What is a Hex Editor?

In modern computer system, a collection of related data or program records is stored in a named file. Thus, a file is merely a heap of the sized and ordered data to which a computer can access.

A text file is a file that contains information expressed in text form whose contents are interpreted as printable characters (usually in the form of words and numbers), plus certain control characters (carriage return, tab, etc.). It can be viewed and edited using a "text editor" (see figure below).

A binary file is a file the bytes of which may contain any of the 256 different possible binary values. Generally, binary files can be edited only by the application in which they were created. An application has to know exactly how the data inside the files is laid out to make use of the file. There are many types of binary files. Executable files (.EXE, .DLL etc) are binary files. Database files and even word processor documents are normally binary files.

A binary file is a file the bytes of which may contain any of the 256 different possible binary values. Generally, binary files can be edited only by the application in which they were created. To make use of the file, an application has to know exactly how the data inside the files is laid out. There are many types of binary files. Executable files (.EXE, .DLL, etc.) are binary files. Database files and even word processor documents are normally binary files.

When you have no particular knowledge about the format of a file and must get command of it, you need a general-service editing tool. Once you master the format of the file, you can develop a pertinent software to render the data in the form of text, multimedia, etc. Thus, a hex editor should be such a tool that is designed by assimilating how people use their common knowledge about binary files. The followings are some information about the elements.

Bits, bytes, and hexadecimal system

Modern computers uses binary number system internally. A digit of a binary number is called a 'bit'. When 8 bits are grouped together, the result is called a 'byte'. Since a byte has 8 binary bits, it can represent any value from 0 up to 255 inclusive.

Every file stored on a disk is stored as a set of bytes. Byte is the elementary unit to represent characters and numerical values that are fundamental for us to express objective things, make scientific calculation, and communicate with each other. Thus, byte also is the elementary unit to think, analyze, and process events.

As a byte oriented tool, a hex editor needs to be based on hexadecimal system, because it is the best number system to present, edit and process the raw contents.

Base data type

A file or a block of data consists of many smaller units, they are data of base types. The base types could be divided into three categories: "integral", "floating", and "char". Integral types are capable of handling whole numbers. Floating types are capable of specifying values that may have fractional parts. Char type usually contains members of the execution character set, such as: ASCII.

A base data consists of one or more bytes. The following table lists the amount of storage required for some base types:

Byte Ordering

Depending on which computing system you use, you will have to consider the byte order in which multibyte numbers are stored, particularly when you are reading them from a file or writing them to a file. The two orders are called "Little Endian" and "Big Endian".

These two phrases are derived from "Big End In" and "Little End In". They refer to the way in which memory is stored. "Little Endian" means that the low-order byte of the number is stored in memory at the lowest address, and the high-order byte at the highest address (The little end comes first). For example, a 4 byte long integer

"Big Endian" means that the high-order byte of the number is stored in memory at the lowest address, and the low-order byte at the highest address (The big end comes first). Our long integer, would then be stored as:

What endian order means is that any time numbers are written to or read from a file, you have to know how the file is supposed to be constructed. If you write out a graphics file (such as a Windows BMP file) on a machine with "Big Endian" integers, you must first reverse the byte order, or a "standard" program to read your file won't work.

The Windows BMP format, since it was developed on a "Little Endian" architecture, insists on the "Little Endian" format. You must write your code this way, regardless of the platform you are using.

Fixed-length structure

Some binary files use block structures where each chunk of data is stored in a number of fixed-length blocks. As to the fixed-length data blocks, their external basics are position and size, and they are often stored in a file continuously, so the data structure array, these blocks as a whole, also has repeatability as its basic.

Hexprobe Hex Editor is a general-service data structure analyzer, it bases on hexadecimal system, and use byte as elementary unit.

Hex Editing Panels

Hexprobe has five panels: a header panel on the top, a bookmark panel on the left, an address panel on the left-center, a hex-data panel on the right-center, a char-data panel on the right (see figure below). All the panels except hex-data panel can be hided.

Header Panel

The panel displays the headers of any other four panels. Among them, Hex-data Panel uses the byte offsets relative to the beginning of the line as its header, you can double-click the area to change the number system.

Mark Panel

The panel displays page separators, line-marks, and data-marks. You can quickly manage bookmarks or position document data using its shortcut menu. You can also quickly select a line or multiple lines of data by pressing and dragging your left mouse in the panel.

Address Panel

The panel displays the address of the byte at the beginning of the line. You can double-click the area to change the number system. You can also copy the address at which your mouse points.

Character Panel

This panel displays ASCII value of each file byte. It only provides the view of printable characters, non-printable characters are shown with a period character ('.') or with other user-defined character.

Hex-data Panel

This is the most commonly used panel. It lists hexadecimal value of each file byte, default is 24 bytes per line, and can be changed by mouse-dragging. It works in the hex editing mode, shows the hexadecimal value of each byte as a two character field, supports to change the presentation properties by application menus or toolbars, such as: Data Unit, First Line Indent, Line Width, and so on.

Presenting Data

Hexprobe Hex Editor has abstracted two groups of the properties. By adjusting the properties, it can present many kinds of data structures. For example, when you view a file, you can adjust Data Unit, Line Width, you can also give the first line an indent, which might make some data properties appear and to be aligned by column. The figure below shows you how to do this on the table directory entries in a TrueType font file.

Interpreting Data

Hexprobe includes a Data Watch Tool, which can be used to view, browse and edit a series of data in context. With the tool, you can:

Editing Data

Data can be edited in a hex editor just like a normal text editor. Hexprobe has a caret that can be moved by clicking with the mouse or using various keys. Position the caret over the byte you want to edit and type the value you want to change. When the caret is in Hex-data Panel, you need to enter byte values in hexadecimal notation, but when the caret is in Character Panel, you can enter regular characters.

Most of Hexprobe editing commands require a selection in order to work. Some of the commands can make a selection based on the current caret location. The default selection will be the data unit adjacent to the caret.

Using Hexprobe, you can select byte, unit, line, multiple lines, a range of data and a column block of data. You can copy, paste, cut, and overwrite selection. You can do many other special editing works, including browsing and editing data structures.

Other Functions

Hexprobe Hex Editor contains other advanced tools to help you work with binary files. For example, you could use a hex-byte vague find/replace tool to search/replace certain bytes, or compare two binary files byte by byte. You could edit the bytes of system processes or disk sectors. You could even use template technology to map a document with a hierarchical list of simpler data structures that could be analyzed and edited in a much easier fashion...