7 ms·

Rehex – Reverse Engineers' Hex Editor

174 points by app4soft 6y ago

setpatchaddress 6y ago
macOS users should take a look at Hex Fiend for reverse engineering: https://github.com/ridiculousfish/HexFiend https://github.com/ridiculousfish/HexFiend
- EamonnMR 6y ago
  We used to use that in 'production' to clean up CSVs that got exported with a weird byte at the beginning
  - dr_zoidberg 6y ago
    Are you sure that weird byte at the begining is not a Unicode BOM (Byte-Order-Mark)? I've seen a few programs do that (or expect it) and other programs ignore it or go crazy on it.
  - sk5t 6y ago
    Perhaps the weird byte(s?) were a BOM?
  - m000 6y ago
    Why would you need anything more than a sed oneliner in your shell rc? utf8-debom() {local SED=gsed; $SED -i '1s/^\xEF\xBB\xBF//' $@}
- saagarjha 6y ago
  Hex Fiend is a good hex editor but it’s really not the same type of tool as this is.
userbinator 6y ago
Something didn't seem quite right about those hexdumps at first glance; and then I saw the odd numbers in the left and realised it was showing 28 bytes per line instead of the usual 16 or 32. The lack of spaces between bytes also tends to make one want to read the values as BE dords, which they often are not. (Long-time reverse-engineer. My go-to hex editor is still HIEW.)
- solemnwarning 6y ago
  FYI both the byte grouping and bytes per line are are configurable. It fits to the window width by default.
- dbsmith83 6y ago
  I love hiew as well for Windows. Do you know of a tool that is comparable for *nix?
a_t48 6y ago
This is neat, though it doesn't really go deep enough for me. Not being able to specify variable length fields is unfortunate.
- solemnwarning 6y ago
  What do you mean by variable-length fields? Feedback on how to improve it is always welcome!
  - a_t48 6y ago
    Let's say I have a data definition that is some length value and then some number of bytes based on the length value. If I want to load up the same definition for another file (something I guess you also don't support) the length will be wrong if I just manually go forward that many bytes. Sorry, this is a really bad explanation.
    - solemnwarning 6y ago
      Yeah, there isn't support for anything like that yet. I'm planning on having support for Kaitai Struct (and/or other definition languages) in addition to a tool for automating repeating comments/highlights/etc, which might end up being able to do what you describe.
      - a_t48 6y ago
        Yeah that would probably do it
ebeip90 6y ago
I strongly recommend checking out 010 Editor [1]. It's very powerful, lets you display in multiple different formats (not just 1/2/4/8 bytes, but interlaced formats and byte-arrays) and has the most amazing templating / scripting engine I've seen for this type of tool. The only caveat is that it isn't free, but if this is something you do for a living (as I do) it's an indispensable tool for exploring file formats and other binary data sources. [1]: https://www.sweetscape.com/010editor/ https://www.sweetscape.com/010editor/
- mkroman 6y ago
  Yep, same! 010 Editor is one of the few commercial tools that I just have to have a license for - I don't use it to make a living, but I've participated in some CTFs and challenges, and just yesterday I noticed that a WAV file had metadata which I didn't know was a thing, so I just opened it in 010 Editor with the WAV template and I could see how the metadata was stored, and all other fields!
- mockery 6y ago
  Yes! The 010 Editor's templating language is a nearly unique (in my experience) hybrid between C-like declarations and imperative flow that's exactly what I want for parsing arbitrary binary files. The template executes like a script (with conditionals and looping) and a line like "int32 myNum;" is actually just syntactic sugar for "read 4 bytes from the current file pointer and label it myNum." Their example probably does a better job explaining it than I can: struct FILE { struct HEADER { char type[4]; int version; ushort numRecords; } header <bgcolor=cLtGray>; struct RECORD { int employeeId; char name[40]; float salary; if( file.header.version > 1 ) int numChildren; if( file.header.version > 2 ) time_t birthDate; } record[ file.header.numRecords ]; } file; ( From: https://www.sweetscape.com/010editor/templates.html https://www.sweetscape.com/010editor/templates.html )
  - deleted 6y ago
    [deleted]
- 6y ago
mmastrac 6y ago
Thank you! This is awesome. I've been using Hex Fiend on Mac along with Ghidra and I could use a leveled up editor.
cordite 6y ago
This would have been so useful when learning ASN.1..
__s 6y ago
On other hex editors: HxD[1] recently received some updates after years of being dormant HxD is a bit sentimental to me as it's the hex editor I used over a decade ago when figuring out that you could flip one bit at a deterministic position in Game Maker executables to enable the debugger for release builds. A small find, since soon after someone else figured out how to extract the whole source from release builds 1: https://mh-nexus.de/en/hxd/ https://mh-nexus.de/en/hxd/
- GordonS 6y ago
  I've been using HxD for years - would love to see a comparison vs Rehex.
wa2flq 6y ago
Do any of these hex editors handle RADIX50 (RAD50) ?
rendaw 6y ago
So Kaitai Struct (http://kaitai.io/ http://kaitai.io/ - they have a web IDE) isn't a hex editor, but their IDE is what I'd jump to if I had to pull apart a blob of binary data. You define the schema and it automatically turns the data into a labeled tree you can click through without needing to remember offsets or byte patterns or whatever. You can use the schema in a number of programming languages then, and if you wanted to compare files it might be a few more steps but you could export your data as json and get a semantic diff vs "4 bytes changed at offset 1294".
- Kuinox 6y ago
  I tried Kaitai struct, won't recommend it. The yaml based language is awful to use. It doesn't support bit level reading, so you can't do unaligned bit reading, used often in networks packets.
MontagFTB 6y ago
A tool I released years back is in the similar vein. It is mostly intended to be a binary file template specification and analysis tool: https://github.com/binspector/binspector https://github.com/binspector/binspector
ashton314 6y ago
Impressive! Really neat work! I've played a little bit with hexl-mode in Emacs; does anyone know of any extensions/built-in functions that can do some of what's going on here with Rehex?
GordonS 6y ago
If anyone is interested, it is using the C++ library wxWidgets[0] for it's cross platform UI. [0] https://www.wxwidgets.org/ https://www.wxwidgets.org/
- Fnoord 6y ago
  Which doesn't support dark mode (my eyes bleed).
  - sitzkrieg 6y ago
    light themes are actually easier on the eyes but you do you
    - Fnoord 6y ago
      You do you doesn't apply here, cause I can't. In UI, a lack of consistency hurts regardless of whatever preference. Which is why all these toolkits was a mess back in the days. Which is why applications have the ability to follow whatever preference the user set in UI (light, dark, solarized, etc). Ignoring following default choice, a lack of choice for dark mode therefore always hurts dark mode users. While dark mode during day is perfectly fine, light mode during night does not cut it for me. I usually go for dark mode full brightness in day, and half brightness during night (after sundown).
s_gourichon 6y ago
On a related topic, there's this program, not an editor but a binary explorer, which looks somehow relevant to reverse engineering: https://hachoir.readthedocs.io/ https://hachoir.readthedocs.io/ The principe seems very good, like a wireshark for binary files. Not sure how powerful it is in practice. It can browse the hierarchy behind a binary format, down to individual fields (even bits). API offers edition capabilities. It has graphical (wx) and textmode (python-urwid) interfaces. Hachoir is able to open invalid / truncated files. Here are the available commands: hachoir-grep hachoir-metadata hachoir-metadata-csv hachoir-metadata-gtk hachoir-metadata-qt hachoir-strip hachoir-subfile hachoir-urwid hachoir-wx
totolol 6y ago
Hi, you do you use the feature of Disassembly ?

174 points by app4soft 6y ago

macOS users should take a look at Hex Fiend for reverse engineering: https://github.com/ridiculousfish/HexFiend https://github.com/ridiculousfish/HexFiend

EamonnMR 6y ago
We used to use that in 'production' to clean up CSVs that got exported with a weird byte at the beginning
- dr_zoidberg 6y ago
  Are you sure that weird byte at the begining is not a Unicode BOM (Byte-Order-Mark)? I've seen a few programs do that (or expect it) and other programs ignore it or go crazy on it.
- sk5t 6y ago
  Perhaps the weird byte(s?) were a BOM?
- m000 6y ago
  Why would you need anything more than a sed oneliner in your shell rc? utf8-debom() {local SED=gsed; $SED -i '1s/^\xEF\xBB\xBF//' $@}
saagarjha 6y ago
Hex Fiend is a good hex editor but it’s really not the same type of tool as this is.

userbinator 6y ago

Something didn't seem quite right about those hexdumps at first glance; and then I saw the odd numbers in the left and realised it was showing 28 bytes per line instead of the usual 16 or 32. The lack of spaces between bytes also tends to make one want to read the values as BE dords, which they often are not. (Long-time reverse-engineer. My go-to hex editor is still HIEW.)

solemnwarning 6y ago
FYI both the byte grouping and bytes per line are are configurable. It fits to the window width by default.
dbsmith83 6y ago
I love hiew as well for Windows. Do you know of a tool that is comparable for *nix?

a_t48 6y ago

This is neat, though it doesn't really go deep enough for me. Not being able to specify variable length fields is unfortunate.

solemnwarning 6y ago
What do you mean by variable-length fields? Feedback on how to improve it is always welcome!
- a_t48 6y ago
  Let's say I have a data definition that is some length value and then some number of bytes based on the length value. If I want to load up the same definition for another file (something I guess you also don't support) the length will be wrong if I just manually go forward that many bytes. Sorry, this is a really bad explanation.
  - solemnwarning 6y ago
    Yeah, there isn't support for anything like that yet. I'm planning on having support for Kaitai Struct (and/or other definition languages) in addition to a tool for automating repeating comments/highlights/etc, which might end up being able to do what you describe.
    - a_t48 6y ago
      Yeah that would probably do it

ebeip90 6y ago

I strongly recommend checking out 010 Editor [1]. It's very powerful, lets you display in multiple different formats (not just 1/2/4/8 bytes, but interlaced formats and byte-arrays) and has the most amazing templating / scripting engine I've seen for this type of tool. The only caveat is that it isn't free, but if this is something you do for a living (as I do) it's an indispensable tool for exploring file formats and other binary data sources. [1]: https://www.sweetscape.com/010editor/ https://www.sweetscape.com/010editor/

mkroman 6y ago
Yep, same! 010 Editor is one of the few commercial tools that I just have to have a license for - I don't use it to make a living, but I've participated in some CTFs and challenges, and just yesterday I noticed that a WAV file had metadata which I didn't know was a thing, so I just opened it in 010 Editor with the WAV template and I could see how the metadata was stored, and all other fields!
mockery 6y ago
Yes! The 010 Editor's templating language is a nearly unique (in my experience) hybrid between C-like declarations and imperative flow that's exactly what I want for parsing arbitrary binary files. The template executes like a script (with conditionals and looping) and a line like "int32 myNum;" is actually just syntactic sugar for "read 4 bytes from the current file pointer and label it myNum." Their example probably does a better job explaining it than I can: struct FILE { struct HEADER { char type[4]; int version; ushort numRecords; } header <bgcolor=cLtGray>; struct RECORD { int employeeId; char name[40]; float salary; if( file.header.version > 1 ) int numChildren; if( file.header.version > 2 ) time_t birthDate; } record[ file.header.numRecords ]; } file; ( From: https://www.sweetscape.com/010editor/templates.html https://www.sweetscape.com/010editor/templates.html )
- deleted 6y ago
  [deleted]
6y ago

mmastrac 6y ago

Thank you! This is awesome. I've been using Hex Fiend on Mac along with Ghidra and I could use a leveled up editor.

cordite 6y ago

This would have been so useful when learning ASN.1..

__s 6y ago

On other hex editors: HxD[1] recently received some updates after years of being dormant HxD is a bit sentimental to me as it's the hex editor I used over a decade ago when figuring out that you could flip one bit at a deterministic position in Game Maker executables to enable the debugger for release builds. A small find, since soon after someone else figured out how to extract the whole source from release builds 1: https://mh-nexus.de/en/hxd/ https://mh-nexus.de/en/hxd/

GordonS 6y ago
I've been using HxD for years - would love to see a comparison vs Rehex.

wa2flq 6y ago

Do any of these hex editors handle RADIX50 (RAD50) ?

rendaw 6y ago

So Kaitai Struct (http://kaitai.io/ http://kaitai.io/ - they have a web IDE) isn't a hex editor, but their IDE is what I'd jump to if I had to pull apart a blob of binary data. You define the schema and it automatically turns the data into a labeled tree you can click through without needing to remember offsets or byte patterns or whatever. You can use the schema in a number of programming languages then, and if you wanted to compare files it might be a few more steps but you could export your data as json and get a semantic diff vs "4 bytes changed at offset 1294".

Kuinox 6y ago
I tried Kaitai struct, won't recommend it. The yaml based language is awful to use. It doesn't support bit level reading, so you can't do unaligned bit reading, used often in networks packets.

MontagFTB 6y ago

A tool I released years back is in the similar vein. It is mostly intended to be a binary file template specification and analysis tool: https://github.com/binspector/binspector https://github.com/binspector/binspector

ashton314 6y ago

Impressive! Really neat work! I've played a little bit with hexl-mode in Emacs; does anyone know of any extensions/built-in functions that can do some of what's going on here with Rehex?

GordonS 6y ago

If anyone is interested, it is using the C++ library wxWidgets[0] for it's cross platform UI. [0] https://www.wxwidgets.org/ https://www.wxwidgets.org/

Fnoord 6y ago
Which doesn't support dark mode (my eyes bleed).
- sitzkrieg 6y ago
  light themes are actually easier on the eyes but you do you
  - Fnoord 6y ago
    You do you doesn't apply here, cause I can't. In UI, a lack of consistency hurts regardless of whatever preference. Which is why all these toolkits was a mess back in the days. Which is why applications have the ability to follow whatever preference the user set in UI (light, dark, solarized, etc). Ignoring following default choice, a lack of choice for dark mode therefore always hurts dark mode users. While dark mode during day is perfectly fine, light mode during night does not cut it for me. I usually go for dark mode full brightness in day, and half brightness during night (after sundown).

s_gourichon 6y ago

On a related topic, there's this program, not an editor but a binary explorer, which looks somehow relevant to reverse engineering: https://hachoir.readthedocs.io/ https://hachoir.readthedocs.io/ The principe seems very good, like a wireshark for binary files. Not sure how powerful it is in practice. It can browse the hierarchy behind a binary format, down to individual fields (even bits). API offers edition capabilities. It has graphical (wx) and textmode (python-urwid) interfaces. Hachoir is able to open invalid / truncated files. Here are the available commands: hachoir-grep hachoir-metadata hachoir-metadata-csv hachoir-metadata-gtk hachoir-metadata-qt hachoir-strip hachoir-subfile hachoir-urwid hachoir-wx

totolol 6y ago

Hi, you do you use the feature of Disassembly ?