Hextor - Hexadecimal editor and binary data analyzing toolkit

[DigitalWolF 11]

Hextor is a hexadecimal editor with a set of tools for binary data analysis and reverse engineering.
Main features include structure analyzer, disassembler, regex-like search and many more.
https://github.com/digitalw0lf/hextor
 

 

I mostly write it as a tool for my main job tasks, but would be glad if it can be useful for community. Feedback and feature suggestions are welcome.

[Anders Melander 1795]

Impressive! I could have used this when I reverse engineered the pdb file format.

 

I have one suggestion based on a quick look though the source: It seems data is read unbuffered and edits are done directly on the source (file/disk/memory). This is fine as it allows one to edit huge binary files without loading them into memory (which surprisingly is what many other hex editors does). One thing I could wish for would be a mode that cached edits in memory and then allowed those edits to be applied/committed to the source on demand. You could probably implement this with a block cache layer on top of your existing data source layer.

[Attila Kovacs 629]

it must be good, it's dark

[Anders Melander 1795]

3 minutes ago, Attila Kovacs said:

it must be good, it's dark

That's what she said

 

 

Sorry

[DigitalWolF 11]

2 hours ago, Anders Melander said:

Impressive! I could have used this when I reverse engineered the pdb file format.

 

I have one suggestion based on a quick look though the source: It seems data is read unbuffered and edits are done directly on the source (file/disk/memory). This is fine as it allows one to edit huge binary files without loading them into memory (which surprisingly is what many other hex editors does). One thing I could wish for would be a mode that cached edits in memory and then allowed those edits to be applied/committed to the source on demand. You could probably implement this with a block cache layer on top of your existing data source layer.

It uses write buffering of course. It stores all pending changed blocks in memory and writes 'em to disk when you click Save.

If you're interested in sources, TEditedData class keeps a list of changed blocks and combines this blocks with dynamically-loaded data from source when user scrolls through file.

[Anders Melander 1795]

8 minutes ago, DigitalWolF said:

t uses write buffering of course. It stores all pending changed blocks in memory and writes 'em to disk when you click Save.

Excellent. Can't wait to give it a spin.

[limelect 48]

trying to compile d10.2.3 missing components

[zed 14]

Good work!

Edited August 19, 2022 by zed

[Bill Meyer 337]

On 8/18/2022 at 5:39 AM, Anders Melander said:

Impressive! I could have used this when I reverse engineered the pdb file format.

 

There is the suggestion that it may get plug-in support in the future. That would be a great addition. 

(Removed prior content perceived as a hijack.)

Edited August 20, 2022 by Bill Meyer

[Anders Melander 1795]

14 minutes ago, Bill Meyer said:

There is a commercial hex editor which supports plug-ins and has one for PDF.

PDF? Not really the same as "pdb" 🙂

 

Anyway there are plenty of other Hex editors but I think it's bad form to hijack this announcement thread to discuss that.

[David Champion 48]

11 hours ago, Bill Meyer said:

There is a commercial hex editor which supports plug-ins and has one for PDF.

Useful information, but its not the same as Hextor available as open source.

[Bill Meyer 337]

15 hours ago, Anders Melander said:

PDF? Not really the same as "pdb" 🙂

 

Anyway there are plenty of other Hex editors but I think it's bad form to hijack this announcement thread to discuss that.

Indeed, reading too quickly. 😞

That said, there was no intention to hijack. And I see that Hextor's future may include support for plug-ins, which would be a great thing.

[angusj 126]

On 8/18/2022 at 3:50 AM, DigitalWolF said:

Feedback and feature suggestions are welcome.

My first impression is it looks very promising. Thanks for sharing!

1. Semi-urgent request:

Either automatically or manually resize toolbar icons as they are currently unreadably small on high DPI displays.

Suggest SVG icons as they resize very well.

2. Suggestion:

I see support for viewing image files (which makes sense since they can be embedded as resources),

but I would really like to see viewers for file structures (eg PE File format and zip file structures) 

 

 

Edited August 20, 2022 by angusj

[Attila Kovacs 629]

1 hour ago, angusj said:

but I would really like to see viewers for file structures (eg PE File format and zip file structures) 

 

https://kaitai.io/#what-is-it

 

(there is a plugin "kiewtai" on github for hiew)

Edited August 20, 2022 by Attila Kovacs

[DigitalWolF 11]

11 hours ago, angusj said:

but I would really like to see viewers for file structures (eg PE File format and zip file structures) 

Structure viewer is one of the core features of Hextor. Currently, there are 3 example structure descriptions included with Hextor installation (PE executable, BMP and PNG), but you can easily create your own and share them with others.

 

10 hours ago, Attila Kovacs said:

https://kaitai.io/#what-is-it

 

(there is a plugin "kiewtai" on github for hiew)

I saw Kaitai library, but I don't like its structures format. My initial intent was to make structure description format similar to C++ sources, so one can use existing C++ headers (e.g. from WinAPI docs) as a base for creating Hextor DataStruct descriptions.

(btw, maybe I can write a kaitai -> DataStruct convertor to use their library of structures, if their license permits)

[angusj 126]

2 hours ago, DigitalWolF said:

Structure viewer is one of the core features of Hextor.

I found it. I thought opening the structures tab with a PE file loaded might show the structure automatically, but I realise now that I have to click on what's on my PC a very tiny toolbar icon that drops a menu to manually load the the structure definition. That's just fine with me (except for the tiny icon 😜).

Anyhow, thanks again for sharing your work.

Edited August 21, 2022 by angusj

[DigitalWolF 11]

3 hours ago, angusj said:

except for the tiny icon

What DPI and screen scaling do you have?

[timfrost 78]

Looks useful. And the icons can easily be made legible on my 192dpi screen by overriding the high-dpi settings in Explorer properties and telling Windows to scale the application.  What is much more serious is that on my big screen I find the font size of the main address, hex and text displays far too small for my ancient eyes. Is there some simple way to change the font size?

[angusj 126]

11 hours ago, DigitalWolF said:

What DPI and screen scaling do you have?

[DigitalWolF 11]

19 hours ago, timfrost said:

Is there some simple way to change the font size?

Beyond what can be done with "font scaling" in display settings - no.

Added this (and small icons issue) to backlog.