Git Product home page Git Product logo

rehex's Introduction

rehex logo Reverse Engineers' Hex Editor

A cross-platform (Windows, Linux, Mac, BSD) hex editor for reverse engineering, and everything else.

An online copy of the manual can be accessed here: solemnwarning.net/rehex/manual/.

Features

  • Large (1TB+) file support
  • Decoding of integer/floating point value types
  • Inline disassembly of machine code
  • Highlighting and annotation of ranges of bytes
  • Side by side comparision of whole files or selections
  • Lua scripting support (API reference)
  • Virtual address mapping support
  • Support for common text encodings (ASCII, Unicode, ISO-8859-X, etc)
  • Import and export of Intel HEX files.
  • Bitmap data visualisation.
  • Binary Templates for automatically annotating data (similar to 010 Editor).
  • Bit editing/manipulation.
  • Checksumming of files/selections.

inline comments + data types demo

file diff demo

Installation

The Releases page has standalone packages for Windows and Mac, as well as installable packages for popular Linux distributions, or you can install them from a distribution package repository as described below.

The same packages are also produced for Git commits (look for the tick), if you want to try the development/unreleased versions.

Debian

First, you will need to add my APT signing key to your system:

sudo wget -O /etc/apt/trusted.gpg.d/solemnwarning-archive-keyring.gpg \
    https://repos.solemnwarning.net/debian/solemnwarning-archive-keyring.gpg

Add the following lines to your /etc/apt/sources.list file:

deb http://repos.solemnwarning.net/debian/ CODENAME main
deb-src http://repos.solemnwarning.net/debian/ CODENAME main

NOTE: Replace CODENAME with the version you're running (e.g. bookworm or bullseye).

Finally, you can install the package:

$ sudo apt-get update
$ sudo apt-get install rehex

Ubuntu

First, you will need to add my APT signing key to your system:

sudo wget -O /etc/apt/trusted.gpg.d/solemnwarning-archive-keyring.gpg \
    https://repos.solemnwarning.net/ubuntu/solemnwarning-archive-keyring.gpg

Add the following lines to your /etc/apt/sources.list file:

deb  [arch=amd64] http://repos.solemnwarning.net/ubuntu/ CODENAME main
deb-src  [arch=amd64] http://repos.solemnwarning.net/ubuntu/ CODENAME main

NOTE: Replace CODENAME with the version you're running (e.g. focal for 20.04 or lunar for 23.04).

Finally, you can install the package:

$ sudo apt-get update
$ sudo apt-get install rehex

NOTE: Ubuntu users must have the "universe" package repository enabled to install some of the dependencies.

Fedora

$ sudo dnf copr enable solemnwarning/rehex
$ sudo dnf install rehex

CentOS

$ sudo dnf install epel-release
$ sudo dnf copr enable solemnwarning/rehex
$ sudo dnf install rehex

openSUSE

$ sudo zypper ar obs://editors editors
$ sudo zypper ref
$ sudo zypper in rehex

FreeBSD

$ pkg install rehex

Building

Compiling REHex from source is described in COMPILING.md.

Feedback

If you find any bugs or have suggestions for improvements or new features, please open an issue on Github.

rehex's People

Contributors

bmwiedemann avatar c0bw3b avatar jubalh avatar learn-more avatar palob avatar regularitcat avatar scgtrp avatar solemnwarning avatar tectu avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

rehex's Issues

Resizing can get stuck in a loop

Seems to mostly occur when resizing back and forth around sizes that are far too small to display anything. Grab a corner and shake it like a madman, it'll eventually get stuck in a loop and consume memory at a frightening rate.

Vertical scrollbar values should be scaled

The vertical scrollbar currently operates directly on the number of lines in the rendered Document, this means that assuming the window is wide enough to display 20 bytes per line, you would encounter issues scrolling with files larger than a measly 43GB or so on most platforms.

We should instead split the whole range of lines into a limited number of segments which are then mapped to the scrollbar position, so dragging the bar moves the file by 1/1000th of its height or something, while the up/down arrows still scroll on a per-line basis.

Reworking of comments

Firstly, Document needs updating so that the authoritative store of comments is a NestedOffsetLengthMap or similar, like the highlighting prototype uses. Regions still need to exist to reflect what is there, but are to be considered transient.

Once that is done, a start of the following changes can be made:

  • Listing of comments outside the main Document view, perhaps also serving as bookmarks? Something like a wxListBox, or a tree to show where they are nested, or a Google Docs-esque thing where they float around to the right of the document, with loosely coupled scrolling? Searching of comment text too?
  • Comments can apply to a region of bytes rather than just a single point, they can also be nested, where annotating data structures.
  • Hiding of comment regions in the main Document view, either globally or on a per-comment basis, once hidden, comments would still be visible in the above view, and also perhaps as tooltips when hovering over the relevant bytes.

Any other ideas welcome...

Find dialog context is confusing

The "Find Text/Value/etc" dialogs are non-modal and associated with the Document that was selected when the dialog was opened.

If you switch tab and then carry on playing with the find dialog, it does things, but nothing appears to happen to the active document - because the search is running and the cursor is being moved in the invisible document.

Possible resolutions:

  • Hide find dialog(s) when a different tab is selected, make them visible again when tab becomes active.
  • Make dialog modal, disappear after first search and make "Find next" continue the previous search (downside: can't see/modify search parameters).
  • Create a "tool panel" under the tab rather than a dialog.

Default paths in Open/Save As dialogs

If the active document has a backing file, the directory containing it should be the default when the Open or Save As dialogs are spawned, if it doesn't have a backing file, then the last directory navigated to should be used.

Additionally, the filename in the Save As dialog should be initialised to that of the active document (if it has one).

Optionally indent annotated data

If enabled, ranges of bytes with a comment assigned should be split out into a separate range of lines which are indented to distinguish where they start/end.

Improve Document rendering performance

Depending on platform, text rendering seems to be relatively slow, and doing it with individual DrawText() calls moreso.

When rendering a data region, Document will optimise each column of "normal" text into a single DrawText() call, however bytes which are selected and/or highlighted (i.e. coloured) are rendered using a DrawText() call for each byte.

I don't think this is severe enough to worry about for now, but might be more of a pain to people on slower computers, or with wide windows/large "bytes per line" settings. On my Windows box here, maximising the window, disabling the ASCII view and dragging the scrollbar up/down like a madman is responsive. If I select everything, then do the same, there is a slight delay, not enough to be annoying, but this is a fairly fast machine.

At some point it could be worth implementing the line-at-a-time optimisation for coloured text as well, or perhaps maintaining a cache of pre-rendered characters and then blitting them. Needs some profiling.

Split searches between multiple threads

Support breaking large search ranges down into smaller chunks and farming them off to worker threads.

Current text search performance I'm seeing on this machine is ~100MB/s when compiled with -O2.

Selection is too eager

Clicking the mouse and holding for a fraction of a second is enough to start selecting, and the byte being hovered over will be selected even with zero mouse movement.

Selection should require the mouse button going down at one end of the byte/character, and not counting until the mouse has traversed a good portion of its width, like other software.

Inline comment display modes

Document-level setting with the following options:

Hidden - Don't display inline comments
Short - Only display first line of comment, and truncate if it doesn't fit in the virtual width
Full - Show full comments, current behaviour

Export range inc. comments to HTML

The ability to select a range, and then export it to a HTML document including colour formatting and comments.

Select X number of bytes, right click and select 'Export to HTML...'? Or copy it as HTML to the clipboard.

This would be very handy for documentation purposes.

Bitmap image data visualisation

This is an idea for a future tool panel. It would render selected data to the screen as a bitmap, including sliders for image width and pixel size, to aid in identifying bitmap images stored inside files.

Colours will be chosen at runtime to provide visible contrast between different values, but also to show similar ones (so a gradient should look like a gradient, for example).

"Find all" search button

The search dialogs should have a "Find all" button which finds and lists every match, possibly also with highlights/comments/etc.

Things to consider:

  • Huge files
  • Huge numbers of matches
  • Exporting listing
  • UI... should the matches go in the existing search dialog? Another window? A tool tab thing?

Copy comments across into different documents

When right clicking onto the comment into the comments section, provide a copy option (which will copy that comment inc. all nested comments as well. Which I can then paste into another document.

image

And add a button to copy here as well? If not might be worth looking at adding an option to right click the comment within the hex view and then provide a copy option there.

image

Comment range marker

Need some kind of visible marker showing comment boundaries in Document.

Perhaps a box around the bytes, but only when not highlighted? I feel too many things might end up adding their own indistinct boxes and highlights to the document.

This is in addition to #22.

Tool API

There should be a pluggable mechanism for adding new tools/functions rather than continually adding more hooks to MainWindow.cpp

Ideas for tools:

  • Relative value search (algorithm prototyped)
  • File (i.e. file(1))
  • Export selection
  • Import file
  • External tools for disassembly, images, audio, etc
  • Bit editor

Existing search and decode table could be updated to use this system.

Plugins would need to be notified of documents being opened/closed/modified, selection changed, etc. Would need to be able to add menu entries, key bindings, create windows/panels, etc and manipulate document. May be dynamically loadable the future, but probably all "plugins" would be statically linked into the binary at this point.

What about interfering with Document rendering process?

Not all file I/O errors are caught

Errors from some file read calls are not caught, which can lead to the editor crashing out on I/O errors or the file being truncated underneath us.

Decode floating point values

We should handle at least common (i.e. 32-bit and 64-bit IEEE 754) floating point values in the decode table.

Are there any other common encodings?

Support non-ASCII character encodings

For other 8-bit codepages, simply substitute the values going in/out.

For other sizes of fixed-length encoding, also narrow the width reserved for the text view.

For variable-length encodings like UTF-8, render multibyte characters at the position of their first byte, with spaces or some other indicator showing their length. Be wary of control characters (e.g. right-to-left) and also fullwidth characters (thanks Japan!).

Paste From and To

If I want to paste the same data over and over between two points in a file, having a function to paste from and then to would be super helpful.

Alternatively this could be a 'Set bytes...' function which has it's own dialogue, you enter the hex you want to set, the offset and the end offset, and whether or not it should 'repeat until end'.

Basically I'd want to zero out an entire file or whatever or a file within a package etc., just to give you a usage idea.

Pattern searching / pattern recognition

This is going to be a complicated feature, but the ability to perform a search for multiple hex values in sequence could be incredibly useful.

So for example, I have a package that contains multiple files of the same format but I want to see how many of X there are exactly - I know these files have the same bytes at the start or end - so I enter this information into the search and it highlights the hex values that match for me.

To do this, you might need some sort of search syntax, I'm not sure how this could optimally be introduced; heck maybe this is something for a plugin? But say as an example; 32:b, 32:b, 32:b would perform a search for three bytes in sequence that are equal to 32.

You could also skip so many bytes here as well (32:32i, 256, 32:b, 256, 32:32i).; this would check for a 32-bit integer of 32, skip 256 bytes, check for a byte with a value of 32, skip another 256 bytes and then finally read another 32-bit integer with the value 32.

Jump to relative offset

Allow jumping relative to the current cursor position by prefixing the value in the "Jump to offset" dialog with a plus or minus sign. Requires text in the dialog describing this.

Decode values as colours

Decode values using different pixel formats (24-bit RGB, 16-bit RGBA, etc) and show as coloured blobs in "Decode values" tab.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.