny on my 4k laptop screen and is unusable. I suppose I could mess about with the compatibility and scaling settings but I kind of lost interest after all of the above.
Oh, it’s this one. I tried it a couple of years ago and it did this, and was somewhat awkward to fix IIRC.
This is how most open source projects do things, 1. because they are not users, and 2. they don't have UX teams and upper management to force them to make it easier to use for people.
Be lucky you get binaries at all, there are many projects that don't provide any at all, and are quite hostile to anyone asking for them!
On another hand, no upper management to push ads and dark patterns. The more old school or even ugly a project looks like, the more I end up trusting it.
You can also use it on the web, no need to download it: https://web.imhex.werwolv.net/
Unfortunately, it does not load under Firefox
I only use it with Firefox, and it works :O
Maybe create an issue saying as much?
https://github.com/WerWolv/ImHex/issues
Why would I do that unless I have a strong reason to use it rather than just move on with my day? A link is posted on HN for some cool software, it is already annoying to install it due to Microsoft complaining about it, then when I first run it, it opens up a tiny window an is asking if it can upload information. I don't expect to spend time figuring out its issues. I can't be the only one using a 4K display on Windows.
Sounds like weird OS.
Maybe they've updated it, but I found a Windows MSI link about halfway down the front page.
[flagged]
Great project, shame the author did not google the username.
Hey, I'd just like to tune in here real quick. I've been using this username since I was like 10, long before I really understood what Nazis are. By the time I learned about this, I've already had this username for years and changing it everywhere would have been a ton of work. As a native German speaker, this association is really not something people generally make. I'd mostly just like to state that I'm probably as far away from being a right extremist as I can be.
Nobody's accusing you of being one. Peace.
Such a dumb complaint. “Werwolf” is the regular German word for “werewolf” which occurs in every single novel that writes about werewolves (including the German translation of Stephanie Meyer's popular werewolves-and-vampires stories), and going by Levenshtein distance, “WerWolv” as a username is no closer to the German “Werwolf” than English “Werewolf” is.
You know the Nazis had plans called blue, red, yellow, pine tree, Icarus, heron, sea lion, northern lights, typhoon, Isabella, Hercules, etc? Should all those words now be stricken from the German lexicon because stupid Americans aren't able to consider that a German-speaker would use a common German word appropriately?
There are certain German words which are now often avoided because of Nazi associations (eg, Führer), but yeah Werwolf isn't really one of them.
As someone who for few years regularly was in position where the correct german term for role I performed included the word Führer... Maybe they are avoided outside of german language, and maybe some of them in more colloquial german, but official/formal terminology? That's the thing with general terms.
Why's that?
Google it.
Ah. Yeah, perhaps, but that was a normal, common word that the bad guys used because it sounded scary, but which still has its original meaning. It's not a word I'd primarily associate with those particular bad guys.
https://en.wikipedia.org/wiki/Werwolf
probably not a good idea to pick a username sounding closely to that stuff.
https://de.wikipedia.org/wiki/Werwolf
(Or, direct link to using google translate to get the gist
https://de-m-wikipedia-org.translate.goog/wiki/Werwolf?_x_tr... )
I get what you’re saying. I wouldn’t pick it for myself. Still, he’s from Switzerland where German is a local language, and that’s a normal German word outside the Nazi usage. It wasn’t one of the ones they invented themselves.
I think it’s closer to, say, “beer hall”, which isn’t inherently Nazi even though “beer hall putsch” was their thing. They can still have beer halls.
Isn't "Werewolf", a common D&D monster (well, actually probably uncommon or even rare in D&D world, but you get what I mean), has the same pronunciation? I guess the Nazis just picked something that sound scary and stealthy.
You are aware that there are languages other than English, and that the author is Swiss?
It may even blow your mind that Google searches are not in fact the same for other people, and can vary in time, location, and the individual searching for something.
So perhaps you should explicitly say what your concern is?
When I search for werwolv, I get the person's github entry, and the german entry for 'Werewolf' https://de.wikipedia.org/wiki/Werwolf