Binary file editor. Hex editor

This article will talk about working in the free hex editor Free Hex Editor Neo, using the example of editing a file BkEnd.dll from delivery for correct operation this system with .

1. A little about hex editors and files

As you know, any file stored on a computer’s hard drive is a sequence of machine words - bytes. A byte, in turn, consists of 8 bits, each of which can take the value “0” or “1”, which means that one byte can take 2 8 = 256 values ​​in the range from 0 to 255. The number is 256 10. written in the hexadecimal system, is a round three-digit number - 100 16, i.e., to represent any number from the range 0-255, no more than 2 digits will be required. This means that it is very convenient to write the value of each byte as a two-digit number in the hexadecimal number system.

The hex-editor shows us the file the way the machine “sees” it, namely, as a sequence of bytes. For example, opening a file in an editor, we will see a matrix consisting of 16 columns and the number of rows depending on the file size. Each matrix value corresponds to one byte, written in two-digit hexadecimal number. By changing the value of the desired byte, we can, accordingly, change the file itself.

In addition, next to the table we can see:

• To the left of the matrix a line of numbers is displayed: each line corresponds to a number indicating the address/offset of the first byte of this line. The address step is equal to the number of columns.
• Another ruler is displayed at the top of the matrix: above each column the offset of the byte in this column relative to the first byte of the corresponding line is displayed. The sum of the number corresponding to the i -th row and the number corresponding to the j -th column is the address/offset of the byte (i;j) located at the intersection of the taken row and the taken column.
• To the right of the matrix the same data is displayed, but in a different interpretation. The most common alternative is to display data as ASCII text, with bytes whose values ​​correspond to non-printable characters displayed as dots (·). You can also edit values ​​in this area.

2. Install Free Hex Editor Neo

For example, I need a byte with an offset 000d9cca write value eb. To do this, I find the row “000d9cco” and column “0a”, double-click on the desired cell and enter a new value.

Proceeding similarly, I make the following changes:

1. To fix the error " MS required SQL Server 6.5 + Service Pack 5a or higher version!» change the fields:
   by offset 000d9cca meaning 83 change to eb
   by offset 000d9ccb meaning e8 change to 15
   by offset 000db130 meaning 83 change to eb
   by offset 000db131 meaning e8 change to 10
2. To fix the error " The sort order set for the database differs from the system one!»:
   by offset 0018a79d meaning 75 change to eb
3. To fix the error " Incorrect syntax about keyword"TRANSACTION»
   Phrase DUMP TRANSACTION %s WITH TRUNCATE_ONLY, which is located at the offset 002856B0 replace with a phrase ALTER DATABASE %s SET RECOVERY SIMPLE
4. To fix the error " The database cannot be opened in single-user mode", change the fields:
   by offset 0028549c meaning 64 change to 6b
   by offset 0028549d meaning 62 change to 70

After all changes are made, save the file by clicking " File» — « Save» .

Did this article help you?

Good day everyone.

For some reason, many people believe that working with hex editors is the domain of professionals and that novice users should not try them. But, in my opinion, if you have at least basic PC skills and an idea of ​​why you need a hex editor, then why not?!

Using the program this kind you can change any file, regardless of its type (many manuals and guides contain information on changing a particular file using a hex editor)! True, the user needs to have at least a basic understanding of the hexadecimal system (data in the hex editor is presented precisely in it). However, basic knowledge of it is taught in computer science classes at school, and probably many have heard and have an idea about it (therefore I will not comment on it in this article). So, here are the best hex editors for beginners (in my humble opinion).

1) Free Hex Editor Neo

One of the simplest and most common editors for hexadecimal, decimal and binary files under Windows OS. The program allows you to open any type of file, make changes (the history of changes is saved), conveniently select and edit a file, debug and analyze.

It is also worth noting that good level productivity coupled with low system requirements to the machine (for example, the program allows you to open and edit quite large files, while other editors simply freeze and refuse to work).

Among other things, the program supports the Russian language, has a well-thought-out and intuitive interface. Even a novice user will be able to figure it out and start working with the utility. In general, I recommend it to everyone who is starting their acquaintance with hex editors.

2) WinHex

This editor, unfortunately, is shareware, but it is one of the most versatile, supporting a bunch of different options and features (some of which are difficult to find among competitors).

In disk editor mode, it allows you to work with: HDDs, floppy disks, flash drives, DVDs, ZIP disks, etc. Supports file systems: NTFS, FAT16, FAT32, CDFS.

I can't help but note convenient tools for analysis: in addition to the main window, you can connect additional ones with various calculators, tools for searching and analyzing the file structure. In general, it is suitable for both beginners and experienced users. The program supports Russian language ( select the following menu: Help / Setup / Russian ).

WinHex, in addition to its most common functions (which support similar programs), allows you to “clone” disks and delete information from them so that no one can ever recover it!

3) HxD Hex Editor

Free and pretty powerful editor binary files. Supports all major encodings (ANSI, DOS/IBM-ASCII and EBCDIC), files of almost any size (by the way, the editor allows, in addition to files, to edit RAM and directly write changes to the hard drive!).

You can also note the well-thought-out interface, convenient and simple function data search and replacement, stepwise and multi-level system backup copies and kickbacks.

After launch, the program consists of two windows: on the left hexadecimal code, and on the right - the text translation and contents of the file are shown.

Among the minuses, I would highlight the lack of Russian language. However, many functions will be clear even to those who have never learned English...

4) HexCmp

HexCmp - this small utility combines 2 programs at once: the first allows you to compare binary files with each other, and the second is a hex editor. This is a very valuable option when you need to find differences in different files, helps to explore the various structures of the most different types files.

By the way, after comparison, places can be colored in different color, depending on where everything matches and where the data is different. The comparison happens on the fly and very quickly. The program supports files whose size does not exceed 4 GB (quite enough for most tasks).

Except ordinary comparison, you can make comparisons in text form (or even both at once!). The program is quite flexible, allows you to customize it for yourself color scheme, specify buttons quick call. If you configure the program appropriately, you can work with it without a mouse at all! In general, I recommend that all novice “checkers” of hex editors and file structures should read it.

5) Hex Workshop

Hex Workshop - simple and convenient editor binary files, which differs primarily in its flexible settings and low system requirements. Thanks to this, it can be used to edit quite large files that simply do not open or freeze in other editors.

The editor's arsenal has all the most required functions: editing, search and replace, copying, pasting, etc. The program can perform logical operations, conduct binary comparison files, view and generate various checksums files, export data to popular formats: rtf and html.

The editor also has a converter between binary, binary and hexadecimal systems. In general, a good arsenal for a hex editor. Perhaps the only negative is that the program is shareware...

Hex Editor Neo Ultimate Edition is a binary, decimal and hexadecimal file editor for Windows that will be very convenient for developers and hackers. You will be able to select, view, edit, replace data, and the process itself will not take much time.

A special feature of the program is that it can work with very large files, has an unlimited level of undoing or redoing actions and viewing the history of changes with its subsequent downloading and editing.

Unlimited undo function.
Choice various objects.
Save and load the selection.
Search.
Search and replace.
Saving and loading history.
Creating packages.
Operations with the clipboard.
Various modes work.
Setting colors in samples.
Data inspector.
Bookmarks.
Structure viewer.
Statistics.
Base converter.
Creating scenarios.

At the first start, the program will notify you about the availability of the Russian language, ready for downloading from the official website.
Click "Yes".
In the window that opens, check the box next to the Russian language and click the "Download" button.
Next, select “Russian” in the drop-down list and click the “Apply” button.
A window will appear warning you that the translation was created by an open community and may not be entirely correct. The following options will be offered:
"Use this lang pack" - use this translation
"Access online repository" - go to change original translation in the repository
"Cancel" - Cancel installation
Select the first option, then click the "OK" button. After this, the program will request its own restart to apply the changes,
Click confirmation and the program will restart with a Russian-language interface.

Fixed Bugs
Multiple bug fixes
A number of reported and internally discovered errors have been fixed.
Fixed memory leak
Application allocated and never freed memory when recursive structures were used in Structure Viewer.
Incorrect rendering of floating-point numbers
Floating-point numbers in range (-1..0) were displayed incorrectly in Structure Viewer, Data Inspector and other components.
New Features
Explorer window settings persistence
Explorer windows now remember last recently used folder settings.
New format specifier
Structure Viewer now allows new format specifier "c" in format() function and attribute. It forces rendering of integer values ​​as single-byte or UNICODE character.
New directives in Structure Viewer
The following directives have been added to Structure Viewer definition language: $revert_to, $shift_by and $remove_to. They allow having look-ahead during structure binding.
New field attribute in Structure Viewer
New attribute forces exact match when rendering enumeration fields.
Updated Features
Changed automatic item collapsing logic
User-defined type does not collapse if it contains other user-defined types and all of them implement attribute. Previously, presence of other user-defined types caused automatic collapsing of a parent type during visualization.

Install the program, do not run it.
Copy Patch.exe to the folder with the installed program
Run, click the "Patch" button
Ready

A HEX editor is a program that can display information the way the computer “sees” it, but converting it into hexadecimal. By opening any file in similar application, the user will see a matrix consisting of columns and rows, the number of which depends on the size of the file in question. Therefore, if you change the byte values ​​in the editor, the contents of the open document will also change.

A little theory

Any data is stored in the PC memory in the form of machine words, otherwise - bytes. Each includes 8 bits (binary digits that take the value either "0" or "1"). By mathematical calculations you can understand that one byte can contain a number in the range from 0 to 255. If you convert 255 to hexadecimal, it is converted to FF. That is, to display any machine word it is very convenient to use the hexadecimal representation. Hence the name of the group of programs - hexadecimal editor.

Basic elements of programs

In addition to the matrix described above, the interface of the presented group of applications may contain other tools:

• Line numbering. Typically located on the left side of the application. Shows the offset of the first byte of the line relative to the beginning of the file.
• At the top there is often a similar strip of numbers indicating the byte offset of the relative left value in the line. By adding the values ​​of the strings, you can get the number of each byte.
• The right pane can display the same data as in the table, but as text for the user).

McAfee FileInsight

This HEX editor is completely free. Only works in operating systems Windows family. The product has all the gentleman's requirements, such as viewing and editing a file. At the same time, the program has a pleasant and user-friendly interface.

But standard features is the minimum that FileInsight can be used for. What's the maximum? We need to start with the ability to parse structures executable files. Is this not enough? Any selected fragment can be disassembled on the fly. One click - and incomprehensible numbers become a readable listing.

Among other things, this HEX editor provides many code processing algorithms to bypass the protection built in by developers. First of all, you need to pay attention to decoding obfuscation methods such as add, xor, Base64, shift. The scripts that the application comes with break such cryptographic protection with ease. Most of the actions can be automated by writing simple scripts in JS or Python. Sometimes there is no need to create anything new, because the base of these has been collected impressively.

Although FileInsight is considered one of the the best tools for reverse engineering, the program also has a huge drawback - the inability to process files larger than 400 MB.

Hex Editor Neo

This HEX editor comes in two versions: free and advanced. A product with a freeware license is of high quality, but unremarkable. Features include extensive interface settings and color schemes. The professional option provides more useful features, which are especially relevant during analysis

For example, the user is provided with the ability to decode programs encrypted general algorithms. In addition to this, there are functions that allow you to edit local resources ( RAM, NTFS streams, hard disks). Process automation is implemented using VBS and JS scripts.

However, the most main feature The program is a disassembler that can work with x64, x86 and .NET files. Another feature not provided by competitors is the creation of a patch based on a comparison of two executable binaries. It's certainly impressive, but when compared to FileInsight, Neo still falls short. However, NEO can handle large files.

Hiew

Hiew HEX editor does not have free version. The development is carried out by a team from Russia. The product's history dates back to the days of 16-bit applications for DOS and Windows 3.1. Hiew is often used by computer and computer professionals. information security. The reasons are clear: the full range of possibilities for editing and viewing executable binary Windows files, as well as compiled Linux programs(ELF).

Another notable feature that helps in reverse engineering is Hiew's built-in disassembler and assembler. Moreover, they work with both x86 and x86_64 applications, processor instructions are also supported. The editor copes with large files without any difficulties, allows you to execute low level change data on physical HDDs.

A large number of actions can be automated. To do this, programmers have built in the ability to create scripts, keyboard macros and API functions that are used to call internal procedures from external applications. But Hiew still did not achieve an unconditional victory in the field of hexadecimal editors. Its interface is completely made in the DOS style, and windows are rendered (or the console, if we talk about Linux systems).