Hex editors vs. malware: Choosing a hex editor for analyzing binaries

× Close


HxD Hex Editor, as the name suggests, is a hexadecimal editor that supports working with RAM and files located on the hard drive. The product is distributed free of charge and allows you to use both desktop and portable versions.

HxD Hex Editor works like a regular editor, with the only difference that files opened with it are represented by default in hexadecimal format. In addition, the program allows you to display not only the content, but also various kinds of service information, viewing which, the user can make sure that there is no malicious code, gain a better understanding of the structure of the object, and also see exactly how applications look in the computer's RAM and permanent memory.

The tool has the basic capabilities of an ordinary editor and allows you to search, replace, view, modify, copy, add and extract information from memory areas. Thus, the user is able to inject his own program code into executable files, study objects with an unknown extension, make corrections to them at his own discretion, and so on.

The HxD Hex Editor interface is similar to other similar editors. The program supports the mechanism of tabs and floating panels. Files opened in the editor can be arranged horizontally, vertically or cascading. In addition, the tool offers four types of encodings to properly represent file content, namely Windows (ANSI), DOS / IBM-ASCII, Macintosh, and EBCDIC.

Benefits of HxD Hex Editor

  • Free distribution of the product.
  • Availability of a portable version of the program.
  • The presence of a built-in data inspector with the ability to present content in various formats.
  • Support for floating panels and tab mechanism.
  • Support for multiple encodings.
  • Supports editor functions such as search, replace, copy, paste and others.
  • Support for many formats for exporting memory areas.
  • Support for partial customization of the appearance, in particular, the fonts used.

Disadvantages of HxD Hex Editor

  • Lack of support for Russian and Ukrainian languages.

Conclusion

The HxD Hex Editor utility behaves responsively and can become an indispensable assistant to system programmers, hackers and anyone interested in the processes taking place in computers.

Changes in latest version ()

  • Redesigned plugin interface.
  • New: Support for signed hexadecimal numbers in the data inspector (for Int8, Int16, Int32, Int64).
  • Improvement: integer types in datainspector support the leading + sign.
  • Improvement: The error message (when the relative offset "goto" is outside the file / stream) will mention both the relative and absolute offset for easier reference.
  • Fixed: datainspector plugins cannot go to previous / next / first / last item.
  • Fixed: Closing the "Block Selection" window with the Enter key will ignore changes in the currently selected text field.
  • Other minor fixes and cleanups.
  • New translations: Indonesian, Greek, Portuguese, Hungarian.

Description

This is a program designed to edit files on the hard drive and work with RAM. Hex Editor is available in a free version and is easy to use. It differs from the standard editor in that the files are in hexadecimal format. Thanks to this program, you can demonstrate not only the content, but also various service information. After reading it, users can independently understand that there is no malicious code, and the state of the object becomes clearer.

The application contains the most relevant features of the standard editor. It is used to replace, view, modify, copy and obtain information from different parts of the device's memory. Each user has the right to equip files with program code, study files with a small extension and correct them at will. You can also download HxD Hex Editor 1.7 7.0 rus to your computer from our website.

Program design

Like many popular editors, Hex Editor has a simple design. The program has floating panels and convenient tabs. Files used for editing can be opened horizontally or vertically. Also, the tools provide different types of encodings, which makes the editing process more interesting. To familiarize yourself with the main advantages of the program, you need Hex Editor HxDxd download in Russian for free.

Main advantages

  • The program is available in free mode for all users
  • Built-in data inspector and content in different formats
  • Convenient tab layout and floating panels
  • Ability to use multiple encodings
  • Multifunctionality: search, replace, copy, paste

To download Hex Editor in Russian for free torrent, you need to follow the link of our website.

System requirements:

  • Windows: XP, Vista, 7, 8, 8.1, 10
  • Year: 2001

Hex editor CI Hex Viewer

The program is designed to view and edit raw binary data. Contains professional tools that are convenient for quickly, easily and safely handling data in hexadecimal format.

Only non-commercial use is allowed for free.

CI Hex Viewer allows you to work with a variety of data sources, including physical and virtual disks, disk images, disk partitions, files, and individual file fragments.

Requirements

  • Operating systems: Microsoft Windows, Linux, Mac OS.
    • Windows: NT 5.1 (Windows XP / 2003) and later.
    • Mac OS: from version 10.6 and up.
    • Linux: Ubuntu Linux 9.10 (or compatible) and higher.
    • Intel Architecture, 32-bit (IA-32, x86).
    • AMD64 (x86-64).
  • Hard Drive: At least 20MB of free space.
  • RAM: at least 256MB.
  • Other software: any web browser available.

Capabilities

Structures

Functions for working with binary data:

  • Easily editable templates with simple and clear programming syntax (code) for specifying any types of files and storages.
  • Setting up a structure template with the ability to set the required structure parameters and exact data forms.
  • Automatic application of templates for all files and storage of the same type.
  • A structure context controller that provides hints about the components of a structure template, making it easier to navigate.

RAID assembly

Functions for working with RAID:

  • The RAID-Builder utility built into the free Hex editor offers several functions for fast and correct array assembly. The user only needs to specify the required RAID parameters. You can refine the assembly results by applying a hexadecimal editor to any of the pattern components.
  • Automatic RAID reassembly helps save time. The built-in RAID parameter locator offers instant reassembly of an array when all of its components are present.
  • The Parity Utility is a turnkey solution for all parity RAID arrays. The program provides the parity result for the sum of several separate components.
  • Boolean operations such as XOR and GFmul do not require user action. Out-of-the-box calculations for data parity are given.
  • RAID levels include JBOD, RAID0, RAID3, RAID4, RAID5, RAID6. In addition, the software supports complex levels like RAID10, RAID0 + 1, RAID50 and the like.
  • Working with custom RAID configurations.
  • Binary and raw data analysis is available for unassembled RAID arrays.

Convenient editing tools and secure data modification mode

The CI Hex Viewer provides the following tools:

  • You can work with any data source, including physical disks, virtual storages, disk images, disk partitions, files, and even any fragments of the listed sources.
  • A search and replace tool based on several methods, including advanced hexadecimal search with customizable syntax, provides accurate data search results.
  • The data replacement pattern simplifies the exchange between stores. The program copies the exact range of data from the source to the target storage in the specified area.
  • The auto build tool allows you to create one file from an unlimited number of different disks and files.
  • The secure data editing mode guarantees maximum protection against data corruption due to accidental editing errors, and, as a result, prevents possible data loss. In addition, the product allows you to create a new file or virtual storage for secure data editing.

Additionally

Features to improve convenience and save user time:

  • Easy viewing of binary data with tools for navigating to different positions, for highlighting areas of data, and for many different copy and save operations.
  • Customizable user interface with the ability to specify the field of representation of hexadecimal data.
  • Inspector for viewing and editing data, both in hexadecimal and in text.
  • Data source settings and status information to speed up the data analysis process, depending on the information already collected by the program.
  • Support for more than twenty encodings to cover a wide range of possible text representations to find the required data formats.
  • Convenient data comparison using the Data Comparison tool, which gives the result of analyzing all the coincidences and differences in the binary data of disks, files and any of their parts.
  • The Parallel Search tool provides the ability to conveniently search for the necessary information on several sources simultaneously.

Like Windows Notepad. Moreover, if you open a binary file with a text editor and save it to disk, in most cases, such a file will be damaged and will not start. To make correct edits, you must use hex editors (hex), which are sometimes also called binary editors.

Most ordinary users are unlikely to have any tasks or needs to use hex editors. However, for tech-savvy users, such editors can be indispensable tools.

Note: As a matter of fact, but at one time, to edit the standard asp.net 1.1 installers, you had to correct the binary code. For example, to make one of the controls for the password field.

This review contains some of the best free hex editors for different needs.

Review of Free Hexadecimal Editors

There are several excellent free hexadecimal editors available, ranging from small and simple to complex products that are comparable to commercial solutions. However, the hex editor category is one of those categories where personal needs and preferences are so important that comparing products is not only difficult, but also pointless. Therefore, you should not assume that the products are arranged in descending order.

HxD great hex hex editor

One of the best binary editing utilities is. First, the program is portable and does not need to be installed, which is especially important when you often need to edit executable files. Secondly, it has a nice interface. Third, HxD handles large files without lag or screen fading. In addition, add to this the capabilities of unlimited revision history, fast find and replace, binary comparison, full ANSI, DOS / IBM-ASCII and EBCDIC support. And a dozen more possibilities, some of which will be listed below. HxD also allows you to edit not only disk, but also RAM. In fact, this set of features makes the program a dangerous toy in the hands of novice users. In addition, security applications can also react to its actions, but experienced users understand that this is due to the specifics of accessing data and using potentially dangerous functions.

In general, HxD is great for those who often deal with various binary codes.

Other features and characteristics:

  • Safe access to files used by other programs
  • Checksum generator: Checksum, CRCs, Custom CRC, SHA-1, SHA-512, MD5, ...
  • Data export in various formats
  • Inserting Code Templates
  • The ability to safely delete files.
  • Splitting or combining files
  • Various types of groupings in columns (1,2,4,8,16 bytes)
  • Highlighting changed data
  • Quick jump to address
  • Support for copying clipboard data from other programs: Visual Studio / Visual C ++, WinHex, HexWorkshop, ...
  • Bookmarks
  • And much more...

Hex-editor Hexplorer analogue of HxD with the ability to view images when analyzing steganography

Another great hex editor is open source. The program has a number of unique features that make it a powerful binary image editor. This means that you can look at all graphic files not only from the point of view of their visual representation, but also their binary code. Of course, it is difficult to imagine editing hexadecimal images in everyday life. However, it can be used for purposes such as steganography.

In general, Hexplorer is suitable not only for those who frequently edit binary code, but also for those who use non-standard ways to use binary code.

Key features and characteristics:

  • Six interface color schemes for different tasks.
  • Unlimited command history
  • x86 disassembler
  • Import and export in 20 different binary file formats including Intel Hex, Motorola S-Record, Atmel standard, etc.
  • Find repeating patterns in data
  • Viewing images
  • Filtering text from binary data
  • Boyer-Moore search algorithm
  • Fast navigation to addresses
  • Allows you to create structures of simple data types such as integers or floating point numbers
  • Pseudo-random number generator
  • Allows you to record macros (scripts) to automate tasks

Other hex editors

There are other hex editors out there that are also noteworthy and useful.

Hexadecimal editor XVI32 simple and convenient

XVI32 is a free hexadecimal editor whose name comes from the Roman numeral XVI (16).

  • Supports scripts to automate tasks.
  • Search by pattern
  • ASCII / ANSI
  • Converting symbols based on custom definitions
  • Writing individual blocks to a file
  • And other possibilities ...
  • Keeps an open file in memory, so there will be problems with large files.
  • As such, there is no command history. This means that all changes are made "as is" and you will have to write them down or remember.

Supports Windows 9x / NT / 2000 / XP / Vista / 7

Hex editor HexEdit with specialized calculator

HexEdit is another free binary editor from MiTeC.

  • No need to install (portable)
  • RAM and disk editor
  • Specialized calculator
  • Can compare files
  • Can dump data from RAM to disk (create a dump)
  • And others...
  • Keeps open files in memory

Supports Windows 2000 - Windows 7

Cygnus Free simple hex editor

Cygnus Free is a free hexadecimal editor that is one of the older versions of the commercial editor. Therefore the functionality is limited.

  • Fast and easy to use
  • Quick find and replace
  • Drag & drop
  • And other possibilities ...
  • Stores an open file in RAM with all the ensuing problems
  • The free version has no technical support
  • Truncated by functionality

Supports Windows

Quick Pick Guide (links to download free hex editors)

HxD

Support for many languages, including Russian. Disk and RAM editor. Quickly edits large files. Allows you to generate checksums. Knows how to compare files. Knows how to safely delete, glue and split files.
All changes are immediately saved to disk. Therefore, always back up your files before editing.
http://mh-nexus.de/en/hxd/
http://mh-nexus.de/en/downloads.php?product\u003dHxD
850 KB 1.7.7.0 Unrestricted freeware Windows 95 - 7

Hexplorer

Memory and disk editor. Additional features such as Fourier transform. Viewing images. Knows how to recognize headers NTFS / FAT, BMP, and so on. Supports macros to automate tasks
Keeps an open file completely in memory, making large files difficult to edit. The default font and display settings are not very well chosen.

This article will talk about working in the free hex editor Free Hex Editor Neo, using the example of editing a file BkEnd.dll from the delivery for the correct operation of this system c.

1. A little about hex editors and files

As you know, any file stored on the hard disk of a computer is a sequence of machine words - bytes. A byte, in turn, consists of 8 bits, each of which can take the value "0" or "1", which means that one byte can take 2 8 \u003d 256 values \u200b\u200bin the range from 0 to 255. Number 256 10, written in hexadecimal system is a round three-digit number - 100 16, that is, no more than 2 digits are required to represent any number from the range 0-255. This means that the value of each byte is very convenient to write a two-digit number in hexadecimal notation.

The hex-editor shows us the file the way the machine "sees" it, namely, a sequence of bytes. For example, opening a file in an editor, we will see a matrix consisting of 16 columns and the number of lines depending on the file size. Each matrix value corresponds to one byte, written in a two-digit hexadecimal number. By changing the value of the desired byte, we can accordingly change the file itself.

In addition, next to the table we can see:

  • To the left of the matrix, a line of numbers is displayed: each line corresponds to a number that indicates the address / offset of the first byte of this line. In this case, the address step is equal to the number of columns.
  • Above the matrix, another ruler is displayed: above each column, the offset of the byte in this column relative to the first byte of the corresponding line is displayed. The sum of the number corresponding to the i -th row and the number corresponding to the j -th column is the address / offset of the byte (i; j) at the intersection of the taken row and the taken column.
  • To the right of the matrix, the same data is displayed, but in a different interpretation. The most commonly used alternative display of data as ASCII text is that bytes whose values \u200b\u200bcorrespond to non-printable characters are displayed as periods (·). You can also edit the values \u200b\u200bin this area.

2. Installing Free Hex Editor Neo

For example, I need a byte with an offset 000d9cca write value eb... To do this, I find the line "000d9cco" and the column "0a", double-click on the desired cell and fill in a new value.

In the same way, I am making the following changes:

  1. To fix the error “ MS SQL Server 6.5 + Service Pack 5a or higher is required!»Change the fields:
    by offset 000d9cca value 83 change to eb
    by offset 000d9ccb value e8 change to 15
    by offset 000db130 value 83 change to eb
    by offset 000db131 value e8 change to 10
  2. To fix the error “ The sort order set for the database differs from the system one!»:
    by offset 0018a79d value 75 change to eb
  3. To fix the error “ Incorrect syntax near the keyword 'TRANSACTION»
    The phrase DUMP TRANSACTION% s WITH TRUNCATE_ONLY which is at the offset 002856B0 replace with the phrase ALTER DATABASE% s SET RECOVERY SIMPLE
  4. To fix the error “ The database cannot be opened in single user mode", Change the fields:
    by offset 0028549c value 64 change to 6b
    by offset 0028549d value 62 change to 70

After all the changes are made, save the file by clicking " File» — « Save» .

Did this article help you?