Imhex: A hex editor for reverse engineers

[dagmx]

ImHex has so far been the best hex editor I’ve used for a few reasons. Some of these exist in other editors but rarely all together.

1. File templates mean that it auto highlights sections of known file types.

2. It shows how selected bytes may be interpreted as pretty much every common data type that I would want and does so simultaneously.

3. It’s significantly faster than other editors for me when I use large files

On the downside, the imgui ui gets buggy sometimes but it’s replaced my use of other viewers like HexFiend, hexa etc…

[rfoo]

Well, 010 Editor also checks all three. So:

4. Unlike 010 Editor, it does not take you $150 and is FOSS so you can easily patch it to do whatever you need.

[mostthingsweb]

https://github.com/WerWolv/ImHex

Oooh that looks slick, thanks for the tip!

[ykonstant]

Does this editor have a way to display the ASCII bytes in CP437 glyphs? I grew up reading binary files in DOS that way and I can read the glyphs much faster than the corresponding hex values; in contrast, using dots for the non-printable characters doesn't really tell me much.

[Simran-B]

You can download additional assets in the settings and then interpret data as encoded in various formats. I don't see CP437 in the list but the file format for encodings is straightforward, you can probably create a mapping easily.

https://github.com/WerWolv/ImHex-Patterns/tree/master/encodi...

[Dwedit]

The problem with CP437 is that FF, 00, and 20 are all empty space and look the same. Then there's the question about that ambiguous character that's either German Sharp S or Beta.

[nneonneo]

I tried ImHex…found it way too complex for most of what I wanted to do. I’m still a huge fan of Hex Fiend on macOS - simple, fast, does what I want. I still haven’t found the perfect “simple” hex editor on Windows.

[s1gsegv]

Interesting, I find HxD on Windows to be the absolute peak of hex editors with no real parallels on macOS or Linux. Which is a shame because I never use Windows.

Hex Fiend for instance is my hex editor on macOS, but why does it insist on reflowing the lines when I expand the window? I might just want to work with it maximized to avoid visual distractions, but I still only want lines to be 16 or 32 bytes long, and definitely not some weird size that will make things not line up.

[MontagFTB]

+1 for HexFiend. Their template format is straightforward to extend. I’ve used it to analyze many different file formats.

I also tried ImHex briefly. I have a ton of respect for the project, but found for my needs it was like using a cannon to kill a housefly.

[nine_k]

Have you tried Hiew?

[noname120]

I will stick to 010 Editor for now[1], it's the most amazing hex editor I've tried in my life. I'm not fond at all of the GUI framework (Dear ImGui) that this new projects uses. It's meant for embedded systems with tiny screens and no window manager, not full-fledged desktop environments where the small elements and the complete lack of UI integration makes for a very awkward experience.

[1] https://www.sweetscape.com/010editor/

[rafram]

Yeah, just the crappy aliased font rendering alone makes this painful to use for me.

[hackyhacky]

> ImHex requires a GPU with OpenGL 3.0 support in general.

Why does a hex editor require OpenGL? (and therefore a GPU?)

Is there a good reason why it needs OpenGL or is it just for l33t-ness?

[SideQuark]

> Why does a hex editor require ... a GPU?

Any editor, to be fluid and quick at today's screen resolution, needs hardware rendering. The days of drawing things pixelwise, especially any complex formatting, are noticeably slow.

See this [1] for example

[1] https://www.sublimetext.com/blog/articles/hardware-accelerat...

[dagmx]

The UI is built using Imgui (hence the Im prefix) which is a Ui framework for computer graphics programs.

Though, a couple nits:

1. An OpenGL requirement doesn’t necessitate a GPU. There are software implementations of OpenGL but they tend to be rather mediocre at best for performance.

2. Many platforms now assume some kind of GPU. It’s fairly rare to need a GUI tool without also having a GPU available. Of course there are niches for it, but those aren’t also likely to be running a hex editor and tooling locally.

[salicideblock]

FYI, from the project's Readme:

> In case you don't have a GPU available, there are software rendered releases available for Windows and macOS

[9029]

they probably just picked the opengl renderer for imgui

[mahoro]

This is an absolutely great project. I had a lot of fun tinkering with the ROM of my Philips smart clock.

It has a built-in DSL that looks like Rust (without memory management, though – so it's very lightweight), and with that, it's possible to visualize and extract structural data from binary streams. That's really fun and cool.

It also has a visual editor to make simple calculations with no code. It didn't feel polished at the time I tried it. Strangely, writing code in DSL was more intuitive and easier for me.

[alex_suzuki]

Cool, a bit like Wireshark protocol dissectors then?

[dang]

Related:

ImHex – A Hex Editor - https://news.ycombinator.com/item?id=32287902 - July 2022 (70 comments)

ImHex – A Hex Editor - https://news.ycombinator.com/item?id=25353965 - Dec 2020 (78 comments)

[hnthrowaway0328]

This looks pretty neat. Would it be a good idea to develop a hex editor as a project? It doesn't look too hard for a simple one, but if one wants there is a lot of room for practice, like parsing all fileformats, from executionable image to doom wads too some proprietary file format, and I'm there is a lot room for tools that help RE too.

[gmiller123456]

I remember reading something where the author said the first project they implement when trying to learn a new language is to implement a hex editor. Said it ticked a lot of boxes as far file handling, GUI, text layout, memory management, etc.

[0xDEADFED5]

Looks good! I usually stick to 010 Editor for it's wildcard search, but ImHex does that and more, I'm sold. Will be testing it out a bit more

[0xFEE1DEAD]

what're the odds of two dead 0x users showing up at the same time in a thread previously without comments. gave me a chuckle

[z3phyr]

I really like this area of computer culture. RE, writing kernel modules, figuring out how stuff works and making stuff do what it was not designed to do aspects. However, legal avenues to do so are far in between and it requires a huge amount of time and help from peers.

[poincaredisk]

>However, legal avenues to do so are far in between and it requires a huge amount of time and help from peers.

I reverse engineer things for a living and I have many peers worldwide who do the same. My main field of work is malware analysis.

For recreation, in my country it's explicitly legal to reverse engineer things you own, with a purpose of making it work on your system (think: fixing a windows XP game so it works on windows 10). This is a very broad loophole, and let's you reverse engineer things in most cases when they "feel" like they should be legal.

[no_time]

You don't need a project to be "legal" to have some fun :)

Publish under a pseudonym with no links to your real identity, use dedicated communities that disregard DMCA takedowns. As long as you don't want to earn money this way, the worst that will happen is that your target notices your work and deploys vmprotect on their releases.

[kstrauser]

File formats are great fun to RE. I worked at a place that used a proprietary business management app. One day I was bored and started looking at its data files with a hex editor and saw some patterns like the titles of records in the app were spaced at exact multiples of X bytes apart on the data file. Oh! Fixed width records! Huh, look at that: right after the title, the next two bytes look like the hex value of the record number show in the app. Guess that's how it stores those! If I click this checkbox, this one byte changes from 0x00 to 0x01. Hey there! After enough experimentation I had the whole thing mapped to structs in code and was able to build reports that the original app couldn't support.

There wasn't anything illegal about that. I'm sure the vendor would've preferred we pay them to make reports for us but nothing legally prevented it.

[viraptor]

This is an amazing app. I had some data to reverse engineer just a few days ago, happened to try imhex and within a couple hours I had a description with some slightly complex data structures. The format language is quite easy to learn if you program in anything and it supports lots of weird cases. I just wish it had some more date/time formats built-in, but otherwise no complaints.

[0xFEE1DEAD]

This seems interesting and is coincidentally exactly what I need right now. My trusty file, strings, hexdump and xxd all failed me. I was going to use ghidra, but it's quite the beast and I haven't had any time to learn it yet. Gonna give this a try tonight.

[nneonneo]

What do you need Ghidra for?

Ghidra is, for the most part, not a hex editor. It’s meant for reverse engineering - mainly decompilation, but it’s useful for patching as well. The debugger is new and takes some getting used to (I’m still using GDB + Ghidra), but the disassembler and decompiler are top-notch.

[ithkuil]

Username checks out

[j16sdiz]

> people who value their retinas when working at 3 AM.

You just need a well lit room to use light mode.

[Krssst]

Light mode is easier to read thanks to black-on-white text I think (I need to use bigger fonts in dark mode for the same readability). But to avoid issues with brightness I set monitor brightness to the minimum and set the background to light yellow ("solarized") rather than plain white.

[someplaceguy]

> > people who value their retinas when working at 3 AM.

> You just need a well lit room to use light mode.

Who wants a well-lit room at 3 AM?

[Stratoscope]

Agreed, and also turn down your monitor brightness if needed so the light background matches a piece of paper on your desk.

No one complains that reading something on paper burns out your retinas. A light mode shouldn't either.

I always assumed that ImHex only supported dark mode, but it turns out that it does support light mode too!

[kul_]

Reminds of the old days, when reverse engineering game binaries were a thing. Finding hex strings, no-op'ing if conditions, adding jmp instructions. Many heroes forgotten with time as more and more of software onboarded the cloud offerings. I wonder how much of it is still relevant and in what fields?

[kamov]

Sadly this program seems to segfault on Wayland.

[denysvitali]

Try the web version: https://web.imhex.werwolv.net

[farmerbb]

Working fine with me under Wayland, on Ubuntu 24.04 + Gnome 46

[acureau]

ImHex has been my primary hex editor for around a year and a half, nothing bad to say about it. By far the most advanced open-source hex editor. Kind of renders 010 Editor obsolete. The dev is exceptionally active as well. I was asking about a bug in his discord once and he patched it as we spoke.

[ykonstant]

Whelp, I tried my best to install imhex into my arch system with no success; the AUR packages fail to build and the -bin crashes with a glfw error. The AppImage runs but doesn't save settings after exit. This sucks, because it seems like a very nice project.

[special-K]

Should be fixed with 1.35.3 now. There was a permissions issue leading to config folders not being created.

[carrja99]

Gave me a flashback to my middle school days when I used a hex editor to modify my saved game files.

[Dwedit]

I still use HXD for most cases, but whenever I need to work with encoded text, I use a fork of MadEdit instead. MadEdit has no problem with multibyte characters, whether it's UTF-8, UTF-16, or Shift-JIS.