Hexprobe --> what's a hex editor?|
What is a hex editor?
In modern computer system, a collection of related data or
program records is stored in a named file. Thus, a file is merely
a heap of the sized and ordered data to which a computer can access.
A text file is a file that contains information expressed in
text form whose contents are interpreted as printable characters
(usually in the form of words and numbers), plus certain control
characters (carriage return, tab, etc.). It can be viewed and edited
using a "text editor" (see figure below).
A binary file is a file the bytes of which may contain any of
the 256 different possible binary values. Generally, binary files
can be edited only by the application in which they were created.
An application has to know exactly how the data inside the files is
laid out to make use of the file. There are many types of binary
files. Executable files (.EXE, .DLL etc) are binary files.
Database files and even word processor documents are normally
A binary file is a file the bytes of which may contain any of the
256 different possible binary values. Generally, binary files can be
edited only by the application in which they were created. To make use
of the file, an application has to know exactly how the data inside
the files is laid out. There are many types of binary files. Executable
files (.EXE, .DLL, etc.) are binary files. Database files and even word
processor documents are normally binary files.
You need a hex editor for mainly two reasons:
- Analyzing file structure. You can't see the bytes
stored in a file using a regular application to open it. You may
need this knowledge to write an application that will interpret
the contents of the file.
Editing file contents. This also needs to know
exactly the file structure. If you don't know how watermarks are
stored in a MPEG file, you could not do anything about them.
What are the elements of a binary file?
When you have no particular knowledge about the format of a file
and must get command of it, you need a general-service editing tool.
Once you master the format of the file, you can develop a pertinent
software to render the data in the form of text, multimedia, etc.
Thus, a hex editor should be such a tool that is designed by assimilating
how people use their common knowledge about binary files. The followings
are some information about the elements.
Bits, bytes, and hexadecimal system
Modern computers uses binary number system internally. A digit of
a binary number is called a 'bit'. When 8 bits are grouped together, the
result is called a 'byte'. Since a byte has 8 binary bits, it can
represent any value from 0 up to 255 inclusive.
Every file stored on a disk is stored as a set of bytes. Byte is
the elementary unit to represent characters and numerical values that are
fundamental for us to express objective things, make scientific calculation,
and communicate with each other. Thus, byte also is the elementary unit
to think, analyze, and process events.
As a byte oriented tool, a hex editor needs to be based on
hexadecimal system, because it is the best number system to present,
edit and process the raw contents.
Base data type
A file or a block of data consists of many smaller units, they are
data of base types. The base types could be divided into three categories:
"integral", "floating", and "char". Integral types are capable of handling
whole numbers. Floating types are capable of specifying values that may
have fractional parts. Char type usually contains members of the execution
character set, such as: ASCII.
A base data consists of one or more bytes. The following table lists
the amount of storage required for some base types:
|char, unsigned char, signed char ||1 byte |
|short, unsigned short ||2 bytes|
|int, unsigned int ||4 bytes|
|long, unsigned long ||4 bytes|
|float ||4 bytes|
|double ||8 bytes|
Depending on which computing system you use, you will have to
consider the byte order in which multibyte numbers are stored,
particularly when you are reading them from a file or writing them
to a file. The two orders are called "Little Endian" and
These two phrases are derived from "Big End In" and
"Little End In". They refer to the way in which memory is stored.
"Little Endian" means that the low-order byte of the number is
stored in memory at the lowest address, and the high-order byte at
the highest address (The little end comes first). For example,
a 4 byte long integer
Byte3 Byte2 Byte1 Byte0
will be arranged in memory as follows:
Base Address+0 Byte0
Base Address+1 Byte1
Base Address+2 Byte2
Base Address+3 Byte3
Intel processors (those used in PC's) use "Little Endian"
"Big Endian" means that the high-order byte of the number
is stored in memory at the lowest address, and the low-order byte
at the highest address (The big end comes first). Our long integer,
would then be stored as:
Base Address+0 Byte3
Base Address+1 Byte2
Base Address+2 Byte2
Base Address+3 Byte0
Motorola processors (those used in Mac's) use "Big Endian"
What endian order means is that any time numbers are written
to or read from a file, you have to know how the file is supposed
to be constructed. If you write out a graphics file (such as a
Windows BMP file) on a machine with "Big Endian" integers, you must
first reverse the byte order, or a "standard" program to read your
file won't work.
The Windows BMP format, since it was developed on a
"Little Endian" architecture, insists on the "Little Endian" format.
You must write your code this way, regardless of the platform you
Some binary files use block structures where each chunk of data is stored
in a number of fixed-length blocks. As to the fixed-length data blocks, their
external basics are position and size, and they are often stored in a file
continuously, so the data structure array, these blocks as a whole, also has
repeatability as its basic.
What is Hexprobe Hex Editor?
Hexprobe Hex Editor is a general-service data structure analyzer,
it bases on hexadecimal system, and use byte as elementary unit.
Hex Editing Panels
Hexprobe has five panels: a header panel on the top, a bookmark
panel on the left, an address panel on the left-center, a hex-data
panel on the right-center, a char-data panel on the right
(see figure below). All the panels except hex-data panel can be hided.
The panel displays the headers of any other four panels. Among
them, Hex-data Panel uses the byte offsets relative to the
beginning of the line as its header, you can double-click the area
to change the number system.
The panel displays page separators, line-marks,
and data-marks. You can quickly manage bookmarks or position
document data using its shortcut menu. You can also quickly select a
line or multiple lines of data by pressing and dragging your left
mouse in the panel.
The panel displays the address of the byte at the beginning of
the line. You can double-click the area to change the number system.
You can also copy the address at which your mouse points.
This panel displays ASCII value of each file byte. It only
provides the view of printable characters, non-printable characters
are shown with a period character ('.') or with other user-defined
This is the most commonly used panel. It lists hexadecimal
value of each file byte, default is 24 bytes per line, and can be
changed by mouse-dragging. It works in the hex editing mode, shows
the hexadecimal value of each byte as a two character field, supports
to change the presentation properties by application menus or toolbars,
such as: Data Unit, First Line Indent, Line Width,
and so on.
Hexprobe Hex Editor has abstracted two groups of the properties.
By adjusting the properties, it can present many kinds of data
structures. For example, when you view a file, you can adjust
Data Unit, Line Width, you can also give the first line
an indent, which might make some data properties appear and to be aligned
by column. The figure below shows you how to do this on the table
directory entries in a TrueType font file.
Hexprobe includes a Data Watch Tool, which can be used to
view, browse and edit a series of data in context. With the tool,
- Tract the edit point and show some neighborhood bytes.
- Show most basic data types, including IBM floating-point data types.
- Toggle the number system (hexadecimal, decimal, or binary system).
- Change byte-order (Big-Endian or Little-Endian).
- In-place edit and update the value of a data type.
- Show Quick Goto Tool to browse data.
Data can be edited in a hex editor just like a normal text editor.
Hexprobe has a caret that can be moved by clicking with the mouse or
using various keys. Position the caret over the byte you want to
edit and type the value you want to change. When the caret is in
Hex-data Panel, you need to enter byte values in hexadecimal
notation, but when the caret is in Character Panel, you can
enter regular characters.
Most of Hexprobe editing commands require a selection in order
to work. Some of the commands can make a selection based on the current
caret location. The default selection will be the data unit adjacent
to the caret.
Using Hexprobe, you can select byte, unit, line, multiple lines,
a range of data and a column block of data. You can copy, paste, cut,
and overwrite selection. You can do many other special editing works,
including browsing and editing data structures.
Hexprobe Hex Editor contains other advanced tools to help you
work with binary files. For example, you could use a hex-byte vague
find/replace tool to search/replace certain bytes, or compare two
binary files byte by byte. You could edit the bytes of system processes
or disk sectors. You could even use template technology to map a
document with a hierarchical list of simpler data structures that could
be analyzed and edited in a much easier fashion...