I guess it depends on what you’re hex editing
Ken and Rich Johnson from MSRC were both extolling the virtues of hiew as a hex editor a few weeks ago. I recently needed to do some hex editing of a pcap file (needed to manually munge some network packets for IM driver testing), and my new laptop didn’t have a hex editor yet, so I decided to go grab hiew and give it a shot.
Once you get over the character-mode interface, it actually has a ton of neat features, including a nice disassembler, and basically everyone I’ve asked in the hex-editing community (?) concurs that it’s the only thing they’d ever use to modify a binary.
So, I loaded up my pcap file and searched around for the bytes to modify. I found the (long) block of hex that I wanted in another capture file and went to copy the bytes. Then I tried to open another file and past them in. Hmm, nope, not supported!
Then I tried re-arranging bytes within the same file. Nope! Not (obviously?) supported, at least without overwriting things.
So, in a bit of a huff, I fired up Visual Studio 2005 and instantly copied and pasted the bytes I needed and achieved a state of happiness in mere seconds.
I’m sure there are a lot of people that will be able to tell me how to get hiew to do this, and I’m sure I could have written a script or something, but… life is to short to learn Yet Another Non-Obvious Editor.
So, I’m sure hiew is great, and if I ever need to hex edit a PE image, I’ll certainly keep it in mind. But for network packets - back to VS!
UPDATE: I am a dumbass. I cannot believe I left the title "your hex editing" instead of "you’re" - the shame!
October 18th, 2007 at 10:35 am
Have you seen 010 editor? Sweetscape Software. I am in no way affiliated with the company but I use it all of the time. The best feature it has is the “binary templates” feature which allows you to use a C style header file to parse files and give them some structure. This is really helpful when trying to wrap your head around a file format.
October 18th, 2007 at 11:26 am
Cool, I’ll look into it. Thanks.
October 23rd, 2007 at 8:30 am
Uedit32 also is a nice tool…
January 21st, 2008 at 8:20 am
What’s wrong with Vim in hex mode?
January 21st, 2008 at 9:38 am
I’m definitely a vimaholic, and I do all my coding in vim, but a proper hex editor needs simultaneous display of ascii and hex, etc., and afaik vim is just not set up for that. Then again, although I’ve been using vim every day for 10 years, i seem to discover major new capabilities every few months even to this day, so maybe I missed something.
March 25th, 2008 at 3:53 am
press * (at num pad) then mark the block then press * again and F2 to save the marked block