Tag Archives: hex

ht: High marks, even if it’s lost on me

This little adventure of the past two years has run me up against more than one tool that I like a lot, but haven’t a single use for. ht is one of those, for reasons that are probably obvious just in these screenshots.

2014-12-22-jsgqk71-hte-01 2014-12-22-jsgqk71-hte-02

ht, a/k/a hte or the HT Editor, has a perfect interface with lots of color, a drop-down menu approach, an adjustable two-pane layout, on-screen function keys and a mess of other goodies.

My only problem is, I can’t say that I’ve ever needed a disassembler and executable editor. 😦

I see where it can double as a hex editor though, so perhaps I should just accept it as that, since I might be able to put it to that use … maybe once, sometime in the next two or three years. πŸ™„ It probably wouldn’t be fair to just call it a hex editor though, since it’s obviously prepared to do a lot more.

I’ll give ht high marks for its style and presentation, even if the purpose of the program is completely over my head. That puts it in good company though, with things like tig, txt2regex and others. 😦

ht is in Debian as well as Arch’s community, and probably for good reason. I’d be pleased to think I could put ht to use some time — heck, I might even settle for watching over someone’s shoulder while they use it. 😐

P.S.: Argh, there’s that red-on-blue effect again. … 😑

vbindiff: Red and blue

Is it time for a hex editor? It’s time for a hex editor … of sorts.

I have to admit a small amount of surprise in seeing a program as venerable yet well-maintained as vbindiff that seems to have skipped a few small steps in its presentation.


Going by the home page, the first “release” of vbindiff was for the OS/2, way back in 1996. Through the years it appears to have shifted more towards the Windows environment, but added *nix support less than 10 years ago, and for what it’s worth, is packaged in both Arch and Debian.

And my fleeting interactions with vbindiff suggest it is a workable, usable program at the very least. It wisely uses a horizontal split-screen arrangement and a strong white-on-blue backdrop, and keeps almost all its key commands on the screen, when they are relevant.

You can edit a file as well, making it a practical hex editor as well as diff tool. It’s not as graceful or elegant as some, and not nearly as splashy as others, but it fills both needs without tripping up.

Except for two or three small things, and this is where my surprise comes in. First, as you can see in the screenshots, vbindiff is apparently comfortable stretching to a depth of at least 42 lines, and possibly a lot more. That I can guess from my terminal depth.

But I don’t see a flag or any option that will stretch it horizontally, which means that there’s a huge, huge gap of wasted space off to the right. Yes, I know 120×42 is unconventional, and I respect that 80×24 is the standard that reaches back to the 1980s. But it’s a bit of an omission — a giant glaring omission, really — given the tiling window manager trend, and the prevalence of terminal emulators.

Second, vbindiff is slanted toward picking out differences between files, but there’s no visual indicator — and by that, I mean color difference or even just a difference in bolding — to highlight changes. Perhaps that’s intentional, or perhaps there’s a way to set that in a configuration file, but I see no note of it in the man page or onboard help.

Add to that the use of red on blue, which would horrify my secondary school art teacher for the shimmering side effect it has for most viewers. I forget the name of that effect or I’d link to it, but it’s not that critical. White on blue is very good, but red on blue is going to offend Miss Crawley, wherever she is now. Maybe she is responsible for my preference for color at the console. … 😐

I should mention that by its own admission, vbindiff can’t handle files greater than 4Gb in size. Of course, if you really need a diff tool for files that are bigger than 4Gb, then I think you have bigger problems than just color choice.

vbindiff does a few things I like — the aforementioned on-screen help is always good, and it allows navigation with arrow keys. It also uses the Enter key as a quick jump to the next difference between files, which will make some of your diff quests easier.

But I don’t think this stands up to things like dhex or some others. It has potential, but really needs to be brought up to date.

tweak: The word processor of hex editors

Is it time for a hex editor? It’s time for a hex editor. Or maybe it’s time for a word processor. O_o

I saved tweak for later in the game, because I could see by the home page that it was intended to run with emacs-style key commands. That always takes me a little bit to re-learn.

It’s not as bad as I make it sound though. The majority of tweak’s controls and commands are fairly straightforward, and some are quite useful.


After working with tweak for a few minutes, I came to the realization that tweak behaves less like a hex editor than some of its counterparts, and behaves more like a word processor than I expected.

For example, it has an insert mode and an overwrite mode, meaning you can press ENTER and jump to the ASCII side of the screen, and just start typing. Overwritten text will behave much as you might expect, but inserted text will cause the entire remainder of the display to shuffle out to the right as you go.

tweak has a copy-and-paste function too, and you can see that at work in the screenshot. Highlight a section with CTRL+@, then write it to a buffer with ALT+W. Move to a new spot, and remembering to either insert or overwrite, drop it into place with CTRL+Y.

If you’re in insert mode after you highlight a passage, CTRL+W will cut that section from the section, so you have a hex cut-and-paste-slash-cut-and-delete function too.

tweak borrows more from the word processor field with forward and back search functions, hotkeys to go to the start and end of the file, a jump-to-address command and a few more little bonuses.

Perhaps best of all, you can tell tweak to adjust its display on-the-fly, with the CTRL+X+w combination. So if you want to take advantage of every one of your precious 280 columns :roll:, tweak will accommodate.

Commands can be customized in tweak, and the easiest way to do that would be

tweak -D > ~/.tweakrc

tweak will write its default configuration to STDOUT; send that into a configuration file and you can edit it to fit your personal preferences. You could even conceivably edit it with tweak. How meta. … 😐

The tweak home page suggests tweak can handle massive cut-and-pastes and will run reasonably light by “lazy loading.” But if I feed tweak a zero-byte file, ps_mem.py still says it’s taking up over 2Mb of space. So likely if you’re working in a big file or making very big edits, you might need more.

I like tweak for taking the word processor route instead of just assuming the standard hex editor role. It doesn’t have some of the on-screen features that the others offer, but if you squint at the screen while you’re editing, you can almost imagine it’s 1986, and you’re using WordStar. πŸ˜‰

hexe: In the flyweight competition

I’ve been holding off on the next hex editor because the last one, dhex, was so impressive that I knew whatever came next wouldn’t stand much of a chance.

Today I’m comfortable showing hexe though, because I think hexe’s claim to fame isn’t split-panel diff viewing with four-directional panning effects. I think it has other praises worth singing.


hexe by default will confine itself to a narrow vertical band that is obviously intended to fit comfortably in an 80×24 terminal space. It does, however, allow you to set the number of columns of hex code, so you can, with a little trial-and-error, stretch hexe to fit your terminal width.

hexe also adopts a very readable color scheme, wisely putting whites on blue and sometimes reversing text for selections. Perhaps that was intentional, or perhaps the author just likes white and blue. πŸ˜‰

Size is where hexe tends to shine. As you can see on the home page, the code files that make up hexe are barely 4Kb in the Arch version I cobbled together, and the packaged tar.xz file costs me a mere 11Kb of disk space. Installed, yaourt -Qi says it’s 34Kb. I’m comfortable allowing hexe 34K of my hard-earned X-gigabytes, for some fundamental hex editing capabilities.

Memorywise, I notice that the amount reported by ps_mem.py tends to vary with the size of the file that’s loaded. I don’t expect that’s uncommon. Just to be fair, opening hexe with no file in an 80×24 terminal emulator shows up as 550Kb on a machine with a gigabyte available. The image you see above required 2.2Mb, and that was a thousand-line file of random words.

So if you are exceptionally tight on memory — exceptionally, like this tight — you might find it more comfortable to fall back on hexe, as opposed to the Cadillac hex editors we’ve seen in past weeks.

hexe keeps most of its key commands on screen. CTRL+T will switch between display modes, if you need another number system to get the job done. I should mention that insert mode occasionally gave me screen artifacts, where columns and data were smudged, even if the file output was clean.

hexe is in AUR, but the source files have been updated and the md5sums in the PKGBUILD are no longer correct. I don’t see hexe in Debian.

And if you think this is the last hex editor I have stashed away, you are sadly mistaken. … πŸ˜‰

dhex: A hex editor with a diff … erence

Is it time for a hex editor? It’s time for a hex editor. Of course, the last hex editor we looked at was quite impressive. It’s going to take some serious advances in the art of hex editing to impress us. Or at least a lot more color.


Holy schmoly! Is that a hex editor, or a gene sequencer?! Is that a hex editor, or a military-grade electromagnetic noise generator?! Is that a hex editor, or a cryptographic cracker for infiltrating alien spaceship defenses?!

It’s none of those things — it’s dhex, a hex editor that adds a diff mode so you can compare more than one file at a time, or variations on the same file. And look at all that wonderful color. I am in heaven.

And going by the list of good things that were present in hexcurse, dhex has also hit it out of the park: uses the full screen, lots of color, neatly divided and arranged, labeled function key legend, and so forth.

But as you can see above, dhex adds its own categories that some (most?) other hex editors haven’t quite approached yet. Themes. Custom key configuration. Split-screen diff mode. Color-coded comparison between files. And perhaps even wilder, synchronized vertical and horizontal panning. Ooh-la-la! πŸ˜€

So the next time you need a brain massage, I recommend firing up dhex with two similar files, and gently scrolling left and right, and up and down. Guaranteed stress reliever. You’ll feel at least as good as a dog getting its belly scratched.

Eye therapy aside, dhex seems like one of your better options for hex editing, and since it’s kind enough to build a configuration for you the first time you run it, I have absolutely nothing to complain about.

Of course that means the next hex editor we stumble across is really going have a difficult time. dhex will be a hard act to follow. … 😐

hexcurse: So many things done right

Is it time for another hex editor? It’s time for another hex editor. Here’s hexcurse, which by most accounts does everything right.


Let’s see if I can get a list going here:

  • Framed panels on the left and right
  • One key (TAB) switches between hex and ASCII panels
  • Corresponding cursor position is displayed in color in opposite panel
  • Scroll bar shows position in the file
  • Takes advantage of full screen dimensions
  • Allows you to resize the panel output to a specific width
  • On-screen F-key legend with corresponding CTRL key sequences
  • Pop-up help page
  • Warning to save changes on exit
  • Display options for decimal addresses and EBCDIC display

And a few more smaller options. And no, I swear I did not coach the hexcurse developers on how to make a great text-based program. But it is very, very well done.

What more could I tell you about a program that does so many things right? I could give you my standard disclaimer about never really needing hex editors, but you know that already.

I can find only one fault in hexcurse, and it’s rather nitpicky: If you ask for a specific width for the panel output, the function key reminders at the bottom of the screen still span the entire width. I’m not sure when that would be useful, so it seems like an oversight to me.

But hexcurse is doing quite well if that’s the only thing I can find wrong with it. Plain and simple, this as an example of a text-based tool with an excellent interface. Up-and-coming text-based software developers, take heed: hexcurse does it right.

shed: A simple hex editor

Is it time for a hex editor? It’s time for a hex editor. Here’s a simple one: shed.


shed takes a different approach to the time-worn display model that has huge blocks hex code on the left, and a semi-readable display on the right. Just about any hex editor, from hexedit to hexdump to hexer, has some variation on that style.

Instead, shed gives you a vertical stream taken from the file, and its corresponding values in hex, decimal, octal and binary to the right. Press p and shed shows a line preview that moves up and down, as you navigate or edit the file.

It’s a nice touch — not necessarily better, but very different.

The shed home page also suggests shed will take up a lot less space in memory, because the “file is not loaded into memory.” I … can’t necessarily corroborate that, since just hexedit, opening the same file, seemed to be about 100Kb lighter than shed, according to ps_mem.py. And aphex was considerably smaller.

Be that as it may, shed also boasts of a pico-esque (nano-esque?) display, which I can vouch for. If you’re one of the enlightened ones who doesn’t subscribe to one side or the other of the age-old editor war, you’ll step right into shed with no difficulty.

But then again, shed is simple enough that everyone should step into it with no difficulty. Bonus points for that, and bonus points for an unusual way of arranging the screen. Bonus points for everybody! :mrgreen:

ired: Unenthusiastic, as might be expected

Time for another hex editor, and just so you don’t get the impression that this blog is some kind of mutual appreciation society, here’s one I really don’t like: ired.

2014-10-09-6m47421-ired 2014-10-09-6m47421-vired

Strictly speaking, ired is on the left, and vired is on the right. ired and vired are analogues to ed and vi, which represent a line editor and a “graphical” arrangement. Hence the names, ired and vired.

In short, I’m not a big fan of ired or vired, mostly because they’re just too obtuse to be practical for me. Hex editors are a stretch for me anyway, but these two will probably never grace my system again.

I suppose that’s not unexpected; ed is a quaint giggle of a program to me, and vi is simply a step down from vim, which I suffer through daily just because … well, just because.

So a hex editor that behaves like ed, or a hex editor that behaves like vi, just doesn’t register on The Scale of Things K.Mandla Likes. :\

If you are one of the Real (Wo)Men of Unix, and you live and breathe ed or vi, then you’ll probably want to take a close look at ired and vired. For me, it’s not worth pursuing. Next, please.

vche: Serious as it gets

I promised something a little more serious today, and I can think of nothing more serious than a hex editor. Here’s vche:


I did run into a short list of hex editors for the console a few weeks ago, which is why vche is up now and why aphex was listed 10 days ago. Which is all the more curious because, as I say every time I see a hex editor, I almost never have any use for a hex editor.

All the same, I like a few things about vche that might not (or might) be part of the hex editor you use:

  • Plenty of color, and well arranged. It’s easy to see what and where you’ve edited.
  • Has separate versions for consoles and X-ish environments, and one that’s flexible enough for either case. I don’t know exactly why that’s necessary, but it does mean there’s a version that won’t show my favorite block character where the font fails a terminal window.
  • Has one-key presses for XOR, OR, AND and other bit operations. Again, not that I would never need that, but it’s cool.
  • Has a quick jump between ASCII and hex editing with the TAB key. It seemed natural to me, so I had to mention it.

vche has a lot of other clever tools on board. I’ll let you take a closer look and see if something tickles your fancy.

I must be honest and say that I did have a little screen corruption, but only when the help window appeared. And if I must be honest again, that help window is not a help window. All it does is tell you to look at the man page. We can do better than that, people. …

I have a few more hex editors to show, but I’ll space them out over the weeks to come. I don’t mind lumping games (particularly minesweeper games) into a single post, but I think an oh-so-serious tool like a hex editor should probably be taken on its own. 😐

P.S.: If you find you like vche, you might consider adopting the Windows version for your other machines.

aphex: The tiny hex editor

The home page for aphex claims it’s a lightweight hex editor, and just to see if that was true, I checked htop to see what portion of the 2Gb on this machine aphex occupied. htop said zero-point-zero. πŸ˜•

Well, it’s not often any more than I have to drag out the ancient ps_mem.py script but I did it for aphex. And if 145Kb is lightweight to you, I’m happy to say the home page is right.


A lowly 145Kb puts it within striking range of things like tty-clock and well below popular standbys like the aforementioned htop, or deliberately lightweight utilities like retawq. For text-based software, 145Kb is quite good.

aphex follows vi-ish controls, but only to a point — which will either horrify you or enthuse you, depending on which side of the camp you sit. aphex itself is rather closemouthed, so you might need to keep this page bookmarked the first few times you use it.

I feel obligated to mention one other thing, because I found it rather quickly and the man page backs me up: There is no undo function, and edits are written out immediately. So there’s no save command, and you better be sure you’re comfortable with the edits you make.

If you need the safety of some sort of file backup system, you might look elsewhere for a hex editor. aphex is a bit unforgiving in that arena.

At this point I’ll repeat my mantra about rarely needing a hex editor, and feeling somewhat guilty for not using this one or one of the half dozen others I’ve seen. No worries. At some time in the future, a hex editor will be needed, and I’ll have plenty to choose from.

Indeed, that might be the most difficult part. … πŸ™‚