4 ms·

HexFiend - A fast and clever open source hex editor for Mac OS X

74 points by coderdude 16y ago

tptacek 16y ago
Sort of old news, I guess, but worth saying: this is one of the 3 most-used tools at Matasano. It's a really excellent piece of code.
- hermanthegerman 16y ago
  Is it better than 0xED ? Don't work that much on the Mac anymore, always found 0xED quite nice.
- iuguy 16y ago
  That's quite interesting, what are the other two? And why specifically a Mac Hex editor?
  - tptacek 16y ago
    We're an all-Mac shop, and HexFiend is the best hex editor on the platform (0xED is more featureful, though... but "lots of features" isn't what I want out of a hex editor).
    - iuguy 16y ago
      Interesting. Is there any particular reason why you went all mac? We run a mix of everything for infrastructure, but it's pretty much 7 on the laptops, VMs for testing from. I also want to know what the two other apps are :)
      - alnayyir 16y ago
        >Interesting. Is there any particular reason why you went all mac? Unix, works well, has some of the nicest apps out there is my guess. (I split most of my work between my Mac and Linux)
- reemrevnivek 16y ago
  I was a little apprehensive of the last release being 7/30/09, and no mention of 10.6, but it looks like it's still under development somewhat - The svn.ridiculousfish.com/HexFiend2/experimental/ branch was last modified two days ago. Is an Intel-only version and an update of the website in the plans somewhere?
- there 16y ago
  did you guys ever modify it?
  - chunkbot 16y ago
    I hope they did; We tried this app, but ended up having to roll our own because of missing features. Of course, we were using it for hex display, not hex editing, so what we came up with was mostly better visualization of binary wire data (specifically, more custom data types than int and float)..
  - tptacek 16y ago
    We've done all sorts of strange things to it over the years; 'yan is planning on embedding it wholesale into one of our projects, so that may be the direction we're going with it.
- Zev 16y ago
  What are the other two tools? Would my guess that another one of them was either otool, class-dump, nm or ld be right?
  - tptacek 16y ago
    IDA and Burp, maybe? Not everyone uses IDA and not on every project. Burp's definitely #1.
    - pvg 16y ago
      What makes Burp stand out? Every time I need something like that I end up downloading 17 free and pay/trial tools, mucking about till one works, mumbling 'God, I'd pay not to have to do that again' and forgetting about it, till next time.
      - tptacek 16y ago
        Burp is basically the industry standard. It's the tool most widely used by professionals on web pentests. I could do a detailed comparison, but it'd be 3-4 years dated; I used a lot of tools back in '06, but haven't looked back since then. The thing that sets Burp apart from (say) Tamper Data in Firefox is the fuzzer (Burp calls it the "intruder"). The free OWASP WebScarab also has a fuzzer, but it's not as good.
wheels 16y ago
I prefer 0xED.app: http://www.suavetech.com/0xed/0xed.html http://www.suavetech.com/0xed/0xed.html
- tptacek 16y ago
  It isn't open source, is it?
  - uxp 16y ago
    No, just free of charge.
wildmXranat 16y ago
I'm not sure if Okteta is available for Mac as well, but it's a beautiful hex editor I use when on linux. WinHex is great on windows. I'll take a look if this might a good choice to use on my mac.
- pipeline_tux 16y ago
  Okteta's beautiful from a user interface perspective, but like most hex editors it fails when trying to deal with large files. There are very few hex editors around that will open files that are larger than the amount of RAM that you have.
js2 16y ago
Ye olde friend, ridiculousfish.com: http://www.google.com/search?q=site:news.ycombinator.com+ridiculousfish.com http://www.google.com/search?q=site:news.ycombinator.com+rid... :-) And couldn't help but notice in the results: http://news.ycombinator.com/item?id=734727 http://news.ycombinator.com/item?id=734727
ridiculous_fish 16y ago
Hi, I'm the author. Thanks for all the kind words! I'm very actively developing Hex Fiend, which is nearing a new release. Some major new features are bookmarks, support for text encodings (including multibyte, though sadly not variable width), support for opening files only readable by root, including device files (after authentication, naturally), and a visual binary diff (a true LCS diff). There's many other miscellaneous improvements and bug fixes, including the longstanding request of preserving the Undo stack after Save, when doing so would not require too much memory. For those unfamiliar with Hex Fiend, the features that set it apart from other hex editors are: - Very deep support for large files. Many other hex editors have some support for large files, but it's easy to get into a situation where they consume all your memory, or do some O(n) blocking operation that hangs the UI. Hex Fiend never does either. - Natural Mac-like editing, including insertion and deletion, smooth scrolling, multiple discontiguous selection, anchored selection, coalesced undo, key bindings, lots more. - It's provided as a framework which is easy to embed in other apps. - It's open source with a permissive BSD style license. Some have asked how Hex Fiend compares to 0xED. Not to pick on anyone, but I'll give some examples that illustrate Hex Fiend's strengths relative to 0xED (and most other hex editors): 1. Open a large file (say 5 GB), overwrite some bytes in the middle, add some bytes to the end, then hit Save. Hex Fiend will appear to save instantly because it makes the changes in-place, while 0xED will require time proportional to the file size as it writes the entire file to disk. 2. Search for some text. 0xED will block the UI until the text is found or the file is exhausted, while Hex Fiend performs the search in the background, including a progress indicator and cancel button. 3. Select everything in the file and choose Edit->Copy. Hex Fiend will do this instantly, while 0xED will require time and space proportional to the file size, as it attempts to read the entire file into memory. Now select all and hit the delete key. Hex Fiend again does this instantly, while 0xED will again try to read the file into memory (to service its Undo stack). Let me know if you have any questions and I'll be happy to answer them in this thread!
- yan 16y ago
  Just wanted to say, thanks so much for HF! Reading source of HF1 (and more recently HF2) taught me more about AppKit than anything else and not to mention a pleasure to use. (I emailed you about writing a data analysis plugin a few years ago to which you replied a very thorough and informative write up. It's still on back burner heh) Also, your blog rocks.
statictype 16y ago
Incidentally, the author was also the one who wrote this delightful piece: http://ridiculousfish.com/blog/archives/2006/05/30/old-age-and-treachery/ http://ridiculousfish.com/blog/archives/2006/05/30/old-age-a...
petercooper 16y ago
I hit "Post to Delicious" on this and noticed I'd already done so on March 28, 2006. The Internet is now officially too big by my reckoning :-)
erkmene 16y ago
If you, like me, wonder about the Windows alternatives; Hexplorer ( http://artemis.wszib.edu.pl/~mdudek/ http://artemis.wszib.edu.pl/~mdudek/ ) is a very nice and capable hex editor for Windows. The only downside is that it chokes on rather big files. Then again, I don't use it daily for my work, so I might be missing some big pros or cons.

74 points by coderdude 16y ago

Sort of old news, I guess, but worth saying: this is one of the 3 most-used tools at Matasano. It's a really excellent piece of code.

hermanthegerman 16y ago
Is it better than 0xED ? Don't work that much on the Mac anymore, always found 0xED quite nice.
iuguy 16y ago
That's quite interesting, what are the other two? And why specifically a Mac Hex editor?
- tptacek 16y ago
  We're an all-Mac shop, and HexFiend is the best hex editor on the platform (0xED is more featureful, though... but "lots of features" isn't what I want out of a hex editor).
  - iuguy 16y ago
    Interesting. Is there any particular reason why you went all mac? We run a mix of everything for infrastructure, but it's pretty much 7 on the laptops, VMs for testing from. I also want to know what the two other apps are :)
    - alnayyir 16y ago
      >Interesting. Is there any particular reason why you went all mac? Unix, works well, has some of the nicest apps out there is my guess. (I split most of my work between my Mac and Linux)
reemrevnivek 16y ago
I was a little apprehensive of the last release being 7/30/09, and no mention of 10.6, but it looks like it's still under development somewhat - The svn.ridiculousfish.com/HexFiend2/experimental/ branch was last modified two days ago. Is an Intel-only version and an update of the website in the plans somewhere?
there 16y ago
did you guys ever modify it?
- chunkbot 16y ago
  I hope they did; We tried this app, but ended up having to roll our own because of missing features. Of course, we were using it for hex display, not hex editing, so what we came up with was mostly better visualization of binary wire data (specifically, more custom data types than int and float)..
- tptacek 16y ago
  We've done all sorts of strange things to it over the years; 'yan is planning on embedding it wholesale into one of our projects, so that may be the direction we're going with it.
Zev 16y ago
What are the other two tools? Would my guess that another one of them was either otool, class-dump, nm or ld be right?
- tptacek 16y ago
  IDA and Burp, maybe? Not everyone uses IDA and not on every project. Burp's definitely #1.
  - pvg 16y ago
    What makes Burp stand out? Every time I need something like that I end up downloading 17 free and pay/trial tools, mucking about till one works, mumbling 'God, I'd pay not to have to do that again' and forgetting about it, till next time.
    - tptacek 16y ago
      Burp is basically the industry standard. It's the tool most widely used by professionals on web pentests. I could do a detailed comparison, but it'd be 3-4 years dated; I used a lot of tools back in '06, but haven't looked back since then. The thing that sets Burp apart from (say) Tamper Data in Firefox is the fuzzer (Burp calls it the "intruder"). The free OWASP WebScarab also has a fuzzer, but it's not as good.

wheels 16y ago

I prefer 0xED.app: http://www.suavetech.com/0xed/0xed.html http://www.suavetech.com/0xed/0xed.html

tptacek 16y ago
It isn't open source, is it?
- uxp 16y ago
  No, just free of charge.

wildmXranat 16y ago

I'm not sure if Okteta is available for Mac as well, but it's a beautiful hex editor I use when on linux. WinHex is great on windows. I'll take a look if this might a good choice to use on my mac.

pipeline_tux 16y ago
Okteta's beautiful from a user interface perspective, but like most hex editors it fails when trying to deal with large files. There are very few hex editors around that will open files that are larger than the amount of RAM that you have.

js2 16y ago

Ye olde friend, ridiculousfish.com: http://www.google.com/search?q=site:news.ycombinator.com+ridiculousfish.com http://www.google.com/search?q=site:news.ycombinator.com+rid... :-) And couldn't help but notice in the results: http://news.ycombinator.com/item?id=734727 http://news.ycombinator.com/item?id=734727

ridiculous_fish 16y ago

Hi, I'm the author. Thanks for all the kind words! I'm very actively developing Hex Fiend, which is nearing a new release. Some major new features are bookmarks, support for text encodings (including multibyte, though sadly not variable width), support for opening files only readable by root, including device files (after authentication, naturally), and a visual binary diff (a true LCS diff). There's many other miscellaneous improvements and bug fixes, including the longstanding request of preserving the Undo stack after Save, when doing so would not require too much memory. For those unfamiliar with Hex Fiend, the features that set it apart from other hex editors are: - Very deep support for large files. Many other hex editors have some support for large files, but it's easy to get into a situation where they consume all your memory, or do some O(n) blocking operation that hangs the UI. Hex Fiend never does either. - Natural Mac-like editing, including insertion and deletion, smooth scrolling, multiple discontiguous selection, anchored selection, coalesced undo, key bindings, lots more. - It's provided as a framework which is easy to embed in other apps. - It's open source with a permissive BSD style license. Some have asked how Hex Fiend compares to 0xED. Not to pick on anyone, but I'll give some examples that illustrate Hex Fiend's strengths relative to 0xED (and most other hex editors): 1. Open a large file (say 5 GB), overwrite some bytes in the middle, add some bytes to the end, then hit Save. Hex Fiend will appear to save instantly because it makes the changes in-place, while 0xED will require time proportional to the file size as it writes the entire file to disk. 2. Search for some text. 0xED will block the UI until the text is found or the file is exhausted, while Hex Fiend performs the search in the background, including a progress indicator and cancel button. 3. Select everything in the file and choose Edit->Copy. Hex Fiend will do this instantly, while 0xED will require time and space proportional to the file size, as it attempts to read the entire file into memory. Now select all and hit the delete key. Hex Fiend again does this instantly, while 0xED will again try to read the file into memory (to service its Undo stack). Let me know if you have any questions and I'll be happy to answer them in this thread!

yan 16y ago
Just wanted to say, thanks so much for HF! Reading source of HF1 (and more recently HF2) taught me more about AppKit than anything else and not to mention a pleasure to use. (I emailed you about writing a data analysis plugin a few years ago to which you replied a very thorough and informative write up. It's still on back burner heh) Also, your blog rocks.

statictype 16y ago

Incidentally, the author was also the one who wrote this delightful piece: http://ridiculousfish.com/blog/archives/2006/05/30/old-age-and-treachery/ http://ridiculousfish.com/blog/archives/2006/05/30/old-age-a...

petercooper 16y ago

I hit "Post to Delicious" on this and noticed I'd already done so on March 28, 2006. The Internet is now officially too big by my reckoning :-)

erkmene 16y ago

If you, like me, wonder about the Windows alternatives; Hexplorer ( http://artemis.wszib.edu.pl/~mdudek/ http://artemis.wszib.edu.pl/~mdudek/ ) is a very nice and capable hex editor for Windows. The only downside is that it chokes on rather big files. Then again, I don't use it daily for my work, so I might be missing some big pros or cons.