Hex Editor For Reverse Engineering
The process of reverse engineering is accomplished by making use of some tools that are categorized into debuggers or disassemblers, hex editors, monitoring and decompile tools: Disassemblers – A disassembler is used to convert binary code into assembly code and also used to extract strings, imported and exported functions, libraries etc. You may wish to use hexadecimal when debugging a program or to reverse engineer a program. So, the Xxd command is very useful if you deal with binary content, if you want to see some binary files or to reverse engineer. HexEdit Hex Editor. Another Hex Editor used to edit binary data is the HexEdit Hex Editor.
We all know that computers and digital machines work on binary digit principle. This is a language which is understandable but computing devices and consists of only two digits 0 and 1. Various combinations give different words that we humans can understand. Like binary code to show “a” on screen is 01000100. Well, now the library of the words is this vast that these binary digits arrange themselves and forms Hexadecimal digits. These digits are all over our device and are operating at each click, each word or anything we do on the computer or any digital device. To edit these codes, some softwares are made, and those are called Hex editors. These software are high-end softwares and are used by professionals. One can change the code of showing “a” using these software and pretty much, alter the whole operating system with it. The person must have a vast knowledge of Binary units to operate in the software. A list of free Hex editing software is provided from which you can choose whichever suits you the best. However, some of the software only come in a trial version for free and are purchasable later for full functionality.
1. Free Hex Editor Neo
The Free Hex Editor Neo is created by HDD software and is loaded with many features with a powerful engine. It can compile data of multi Giga-bytes in seconds, and the accuracy is mesmerizing. It readily supports Windows and is used by most professional reverse engineers. In the freemium version, you can Type, Cut, Paste, Copy, Insert, Delete, Fill, Import and Export and even try some advanced function for your ease. This Hexadecimal software will blow your mind in terms of power, and the company says it has no competitor in the market for its speed. Try it for free.
2. PSPad
PSPad is a very versatile hexadecimal text editor which is loaded with features. The software was made and published in 2001 and is still improving and adding new features by updates. The software is rivaling the market and comes in the top list. The software provides you with many features like full HEX editor, Support for Unicode, ANSI, ISO, OEM, Auto Correction, Spell checking, Undo-Redo Operations and Unlimited length. The editor is available in two formats: as a setup file (installer) and a portable version (zip archive). You can download it free from the provided website and use it directly after installation.
3. HxD
HXD is a high-quality freeware Hex editing software which is very dependable in terms of quality. The software is loaded with feature and makes it easier for the user to create and edit text files. Features like searching and replacing, exporting, check sums/digests, insertion of byte patterns, a file shredder, concatenation or splitting of files, statistics and many more help you get your work done efficiently. It has unlimited support for length and it can open a file of any size larger than large.
4. Hex Workshop
Hex Workshop is software by Breakpoint software which provides you with lots of Hex editing tools and readily supports Windows. The company keeps improving the software and it is already in a shape in which any user can use it without any trouble. Reverse engineering of software is very complicated and must be pinpoint accurate to provide results; this software helps you achieve that landmark and gets you project to be completed successfully in time with accuracy. The features of this software are very vast, and you can see a list of them on the official website.
5. Free Hex Editor (frehed)
Frhed – free hex editor is an open-source binary file editor which supports only previous version Windows like Windows 95/98/Nt4.It is a 100% free Hex Editor and good in quality relatively. Features include Cut and Paste (for Binary and text data), find and replace (binary and/or text), file comparison, customizable colours and font (ANSI or OEM display), bookmarking and some more. Thus, it is a basic software which goes straight for the binary related work and no other functionalities to alter the text.
Hex Editors Free
6. UltrEdit
UltrEdit is a top rated text editing software which can pretty much open any text format file. Editing Hexadecimal is also available in this software, and with its broad library of functions, it becomes easy to edit Hex text and compile it. The software is unmatched in terms of text editing and is offering a free trial version with many essential functions, which can be later purchased. It’s some features are: Easily open and edit large files – 4 GB and beyond, Multi-caret editing and multi-select, Code syntax highlighting for nearly any programming language, Auto-closing XML/HTML tags, File and data sorting and many more.
Before I start this article, I need to define a couple of terms:
- Byte – This is a data type which can store 256 discrete variations. Typically its said to have a minimum value of 0 and a maximum value of 255 (thus 256 variations including the 0). All files can be considered to just be a series of bytes.
- Hex or Hexadecimal – Unlike a decimal or base 10 number which only allows 10 different variations per digit and must include a another digit to include numbers which exceed that range (e.g. 8, 9, 10, 11 / 98, 99, 100, 101) a hexadecimal number stores 16 variations. After 9, the first six letters of the alphabet are used (e.g. 8, 9, A, B, C, D, E, F, 10 , 11 / FE, FF, 100, 101) .
All files are divided into two categories – plain text and binary.
Plain text files as the name suggests just contains text. They cannot contain images, sound, video or any form of text styling unless they mark it up. Examples of these files include .txt, .ini, .csv, .html, .php. These files can be opened in your system’s default plain text editor such as Notepad on Windows and will load and display fine.
Plain text files load and display fine in plain text editors
Binary files however can store a much wider range of data. Your camera photos, mp3s and videos are all binary files. Rather than limit the data storage to just text, binary files can make use of a larger range of encoding which means that we can’t view these files properly in a plain text editor. This is shown in the image below, in which I’ve tried to load a bitmap image into Notepad.
By contrast, loading a binary file in a plain text editor is not a good idea
So to view and edit binary files, we clearly need a different tool. If we know the file format then we could load the file into the relevant editor, loading images into Photoshop or Paint for example. But this is no good to us if we don’t know the file format, if there isn’t a relevant editor yet or if we want to examine the internal data structure.
Hex Editors can display and edit binary data in a very helpful and effective way. They are not limited to text characters and can be used to display and edit the full range of variations in each byte. Unlike text editors which display binary data badly and don’t support changing the value of non text data, hex editors are not hindered by these problems.
My personal favourite free hex editor is XVI32 which can be downloaded for free on Windows. It’s quite a lightweight and functional hex editor and while there are many hex editors out there offering a greater range of features, I like the simplicity and straightforwardness of XVI32.
In the above screen shot we can see three columns. The left and thin column is the line number displayed in hex. The number shown represents the index or offset of the first entry on that line, for example B means 11 as a decimal and if you count across the boxes in either of the other two columns you’ll see that they are also 11 boxes across. These line groupings do not exist in the actual file, this is merely just how its displayed in the editor, a bit like word wrapping text.
The middle column displays the hexadecimal view of the file, while the right column shows a ASCII or text view of the file. Each box in the hex and text views represents a byte in the file.
So why is hex useful? Why not represent the values of each byte as a decimal?
Hexadecimal numbers have the useful property that with two digits they can represent 256 discrete variations, just like a byte. So rather than use 3 digits to represent the value of each byte, we can use two digits to their full range. The minimum hex value for a byte is 0 (or 00) and the maximum hex value for a byte is FF.
To convert between decimal and hexadecimal you can use the built in calculator on Windows (or use a site like this). Depending on your version of Windows you may need to change to either scientific or programmer mode before the hex and decimal options are available. To convert a number, type it into one mode then select the other mode. For example:
In the next post, I’ll explore how to use a hex editor and look at some common data types. Before reading that post however, it would be useful to try opening a few different file types in a hex editor just to get a feel for it. It would also be very helpful to try converting a few different numbers between hex and dec.
Imagine.. you have a binary file and don't know its contents. Or some software creates binary files you have a specification for but don't want to decode them manually.
Have you ever looked at hex dumps and felt how hard it is to make sense of it? And to remember the meaning of all the bits and bytes?
Synalyze It! allows you to create a “grammar“ for your binary files interactively. Unlike in regular hex editors or viewers the files are interpreted automatically for you! Analysis of binary files has never been easier.
Additionally Synalyze It! is a full-featured Hex Editor for Mac OS X allowing you to edit files of unlimited size and interpret the bytes with dozens of text encodings.
Essentially it’s a modeling tool for arbitrary file formats that is being used by software developers and data stream experts as well as in computer forensics.
The grammars are stored as XML files and contain all the structures that may occur in a file of a certain format, just like XML schemas. It’s even possible to inherit structures from others (like in OO languages) so you don't have to repeat for example a length field that appears at the beginning of each structure.
Synalyze It! is an extremely flexible and useful tool for viewing binary file data. It enables you to easily apply a structured format to your file bytes and convert them into meaningful displays of data.
Synalyze It! provides formatters for common binary types like ICC, PNG, TIFF, WAV, ZIP and dozens more. That alone is useful but, if you’re a programmer creating a custom binary file format, Synalyze It! is priceless.
With Synalyze It!, you can create custom data formatters for your personal binary files. Instead of struggling with cryptic lines of hexadecimal, you can view and label data values as floating point or integer, signed or unsigned, with any byte length. Your files can even modify the formatting, allowing you to create settings on the fly to variably view your data.
If the standard formatting tools are not enough, you can write formatting scripts using Python or Lua. I quickly got ambitious and was soon in over my head exploring Synalyze It!’s features. When I emailed a question to the developer, the technical support was outstanding. I was sent a complete solution to my problem that also served as an advanced Synalyze It! tutorial.
I doubt that I will ever fully exploit the potential of Synalyze It! but the value I’ve received is already many multiples of the price I paid.
John Goodman
For some well-known formats you can download grammars here. Matching grammars are suggested automatically when you open a file.
Right now you can download Synalyze It! for Mac OS X and give it a try. In case of questions or problems please give me feedback. The latest changes can be tracked here; stay tuned also on Twitter.
If you like Synalyze It! consider buying the Pro version in the Mac App Store.
The Pro version has even more useful features beyond hex editing.
Hi,
I just bought the pro version of Synalyze, and I am very glad I did. Thank you for taking the time to bring this excellent tool to life.
I’m the author of an open-source program called SleepyHead, which is used for reviewing CPAP machine data (used in Sleep Apnea treatment), and already I’m wishing I discovered Synalyze a lot sooner, as an awful lot of binary format hacking is involved thanks to the manufacturers not releasing documentation.
I particularly like being able to use expressions in the length fields. I spent ages looking through the example grammar and scripts only to find I didn’t even need them thanks to this feature. (It pays to read the manual first. ;)
Keep up the good work!
Regards
Mark Watkins
Mac Hex Editor for Professionals
There are some hex editors for Mac available but only Synalyze It! allows to create a grammar for automatic file decoding in a specialized grammar editor.
- Simply open the file you want to analyze
- Create an empty grammar
- Select bytes in the hex editor and add an element or structure to the grammar using the context menu
- Enhance the grammar in the grammar editor
Other special features of Synalyze It!:
- Supports various encodings like ASCII, EBCDIC, UTF-8 or UTF-16 (see ICU for all supported encodings)
- Lets you easily see if a file is compressed with the histogram view
- Opens even huge files ultra fast by loading only the visible part of a file
- Hex editing works with the same mouse and keyboard commands like in common text editors
In case you need a tool specialized in disk editing, I recommend to check out iBored.
Gif&039 ted 1 1 30.
Recent updates:
2020-01-05: Added grammar for Commander Keen 1-3 saved games
2019-09-13: Version 1.23 released with dark mode support
2019-05-16: Added grammar for Ducati Data Analyzer dda files (thank you, Jack!)
2019-02-17: Added grammar for Atari Lynx .lnx files (thank you, Brian!)
2019-02-14: Added grammar for uImage files on Linux (thank you, Lukas!)
Hex Editor For Reverse Engineering Programs
Older additions to the web site can be found here…
