Hex Editor
Viewing, editing and analysing binary data
Last updated
Was this helpful?
Viewing, editing and analysing binary data
Last updated
Was this helpful?
The Hex Editor View is the most important View in ImHex. It displays the currently loaded data as a range of hexadecimal values and ASCII and lets you modify it.
The Hex Editor footer is the portion at the bottom of the hex editor window that contains basic information on the current selection and the loaded data. By default only the most important parts are visible, the rest is hidden and can be shown by clicking on the up arrow button in the middle.
Use the toggles to change various visualization options. Below are explanations for each of the options in order.
Upper case hex characters
This option determines if ImHex uses upper- or lowercase letters to display hex values
Gray out zeros
This option enables or disables if ImHex should gray out all zero bytes in the editor.
Display ASCII column
This option shows or hides the ASCII column to the right of the bytes column
Display advanced decoding column
Enabling this option will show the advanced decoding column. By default this option is grayed out and only enabled when when a custom encoding has been loaded through File -> Import -> Custom Encoding.
Mini Map
Enabling this option shows or hides the Mini Map next to the scroll bar.
The Mini Map shows information about hex editor lines in the current vicinity. Each colored line represents one row in the hex editor. By default the color corresponds to to the entropy of that line, the bluer the color, the higher the entropy. Other options can be specified through by right clicking the Mini Map icon and choosing a different visualizer in the popup.
Another option to customize the look of the Hex Editor is through cell visualizers. By default a 8 bit hex visualizer is used but many different ones are available such as decimals, floats or colors.
The first dropdown selects the visualizer to be used and the slider below determines if the (potentially multi-byte value) should be interpreted in big or little endian format.
The columns slider selects the number of columns that should be shown on screen. Moving it all the way to the left will cause the hex view to auto resize itself to show as many columns as fit on the screen.
The Segment Separator option allows inserting separator lines after every N bytes.
The Format option decides the radix in which the addresses should be displayed. It can be set to Hexadecimal, Decimal and Octal.
In the second row of the footer (shown when expanding the footer using the chevron button), information about the currently displayed data is shown
The left side shows the currently visible data page and its region. By default the entire data is shown on one page but the size can be changed through Edit -> Set page size.
If a custom page size is set, the currently displayed page can be switched by moving the slider left or right
The right side shows the base address of the data as well as the total size in hexadecimal and in human readable bytes.
To interact with the bytes in any way, they first need to be selected. To do that, click on one and optionally drag your mouse cursor to select bigger ranges of bytes. This can be done either on the main hexadecimal column or on the ASCII column.
Once a selection has been made, the current cursor can also be moved around using the arrow keys. Holding down SHIFT lets you select a range of bytes.
Through the use of the Edit -> Set base address option, ImHex can virtually load a file not at address 0x000000 but at any arbitrary address. This is mainly useful for analysing memory dumps that have been dumped from a specific address. Doing this will affect displayed addresses throughout all of ImHex.
Sometimes files consist of multiple different parts in which case it might be easier to analyse each of these parts on their own. For these cases, Edit -> Open selection view takes all currently selected bytes and breaks them out into a new tab. This new tab contains a transparent view of only the selected bytes now and making modifications to them in one tab will automatically apply the same modifications in the other tab.
To edit the value of a byte, simply double click it to enter editing mode. The value of the byte becomes highlighted and a new value can be entered. Once enough characters have been entered, the cursor automatically advances to the next cell so the next value can be entered. Notice how modified bytes are highlighted in red.
Size changing operations include byte insertions, byte removal and resizing.
These operations are rarely needed when analysing or patching data since they can change the layout of the data and will most likely make it unreadable by other programs.
All of these operations can be found in the Edit main menu or in the Hex Editor's right-click menu.
A popup window will open asking for the start address of the operation and the number of bytes that will be affected. Clicking on Set executes it. In the case of the following image, 0x10 zero bytes will be inserted at address 0x1A0. The Remove and Resize operation work similarly.
As of v1.34.0, ImHex loads files that are smaller than 128MiB into memory and only writes back the modified data when saving.
Files that are larger than that will apply operations on the file directly. Operations can still be undone until ImHex is closed but be aware to make backups before modifying these files.
These operations let you copy bytes in various ways and paste them back into the data later on. All copy and paste operations only operate on the currently selected bytes. Using Edit -> Copy on the following selection will copy the string 1B D2 E6 into the clipboard. Selecting only two other bytes now and using Edit -> Paste will paste 1B D2 at that selection and discard E6.
The Copy as operation copies a formatted representation of the selected bytes into the clipboard. Possible representations are arrays in the syntax of various programming languages, as well as ASCII art, HTML and more.
Some Examples:
Paste All always pastes all copied bytes, no matter of the number of currently selected bytes or if the file is big enough to hold all bytes. If there's not enough space left for all bytes after the current cursor position, the data will automatically be resized to fit it.
The jump to operation interprets the currently selected bytes (up to a max of 8 bytes) as a little endian unsigned number and jumps to that address. For example, selecting the bytes 45 00 00 and clicking Jump to will interpreted these bytes as the number 0x000045 and then jump to this address in the editor.
