Jump to content
DigitalWolF

Hextor - Hexadecimal editor and binary data analyzing toolkit

Recommended Posts

Hextor is a hexadecimal editor with a set of tools for binary data analysis and reverse engineering.
Main features include structure analyzer, disassembler, regex-like search and many more.
https://github.com/digitalw0lf/hextor
 

Hextor1280x640.thumb.png.de7a92916f67883f0df67533acc35fd8.png

 

I mostly write it as a tool for my main job tasks, but would be glad if it can be useful for community. Feedback and feature suggestions are welcome.

  • Like 5
  • Thanks 6

Share this post


Link to post

Impressive! I could have used this when I reverse engineered the pdb file format.

 

I have one suggestion based on a quick look though the source: It seems data is read unbuffered and edits are done directly on the source (file/disk/memory). This is fine as it allows one to edit huge binary files without loading them into memory (which surprisingly is what many other hex editors does). One thing I could wish for would be a mode that cached edits in memory and then allowed those edits to be applied/committed to the source on demand. You could probably implement this with a block cache layer on top of your existing data source layer.

Share this post


Link to post
2 hours ago, Anders Melander said:

Impressive! I could have used this when I reverse engineered the pdb file format.

 

I have one suggestion based on a quick look though the source: It seems data is read unbuffered and edits are done directly on the source (file/disk/memory). This is fine as it allows one to edit huge binary files without loading them into memory (which surprisingly is what many other hex editors does). One thing I could wish for would be a mode that cached edits in memory and then allowed those edits to be applied/committed to the source on demand. You could probably implement this with a block cache layer on top of your existing data source layer.

It uses write buffering of course. It stores all pending changed blocks in memory and writes 'em to disk when you click Save.

If you're interested in sources, TEditedData class keeps a list of changed blocks and combines this blocks with dynamically-loaded data from source when user scrolls through file.

Share this post


Link to post
8 minutes ago, DigitalWolF said:

t uses write buffering of course. It stores all pending changed blocks in memory and writes 'em to disk when you click Save.

Excellent. Can't wait to give it a spin.

Share this post


Link to post
On 8/18/2022 at 5:39 AM, Anders Melander said:

Impressive! I could have used this when I reverse engineered the pdb file format.

 

There is the suggestion that it may get plug-in support in the future. That would be a great addition. 

(Removed prior content perceived as a hijack.)

Edited by Bill Meyer

Share this post


Link to post
14 minutes ago, Bill Meyer said:

There is a commercial hex editor which supports plug-ins and has one for PDF.

PDF? Not really the same as "pdb" 🙂

 

Anyway there are plenty of other Hex editors but I think it's bad form to hijack this announcement thread to discuss that.

Share this post


Link to post
11 hours ago, Bill Meyer said:

There is a commercial hex editor which supports plug-ins and has one for PDF.

Useful information, but its not the same as Hextor available as open source.

Share this post


Link to post
15 hours ago, Anders Melander said:

PDF? Not really the same as "pdb" 🙂

 

Anyway there are plenty of other Hex editors but I think it's bad form to hijack this announcement thread to discuss that.

Indeed, reading too quickly. 😞

That said, there was no intention to hijack. And I see that Hextor's future may include support for plug-ins, which would be a great thing.

Share this post


Link to post
On 8/18/2022 at 3:50 AM, DigitalWolF said:

Feedback and feature suggestions are welcome.

My first impression is it looks very promising. Thanks for sharing!

1. Semi-urgent request:

Either automatically or manually resize toolbar icons as they are currently unreadably small on high DPI displays.

Suggest SVG icons as they resize very well.

2. Suggestion:

I see support for viewing image files (which makes sense since they can be embedded as resources),

but I would really like to see viewers for file structures (eg PE File format and zip file structures) 

 

 

Edited by angusj

Share this post


Link to post
11 hours ago, angusj said:

but I would really like to see viewers for file structures (eg PE File format and zip file structures) 

Structure viewer is one of the core features of Hextor. Currently, there are 3 example structure descriptions included with Hextor installation (PE executable, BMP and PNG), but you can easily create your own and share them with others.

image.thumb.png.fad39a6a941eb1ae096383f68d674b9d.png

 

10 hours ago, Attila Kovacs said:

https://kaitai.io/#what-is-it

 

(there is a plugin "kiewtai" on github for hiew)

I saw Kaitai library, but I don't like its structures format. My initial intent was to make structure description format similar to C++ sources, so one can use existing C++ headers (e.g. from WinAPI docs) as a base for creating Hextor DataStruct descriptions.

(btw, maybe I can write a kaitai -> DataStruct convertor to use their library of structures, if their license permits)

Share this post


Link to post
2 hours ago, DigitalWolF said:

Structure viewer is one of the core features of Hextor.

I found it. I thought opening the structures tab with a PE file loaded might show the structure automatically, but I realise now that I have to click on what's on my PC a very tiny toolbar icon that drops a menu to manually load the the structure definition. That's just fine with me (except for the tiny icon 😜).

Anyhow, thanks again for sharing your work.

Edited by angusj

Share this post


Link to post

Looks useful. And the icons can easily be made legible on my 192dpi screen by overriding the high-dpi settings in Explorer properties and telling Windows to scale the application.  What is much more serious is that on my big screen I find the font size of the main address, hex and text displays far too small for my ancient eyes. Is there some simple way to change the font size?

Share this post


Link to post
11 hours ago, DigitalWolF said:

What DPI and screen scaling do you have?

display.thumb.png.083198c61acd41a65f77364c17de7f04.png

Share this post


Link to post
19 hours ago, timfrost said:

Is there some simple way to change the font size?

Beyond what can be done with "font scaling" in display settings - no.

Added this (and small icons issue) to backlog.

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×