Hexerator
Hexerator is a hex editor with a unique feature set.
Its main focus is to make looking at binary files fun and easier to comprehend, but it also aims to be a good general-purpose hex editor, suitable for a wide range of uses.
Here is what it looks like:
Legend:
- = Planned
- = Implemented
Features
- Colorized values
- Easy data alignment
- Built-in process memory editing
- Multiple source types (file/streamed sources)
- Rich command line options
- Bookmarks
- Multiple configurable views
- Lua scripting support for various operations, like fill.
- External command support
- Diffing functionality
- Huge file support through memory mapped files
Non-features
Features
Colorized values
Colorizing values helps a lot with human pattern recognition.
Custom color palettes
Custom color palettes can be saved and loaded, and generated through various means.
Easy data alignment
Hexerator considers it important to easily align data with shortcut keys. Proper alignment can make a lot of difference with pattern recognition.
Process Memory editing
Built-in support for opening memory of a process and viewing/editing it. Can be used to cheat in games, or discover how different applications store data in memory.
You need to run hexerator with root/admin privileges to open memory of other processes.
Multiple source types
Hexerator supports opening both files and streamed sources like standard input or character devices like /dev/urandom
.
Bookmarks
Quickly and easily save and access points of interest in the data.
Additional support for setting a type for a bookmark to display and manipulate the data associated with it.
Multiple configurable views
You can have different views into different regions of the same file, with different column counts and other configurable properties.
Lua scripting support
You can write Lua scripts to:
- Fill a selection
- Generate a custom color palette
- More coming in the future
External command support
Support for executing a custom external command on selected data.
Diffing
There is basic support for showing differences between
- The current buffer and its source file
- The current buffer and an arbitrary file
- The current metadata and the clean metadata
- Support for more coming in the future
For now diffing is pretty barebones, shown as a list of offsets. It will be better fleshed out in the future
Huge file support through memory mapped files
Huge files that couldn't fit in memory can be opened as memory mapped files through a command line option. To be implemented.
Non-features
Insertion
Insertion would complicate implementation, and for most binary data, including process memory, it will just mess up the data.
Memory holes support, generic support for huge data
Originally, I wanted to have a generic mechanism for loading only parts of files, but I found that it would make the implementation way more complex, and possibly inefficient, so I dropped the idea. Huge files will be eventually supported through memory mapped file support.
News
Hexerator 0.3 released! - 2024-10-16
Check out the release page!
Hexerator 0.2 released! - 2023-01-27
Check out the release page!
Hexerator 0.1 released! - 2022-09-16
This is the initial release.
Get Hexerator
Note: Hexerator is a work-in-progress. It's not polished and there are bugs. Feedback and bug reports are welcome on the git repository.
The meta file format is also not yet stable, so you might not be able to open your metafile after upgrading to a new version of Hexerator.
You can help by contributing!
The current version is 0.3.0
.
Requirements
Check out the requirements before getting Hexerator.
Prebuilt versions
Packages
Building from source
You can follow the instructions here to build Hexerator from source.
Other links
Requirements
Supported platforms
- Windows 7 or newer
- Linux
Looking for a Mac OS developer/maintainer!
Hardware requirements
-
A 32 bit or 64 bit CPU. 64 bit is highly recommended, because 32 bit can only open files up to 4 GB large. Additionally, 32 bit support is not being tested right now.
-
A fairly strong GPU that supports OpenGL 2.1+. Hexerator renders using the GPU, and it can render a lot of stuff on the screen at once, making it fairly GPU intensive.
Building from source
Prerequisites
Building with cargo
If you have rustup installed, you can install Hexerator with cargo.
$ cargo install hexerator --git https://github.com/crumblingstatue/hexerator.git --tag v0.3.0
Building manually
- Get the latest source zip or tarball from the releases page.
- Extract the source somewhere
- Ensure you're using an up-to-date nightly rust. Hexerator is using nightly Rust for the time being.
- Open up a terminal, and change to the directory where you extracted Hexerator.
- Run
cargo build --release
- There will be a hexerator binary built in the
target/release
directory.
If you run into trouble you can't seem to solve, you can ask for help at https://github.com/crumblingstatue/hexerator/discussions.
Ui Overview
Open a file either with a command line argument, or by selecting File->Open...
from the top menu.
You should be greeted with a sight similar to this:
Menu bar
At the top is the menu bar. It contains most actions you can perform. Many actions also have shortcut keys, which are displayed on the right side of the menu buttons.
Views
At the center are the views. Views are the main way you can view and interact with the file you opened. By default, you get 3 views:
- A Hex view, which displays data in a hexadecimal format.
- A Text view, which makes it easier to recognize text.
- A Block view, which can serve as a minimap, or display embedded graphical data.
Interact mode
Hexerator has two interaction modes.
View mode
Press F1
to activate.
This mode is used to navigate around the file in order to discover its contents.
- The arrow keys scroll the active view, letting you navigate around the file.
- You can hold down
left shift
to scroll faster. Page up
andPage down
keys scroll a page's worth of content.Home
andEnd
navigate to the beginning and end of the file respectively.ctrl
+Left
/Right
arrow keys to change the column count of your active perspective.ctrl
+Up
/Down
arrow keys to change the starting offset of your active region.
Edit mode
Press F2
to activate.
This mode is used to edit the file by entering text through the keyboard.
- The arrow keys move the edit cursor.
Inspect panel
The inspect panel provides multiple interpretations of the data the edit cursor or mouse is pointing at. It can be useful in figuring out what type of data we're dealing with.
Meta overview
In order to understand how to use Hexerator, we'll establish some basic concepts.
What is the Meta?
When you open a file with Hexerator, you're opening a raw binary file. The raw binary file itself doesn't dictate how a hex editor should display it, or how to interpret the raw binary data contained within. Instead, it's up to the user to figure out all that stuff. The Meta contains all the information on how to meaningfully interpret and display the data. It can also contain various notes and discoveries made by the user.
Meta components
Regions
Regions are the most basic metadata. They are used to mark regions of the file that are meaningfully different. For example an executable might contain a header, executable code, and data. These could be marked as 3 different regions in Hexerator.
The default region is the entire file.
You can select Meta->Regions
from the top menu, or press F8
to bring up a list of regions, and create
new ones.
In order to create a new region, you first need to make a selection.
Perspectives
Perspectives tell Hexerator how to align the data, by setting the number of columns used to display them. Each perspective has an associated region.
You can press ctrl + Left
and ctrl + Right
arrow keys in View
mode to adjust the column count
for the current perspective.
Additionally, perspectives have a special mode to flip the row order, to display rows upside down. This is useful because sometimes things like images are stored upside down in binary files. Weird, I know.
You can select Perspective->Perspectives
from the top menu, or press F7
to bring up a list of
perspectives, and create new ones.
Views
Views are the windows through which data is viewed and interacted with. Each view has an associated perspective. Views that share the same perspective scroll together. So if the hex view of a perspective is scrolled, the text and block views scroll along with it.
Currently there are 4 basic types of views
- Hex
- Decimal
- Text
- Block
You can right click a view and select View properties...
to look at and change the properties
of a view.
You can also select View->Views
from the top menu, or press F6
to bring up a list of views,
and create new views.
Layouts
Layouts are groups of views that are displayed together. You can create multiple layouts that show different places in the file in different ways.
A layout consists of one or more rows, and each row can contain one or more view. Hexerator will try to lay out the views in a sensible manner, based on the row and column they belong to.
The default layout is a Hex view, a Text view, and a Block view side by side.
You can select View->Layouts
from the top menu, or press F5
to bring up a list of layouts, and
edit the current layout, or add new ones.
Bookmarks
Bookmarks are places of interest in the data at various offsets. They can also additionally be assigned a data type, which allows them to show a handle to the data at their offset, which shows the value and allows it to be edited.
You can select Meta->Bookmarks
from the top menu, or press F9
to show a list of bookmarks, and
add new ones.
You can also right click a location in a view, and select Add bookmark
.
Basic operations
A-B select
Click somewhere in a view to set the cursor to that location.
You can then press shift+1
in View mode to set the A
point of a selection,
and shift+2
to set the B
point of a selection.
Once you have both an A
and a B
point, the selection is the region spanning
A
and B
.
Once you have a selection, you can do various things with it.
- Add a region by right clicking, and selecting
Add region as selection
- Fill using the fill options in the
Edit
menu - Run an external command on the selection using
Edit->External command...
- Unselect with
Esc
Select all
You can select everything in a view with Edit->Select all in view
or Ctrl+A
.
Other operations
Documentation is a work-in-progress. Use the top menu to discover the kinds of things you can do in Hexerator! Also don't be afraid to right-click stuff. Right clicking things might reveal additional operations you can do.
Command line API
Hexerator aims to support a wide variety of use cases, so it exposes a lot of different options.
Here is the help generated by hexerator --help
:
Usage: hexerator [OPTIONS] [FILE]
Arguments:
[FILE] The file to read
Options:
-j, --jump <offset> Jump to offset on startup
--hard-seek <offset> Seek to offset, consider it beginning of the file in the editor
--take <bytes> Read only this many bytes
--read-only Open file as read-only, without writing privileges
--stream Specify source as a streaming source (for example, standard streams). Sets read-only attribute
--recent Open most recently used file
--meta <path> Load this metafile
--version Show version information and exit
--debug Start with debug logging enabled
--spawn-command <command>... Spawn and open memory of a command with arguments (must be last option)
--look-for-proc <name> When spawning a command, open the process list with this filter, rather than selecting a pid
--autoreload [<interval>] Automatically reload the source for the current buffer in millisecond intervals (default:250)
--autoreload-only-visible Only autoreload the data visible in the current layout
--autosave Automatically save if there is an edited region in the file
--layout <name> Open this layout on startup instead of the default
--load-plugin <LOAD_PLUGIN> Load a dynamic library plugin at startup
--new <length> Allocate a new (zero-filled) buffer. Also creates the provided file argument if it doesn't exist
-h, --help Print help
Hexerator design document
Goals
Hexerator is a hex editor aiming to aid in pattern recognition and binary file discovery.
It also aims to be a good and versatile hex editor usable in a large amount of scenarios,
including editing /proc/id/mem
and reading streaming sources, making it usable to read
piped data.
User interface
Perspective
A Perspective
is a view into a Region
with a specific column count
.
A variable column count is very helpful for better recognizing certain patterns in data, and is one of the core features of hexerator. A Perspective
on its own doesn't really do much. To make use of perspectives, there are View
s.
View
A View
is a region on the Viewport
that provides a look into the data presented by a perspective. A view can be one of multiple kinds, like hex, ascii, block (pixel, kind of like a minimap), and it's scrollable, allowing you to explore different parts of a perspective. You can have multiple views on the Viewport
. There is a focused
view that you are currently focused on and scrolling/editing, etc.
By default, all views that share the same perspective sync their scroll offsets with the focused
view. This behavior can be turned off if independent scrolling is desired.
Viewport
The Viewport
is the area in the window where the Views
are laid out.
The other things that take up space in the window are the UI panels and windows.
Concepts
BinData
The BinData
is the raw binary data opened inside hex editor.
It can be opened from a file, or streamed from a streaming source, like a pipe.
Region
A Region
is a slice of the BinData
.
It has a start
offset which determines where it begins,
and an end
offset which determines where it ends.
A Region
can be given a name
to give it an easy to remember
identifier and also help remember what it's about.
It can also have a description
which can give further useful information about it.
Meta
A Meta
is all the metadata about a binary format. It can include things like Region
s and View
s that aid understanding
of a binary format.
Limits
To make development easier, and help keep my sanity, hexerator defines some value limits.
File size
The supported file size is min(usize, i64)
, which is ~4GB on 32 bit platforms,
and practically limitless on 64 bit platforms. 16 bit platforms are not supported.
Resolution and mouse position
These are i16, meaning values higher than 32767 are not supported. The minimum supported resolution is 920x620. The ui is not designed and tested for resolutions lower than that.
Block size
A block, or cell (final name not decided) is the element that displays a value.
Like a hex pair, an ascii character, etc.
The size range is 1..i16::MAX
.
Contributing
Hexerator welcomes contributions!
The repository is on GitHub
There is also a Discussions page that can be used for both help and ideas, as well as general discussion.
See Build from source if you want to contribute code to Hexerator and want to build it from source.