I guess it depends on what you’re hex editing

Ken and Rich Johnson from MSRC were both extolling the virtues of hiew as a hex editor a few weeks ago. I recently needed to do some hex editing of a pcap file (needed to manually munge some network packets for IM driver testing), and my new laptop didn’t have a hex editor yet, so I decided to go grab hiew and give it a shot.

Once you get over the character-mode interface, it actually has a ton of neat features, including a nice disassembler, and basically everyone I’ve asked in the hex-editing community (?) concurs that it’s the only thing they’d ever use to modify a binary.

So, I loaded up my pcap file and searched around for the bytes to modify. I found the (long) block of hex that I wanted in another capture file and went to copy the bytes. Then I tried to open another file and past them in. Hmm, nope, not supported!

Then I tried re-arranging bytes within the same file. Nope! Not (obviously?) supported, at least without overwriting things.

So, in a bit of a huff, I fired up Visual Studio 2005 and instantly copied and pasted the bytes I needed and achieved a state of happiness in mere seconds.

I’m sure there are a lot of people that will be able to tell me how to get hiew to do this, and I’m sure I could have written a script or something, but… life is to short to learn Yet Another Non-Obvious Editor.

So, I’m sure hiew is great, and if I ever need to hex edit a PE image, I’ll certainly keep it in mind. But for network packets - back to VS!

UPDATE: I am a dumbass. I cannot believe I left the title "your hex editing" instead of "you’re" - the shame! :-(

6 Responses to “I guess it depends on what you’re hex editing”

Leave a Reply

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>