10 ms·
Imhex: A hex editor for reverse engineers
- ykonstant 2y agoWhelp, I tried my best to install imhex into my arch system with no success; the AUR packages fail to build and the -bin crashes with a glfw error. The AppImage runs but doesn't save settings after exit. This sucks, because it seems like a very nice project.
- special-K 2y agoShould be fixed with 1.35.3 now. There was a permissions issue leading to config folders not being created.
- kul_ 2y agoReminds of the old days, when reverse engineering game binaries were a thing. Finding hex strings, no-op'ing if conditions, adding jmp instructions. Many heroes forgotten with time as more and more of software onboarded the cloud offerings. I wonder how much of it is still relevant and in what fields?
- z3phyr 2y agoI really like this area of computer culture. RE, writing kernel modules, figuring out how stuff works and making stuff do what it was not designed to do aspects. However, legal avenues to do so are far in between and it requires a huge amount of time and help from peers.
- exe34 2y agoare there illegal schools teaching kernel module writing?
- Retr0id 2y agoYes. A silly example I encountered just yesterday, looking for usermodehelper invocation examples: https://gist.github.com/muratdemirtas/31b46c459c9c2e285ed71b159a89480c https://gist.github.com/muratdemirtas/31b46c459c9c2e285ed71b... Commenter asks: > also, question: Why is it called linux_keylogger?
- exe34 2y agoi don't see how that's illegal - it's only a crime if you install it on somebody's computer to steal their information. knives aren't illegal.
- Retr0id 2y agoYes, it's not literally illegal, otherwise Microsoft would be in even more trouble. I just thought it was amusing. (but also, carrying sensibly sized knife is illegal where I live)
- no_time 2y agoYou don't need a project to be "legal" to have some fun :) Publish under a pseudonym with no links to your real identity, use dedicated communities that disregard DMCA takedowns. As long as you don't want to earn money this way, the worst that will happen is that your target notices your work and deploys vmprotect on their releases.
- poincaredisk 2y ago>However, legal avenues to do so are far in between and it requires a huge amount of time and help from peers. I reverse engineer things for a living and I have many peers worldwide who do the same. My main field of work is malware analysis. For recreation, in my country it's explicitly legal to reverse engineer things you own, with a purpose of making it work on your system (think: fixing a windows XP game so it works on windows 10). This is a very broad loophole, and let's you reverse engineer things in most cases when they "feel" like they should be legal.
- Arech 2y agoCan you please share more details about the loophole you've mentioned?
- 8372049 2y agoThis applies to the entire EEA, fortunately!
- Arech 2y agoCan you maybe share more details, where I can read about this? Thanks!
- cess11 2y agoReversing for the purpose of integrations is commonly also legal.
- Arech 2y agoCan you please also share more details, where I can read about this? Thanks!
- LocalH 2y agoIf you've never done at least a tiny bit of "illegal" RE, are you even a true hacker? ;)
- kstrauser 2y agoFile formats are great fun to RE. I worked at a place that used a proprietary business management app. One day I was bored and started looking at its data files with a hex editor and saw some patterns like the titles of records in the app were spaced at exact multiples of X bytes apart on the data file. Oh! Fixed width records! Huh, look at that: right after the title, the next two bytes look like the hex value of the record number show in the app. Guess that's how it stores those! If I click this checkbox, this one byte changes from 0x00 to 0x01. Hey there! After enough experimentation I had the whole thing mapped to structs in code and was able to build reports that the original app couldn't support. There wasn't anything illegal about that. I'm sure the vendor would've preferred we pay them to make reports for us but nothing legally prevented it.
- sadops 2y agoJust don't publish it, and you can kinda do whatever. Remember, just because you build or learn something doesn't mean you have to broadcast it. Edification can be its own reward.
- wkat4242 2y agoIt's publishing what you've learned not ok?
- 0xDEADFED5 2y agoLooks good! I usually stick to 010 Editor for it's wildcard search, but ImHex does that and more, I'm sold. Will be testing it out a bit more
- 0xFEE1DEAD 2y agowhat're the odds of two dead 0x users showing up at the same time in a thread previously without comments. gave me a chuckle
- jolj 2y agoa thread about a hex editor? kinda high
- 0xFEE1DEAD 2y agoThis seems interesting and is coincidentally exactly what I need right now. My trusty file, strings, hexdump and xxd all failed me. I was going to use ghidra, but it's quite the beast and I haven't had any time to learn it yet. Gonna give this a try tonight.
- nneonneo 2y agoWhat do you need Ghidra for? Ghidra is, for the most part, not a hex editor. It’s meant for reverse engineering - mainly decompilation, but it’s useful for patching as well. The debugger is new and takes some getting used to (I’m still using GDB + Ghidra), but the disassembler and decompiler are top-notch.
- tsujamin 2y agoIt’s also useful for defining data structures and carving them up, which (for me) is the role now filled by ImHex. If HexFiend/xxd are at one end of the spectrum, ghidra at the other, I imagine ImHex and tools like Kaitai are in the middle
- nneonneo 2y agoHex Fiend does data structures and file formats now too, using parsers written in TCL. I’d probably rate Hex Fiend as being in the middle too, especially if you’re going to put xxd at the low end :) Personally, for file format parsing I like to use Hachoir (specifically Hachoir-wx for GUI file structure browsing), which is a somewhat obscure bit of software that I’ve made some contributions to.
- tsujamin 2y agoHuh interesting, thanks for the recs!
- ithkuil 2y agoUsername checks out
- nneonneo 2y agoI tried ImHex…found it way too complex for most of what I wanted to do. I’m still a huge fan of Hex Fiend on macOS - simple, fast, does what I want. I still haven’t found the perfect “simple” hex editor on Windows.
- nine_k 2y agoHave you tried Hiew?
- nneonneo 2y agoNo, hadn’t heard about it. Seems interesting, sort of “vim for hex” like. I might give it a spin.
- andrewshadura 2y agoActually ncedit for hex.
- SomeoneFromCA 2y agoYou must be from ex-USSR.
- MontagFTB 2y ago+1 for HexFiend. Their template format is straightforward to extend. I’ve used it to analyze many different file formats. I also tried ImHex briefly. I have a ton of respect for the project, but found for my needs it was like using a cannon to kill a housefly.
- deleted 2y ago[deleted]
- s1gsegv 2y agoInteresting, I find HxD on Windows to be the absolute peak of hex editors with no real parallels on macOS or Linux. Which is a shame because I never use Windows. Hex Fiend for instance is my hex editor on macOS, but why does it insist on reflowing the lines when I expand the window? I might just want to work with it maximized to avoid visual distractions, but I still only want lines to be 16 or 32 bytes long, and definitely not some weird size that will make things not line up.
- noname120 2y agoI will stick to 010 Editor for now[1], it's the most amazing hex editor I've tried in my life. I'm not fond at all of the GUI framework (Dear ImGui) that this new projects uses. It's meant for embedded systems with tiny screens and no window manager, not full-fledged desktop environments where the small elements and the complete lack of UI integration makes for a very awkward experience. [1] https://www.sweetscape.com/010editor/ https://www.sweetscape.com/010editor/
- carrja99 2y agoGave me a flashback to my middle school days when I used a hex editor to modify my saved game files.
- mahoro 2y agoThis is an absolutely great project. I had a lot of fun tinkering with the ROM of my Philips smart clock. It has a built-in DSL that looks like Rust (without memory management, though – so it's very lightweight), and with that, it's possible to visualize and extract structural data from binary streams. That's really fun and cool. It also has a visual editor to make simple calculations with no code. It didn't feel polished at the time I tried it. Strangely, writing code in DSL was more intuitive and easier for me.
- alex_suzuki 2y agoCool, a bit like Wireshark protocol dissectors then?
- jchw 2y agoThere's, unfortunately, a million similar implementations for this basic concept. 010 Binary Templates, Hex Workshop structures, Okteta structures, Kaitai Struct Definitions. Heck, I made my own Go struct tag DSL that does this, before I realized just how many times it had already been done before. The thing that's complicated of course, is that while it is a good idea and the basic idea is incredibly similar across implementations, there are just enough different concerns to make it hard to have one universal standard that can cover all of the use cases. It's hard enough to have a single parsing framework that handles both text parsing and binary format parsing well, but you also would need to consider the ability to incrementally parse/stream, read/write support, support arbitrary transformations, some formats need pointers, offsets, indices, and of course to what degree such a descriptor should be declarative versus imperative (declarative is better, but it gets increasingly hard to capture all details entirely in a purely declarative manner.)
- marlin 2y ago^ Insightful! I too have been working in this space for a while. Then I found out about kaitai stuct, lost some steam but regrouped. I do have some novel ideas and my dsl is less verbose than theirs :) I have a DSL in go with cli tooling at https://github.com/martinlindhe/feng/ https://github.com/martinlindhe/feng/
- ykonstant 2y agoDoes this editor have a way to display the ASCII bytes in CP437 glyphs? I grew up reading binary files in DOS that way and I can read the glyphs much faster than the corresponding hex values; in contrast, using dots for the non-printable characters doesn't really tell me much.
- Simran-B 2y agoYou can download additional assets in the settings and then interpret data as encoded in various formats. I don't see CP437 in the list but the file format for encodings is straightforward, you can probably create a mapping easily. https://github.com/WerWolv/ImHex-Patterns/tree/master/encodings https://github.com/WerWolv/ImHex-Patterns/tree/master/encodi...
- Dwedit 2y agoThe problem with CP437 is that FF, 00, and 20 are all empty space and look the same. Then there's the question about that ambiguous character that's either German Sharp S or Beta.
- ykonstant 2y agoI break ties by using ๐ for NULL which declutters output with lots of null bytes, and ⍽ for non-breaking space because I saw the glyph on Wikipedia.
- stavros 2y agoI will fight anyone who claims that a beta and an eszett look the same.
- teddyh 2y agoThey’re talking about CP473 character 225, (hexadecimal E1), which resembles both β and ß (depending on the exact font), and was frequently used as a stand-in for both.
- 2y ago
- j16sdiz 2y ago> people who value their retinas when working at 3 AM. You just need a well lit room to use light mode.
- Stratoscope 2y agoAgreed, and also turn down your monitor brightness if needed so the light background matches a piece of paper on your desk. No one complains that reading something on paper burns out your retinas. A light mode shouldn't either. I always assumed that ImHex only supported dark mode, but it turns out that it does support light mode too!
- wkat4242 2y ago> No one complains that reading something on paper burns out your retinas. A light mode shouldn't either. The problem is that modern monitors are optimised for max brightness, not minimum. On my monitor I work on 0% brightness during the day. More is too bright already. During the night I turn down the contrast for lack of other options. That screws up colour depth though. Dark mode helps a ton too. A monitor that could display accurate colours at low brightness would be amazing but nobody cares enough to make one.
- Stratoscope 2y agoExcellent point. Of course it will vary with different monitors. I have a pair of LG 24UD58-B 4K 24" monitors mounted on monitor arms: https://www.amazon.com/dp/B01LPNKFK0/ https://www.amazon.com/dp/B01LPNKFK0/ One is above my ThinkPad P1 or X1 Extreme in landscape mode, the other to the left in portrait mode. I use all three displays. I calibrated all three displays with an X-Rite (now Calibrite) Display Pro using DisplayCAL software. For the two external monitors, the calibrator came up with these settings: Brightness: 27 Contrast: 70 Gamma: Gamma 1 The specific RGB settings are slightly different between the two. One is: Red: 56 Green: 43 Blue: 40 And the other: Red: 39 Green: 42 Blue: 42 This settings make light modes very comfortable on both monitors, either during the day or at night with the room lights on. They are on a dimmer so I can adjust the lighting for comfort. For photo editing or watching a video, I crank up the brightness on the landscape monitor to 85. I do something similar on my phone, a Samsung S24 Ultra. I use light themes and turn the phone brightness way down so it matches these other displays - unless I'm out in the sun and then I turn it way up. I also turn up the brightness near max to look at photos or watch videos. Because of this, YouTube is the one app where I use a dark theme. This works well with the increased brightness.
- aquova 2y agoNot to be confused with the Reverse Engineer's Hex Editor, rehex https://github.com/solemnwarning/rehex https://github.com/solemnwarning/rehex
- _xerces_ 2y agoIt is hard to find the link for Windows download, most people (especially us dumb Windows users) want to find a link and download, not scroll a bunch then go to another page then scroll some more and make a decision about which one of 20 links they need. It is not that hard, especially for most people on HN but it does add friction to people trying your software. This is a very common thing with other projects so not just picking on this one. Finally, when it does load on my Windows machine (using MSI installer and after convincing Microsoft that it is safe to run and bypassing their warning) it loads up super tiny on my 4k laptop screen and is unusable. I suppose I could mess about with the compatibility and scaling settings but I kind of lost interest after all of the above. I tell you all this because obviously a lot of work went into this tool and from the screenshots it looks beautiful and useful, but is let down by the process involved to get it to run, at least on my machine. For now, I will keep running HxD.
- go_prodev 2y agoMaybe they've updated it, but I found a Windows MSI link about halfway down the front page.
- sva_ 2y agoReally weird criticism. If you're confused about how GitHub works, you might follow the link to their website[0] (when you click on "Release" in the readme) and then scroll down to find a "Download for Windows" button. 0. https://imhex.werwolv.net/ https://imhex.werwolv.net/
- tom_ 2y agoAt least on desktop, there's also a link to the main site in the About section of the repo. This might actually be a better link for the HN submission, as I bet there's a non-zero intersection of hex editor users and people who completely do not understand Git whatsoever (assuming they've even heard of it).
- deleted 2y ago[deleted]
- 2y ago
- dagmx 2y agoImHex has so far been the best hex editor I’ve used for a few reasons. Some of these exist in other editors but rarely all together. 1. File templates mean that it auto highlights sections of known file types. 2. It shows how selected bytes may be interpreted as pretty much every common data type that I would want and does so simultaneously. 3. It’s significantly faster than other editors for me when I use large files On the downside, the imgui ui gets buggy sometimes but it’s replaced my use of other viewers like HexFiend, hexa etc…
- mostthingsweb 2y agohttps://github.com/WerWolv/ImHex https://github.com/WerWolv/ImHex Oooh that looks slick, thanks for the tip!
- unwind 2y agoUh that is literally the link that is posted, that this thread is about.
- stavros 2y agoI'm guilty of not reading the article more often than not, but posting the exact link of the article in a comment is next-level.
- mostthingsweb 2y agoWow, that's embarrassing :/
- stavros 2y agoIt was more funny than anything.
- rfoo 2y agoWell, 010 Editor also checks all three. So: 4. Unlike 010 Editor, it does not take you $150 and is FOSS so you can easily patch it to do whatever you need.
- hnthrowaway0328 2y agoThis looks pretty neat. Would it be a good idea to develop a hex editor as a project? It doesn't look too hard for a simple one, but if one wants there is a lot of room for practice, like parsing all fileformats, from executionable image to doom wads too some proprietary file format, and I'm there is a lot room for tools that help RE too.
- gmiller123456 2y agoI remember reading something where the author said the first project they implement when trying to learn a new language is to implement a hex editor. Said it ticked a lot of boxes as far file handling, GUI, text layout, memory management, etc.
- hnthrowaway0328 2y agoYeah it sounds like a plan. I'll try it out!
- surfingdino 2y agoGreat project, shame the author did not google the username.
- kstrauser 2y agoWhy's that?
- surfingdino 2y agoGoogle it.
- kstrauser 2y agoAh. Yeah, perhaps, but that was a normal, common word that the bad guys used because it sounded scary, but which still has its original meaning. It's not a word I'd primarily associate with those particular bad guys.
- surfingdino 2y agohttps://en.wikipedia.org/wiki/Werwolf https://en.wikipedia.org/wiki/Werwolf probably not a good idea to pick a username sounding closely to that stuff.
- Kim_Bruning 2y agohttps://de.wikipedia.org/wiki/Werwolf https://de.wikipedia.org/wiki/Werwolf (Or, direct link to using google translate to get the gist https://de-m-wikipedia-org.translate.goog/wiki/Werwolf?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://de-m-wikipedia-org.translate.goog/wiki/Werwolf?_x_tr... )
- kstrauser 2y agoI get what you’re saying. I wouldn’t pick it for myself. Still, he’s from Switzerland where German is a local language, and that’s a normal German word outside the Nazi usage. It wasn’t one of the ones they invented themselves. I think it’s closer to, say, “beer hall”, which isn’t inherently Nazi even though “beer hall putsch” was their thing. They can still have beer halls.
- nayuki 2y ago[flagged]
- drzzhan 2y agoI will just stick with 010 Hex editor for now. Still I will keep an eye on this.
- hackyhacky 2y ago> ImHex requires a GPU with OpenGL 3.0 support in general. Why does a hex editor require OpenGL? (and therefore a GPU?) Is there a good reason why it needs OpenGL or is it just for l33t-ness?
- dagmx 2y agoThe UI is built using Imgui (hence the Im prefix) which is a Ui framework for computer graphics programs. Though, a couple nits: 1. An OpenGL requirement doesn’t necessitate a GPU. There are software implementations of OpenGL but they tend to be rather mediocre at best for performance. 2. Many platforms now assume some kind of GPU. It’s fairly rare to need a GUI tool without also having a GPU available. Of course there are niches for it, but those aren’t also likely to be running a hex editor and tooling locally.
- anotherhue 2y ago'GPU' doesn't mean discrete, power-hungry graphics card either (not that you said it did). OpenGL calls for basic desktop rendering can be reliably handled by the integrated graphics in the CPU. In which case OpenGL can almost be viewed as a parallel instruction set / DSL.
- codedokode 2y ago> There are software implementations of OpenGL but they tend to be rather mediocre at best for performance. This is because OpenGL is made so that you need to run a program to calculate color of every pixel, even if all you want is to copy a glyph. Obviously it will be slow unless you have hundreds of core running in parallel. Software implementations should either learn to convert shaders to non-parallel optimized loops, or something other than OpenGL should be chosen as a basis for rendering GUI.
- codedokode 2y agoAlso, ImGUI (which is an immediate mode toolkit) is a weird choice for GUI program, isn't it better to use retainted mode library that updates only parts of the window that have changed?
- Dwedit 2y agoI still use HXD for most cases, but whenever I need to work with encoded text, I use a fork of MadEdit instead. MadEdit has no problem with multibyte characters, whether it's UTF-8, UTF-16, or Shift-JIS.
- jonhohle 2y agoThis looks awesome. I’m spending the majority of my time reversing an old game and mostly still use hexdump.
- dang 2y agoRelated: ImHex – A Hex Editor - https://news.ycombinator.com/item?id=32287902 https://news.ycombinator.com/item?id=32287902 - July 2022 (70 comments) ImHex – A Hex Editor - https://news.ycombinator.com/item?id=25353965 https://news.ycombinator.com/item?id=25353965 - Dec 2020 (78 comments)
- kamov 2y agoSadly this program seems to segfault on Wayland.
- farmerbb 2y agoWorking fine with me under Wayland, on Ubuntu 24.04 + Gnome 46
- denysvitali 2y agoTry the web version: https://web.imhex.werwolv.net https://web.imhex.werwolv.net
- denkmoon 2y agoThe pattern language is sick, it has really helped my learning. I love this program.
- rareitem 2y agoI love the kawai logo
- deleted 2y ago[deleted]
- viraptor 2y agoThis is an amazing app. I had some data to reverse engineer just a few days ago, happened to try imhex and within a couple hours I had a description with some slightly complex data structures. The format language is quite easy to learn if you program in anything and it supports lots of weird cases. I just wish it had some more date/time formats built-in, but otherwise no complaints.
- acureau 2y agoImHex has been my primary hex editor for around a year and a half, nothing bad to say about it. By far the most advanced open-source hex editor. Kind of renders 010 Editor obsolete. The dev is exceptionally active as well. I was asking about a bug in his discord once and he patched it as we spoke.