Write a program in a hex editor.

Wallpaper HxD Hex Editor is a data editor with support for ANCI encoding. The application uses hexadecimal representation for any opened files and can work with elements random access memory , saving changes to the hard drive. Allows you to search and replace values ​​automatically or manual mode . Includes tools for data export, creation checksums

and erasing code fragments.

The program can divide files into parts of the required size and supports processing a large amount of information. Uses a modular interface with the ability to view standard and hexadecimal code. Allows you to cancel any changes made, contains navigation tools by context and line address.

The HEX editor is capable of interacting with any type of file and can be used to search and replace executable values ​​of running processes.

Download the full Russian version of HxD Hex Editor for free from the official website without registration and SMS.

• System requirements
• Supported OS: Windows 8.1, Vista, 10, 8, 7, XP

Bit depth: 64 bit, x86, 32 bit

Like Windows Notepad. Moreover, if you open a binary file with a text editor and save it to disk, in most cases the file will be corrupted and will not run. To make correct edits, you must use hexadecimal editors (hex), which are sometimes also called binary editors.

Most ordinary users are unlikely to have any tasks or needs to use hexadecimal editors. However, for tech-savvy users, such editors can be indispensable tools. Note : As a fact, but at one time, to edit standard asp.net 1.1 installers, it was necessary to adjust binary code

. For example, in order to make one of the controls a password entry field. IN this review

We have collected some of the best free hex editors for different needs.

There are several excellent free hex editors, ranging from small and simple to complex products that are comparable to commercial solutions. However, the hex editor category is one of those categories where personal needs and preferences are so important that comparing products is not only difficult, but also pointless. Therefore, you should not assume that the products are arranged in descending order.

HxD is an excellent hexadecimal hex editor

One of best utilities for editing binary code is . Firstly, the program is portable and does not require installation, which is especially important if you often need to edit executable files. Secondly, it has a nice interface. Third, HxD processes large files without delays or screen freezes. Plus, add to this the ability to have an unlimited edit history, quick search and replacements, comparison binary files, full support for ANSI, DOS/IBM-ASCII and EBCDIC. And a dozen more possibilities, some of which will be listed below. HxD also allows you to edit not only the disk, but also the RAM. As a fact, such a set of capabilities makes the program a dangerous toy in the hands of novice users. In addition, security applications may react to its actions in the same way, but experienced users understand that this happens due to the specifics of accessing data and the use of potentially dangerous functions.

Overall, HxD is great for those who frequently deal with various binary codes.

Other features and characteristics:

• Secure access to files that other programs use
• Checksum generator: Checksum, CRCs, Custom CRC, SHA-1, SHA-512, MD5, ...
• Export data to various formats
• Inserting code templates
• Ability to safely delete files.
• Splitting or merging files
• Different types of groupings in columns (1,2,4,8,16 bytes)
• Highlighting changed data
• Quickly jump to an address
• Support for copying clipboard data from other programs: Visual Studio/Visual C++, WinHex, HexWorkshop, ...
• Bookmarks
• And much more...

Hex editor Hexplorer is an analogue of HxD with the ability to view images when analyzing steganography

Another great hex editor is open source. The program has a number unique features, which also make it a powerful binary image editor. This means you can look at everything graphic files not only in terms of their visual representation, but also their binary code. Of course, it is difficult to imagine editing pictures in hexadecimal in everyday life. However, it can be used for purposes such as steganography.

Overall, Hexplorer is suitable not only for those who frequently edit binary code, but also for those who use non-standard ways to use binary code.

Main features and characteristics:

• Six color schemes interface for various tasks.
• Unlimited command history
• x86 disassembler
• Import and export to 20 different binary file formats, including Intel Hex, Motorola S-Record, Atmel standard, etc.
• Ability to find recurring patterns in data
• Viewing Images
• Filtering text from binary data
• Boyer-Moore search algorithm
• Quick navigation to addresses
• Allows you to create structures simple types data, such as integers or floating point numbers
• Pseudo-random number generator
• Allows you to record macros (scripts) to automate tasks

Other hex editors

There are other hex editors that are also worthy of attention and may come in handy.

Hexadecimal editor XVI32 simple and convenient

XVI32 is a free hexadecimal editor whose name comes from the Roman numeral XVI (16).

• Supports scripts to automate tasks.
• Search by pattern
• ASCII/ANSI
• Character conversion based on user definitions
• Writing individual blocks to a file
• And other possibilities...

• Stores open file in memory, so there will be problems with large files.
• As such, there is no command history. This means that any changes you make are made "as is" and you will have to write them down or remember them.

Supports Windows 9x/NT/2000/XP/Vista/7

Hex editor HexEdit with a specialized calculator

HexEdit is another free binary editor from MiTeC.

• No need to install (portable)
• RAM and disk editor
• Specialized calculator
• Can compare files
• Can dump data from RAM to disk (create a dump)
• And others...

• Stores open files in memory

Supports Windows 2000 - Windows 7

Cygnus Free simple hex editor

Cygnus Free is a free hex editor that is one of the older versions of the commercial editor. Therefore functionality is limited.

• Fast and easy to use
• Quick search and replace
• Drag & drop
• And other possibilities...

• Stores an open file in RAM with all the ensuing problems
• Technical support from free version No
• Trimmed for functionality

Supports Windows

Quick Selection Guide (Links to download free hex editors)

HxD

Hexplorer

Now there will be a lot of material on the topic of what data consists of and how it can be edited. Many people know that any file on a computer (picture, text or multimedia) is a binary code - zeros and ones. To edit such files use HEX editors– an application that edits data consisting of byte code. Bytes in the editor are presented in hexadecimal format.

File extension

The problem is the huge number of file types and at first it is not clear how operating system defines text, multimedia or archive and other types of data. As you know, the system identifies a file using an extension added after the name, for example, “.exe”, “.txt” and others.

The settings in the OS are flexible, which means the extension of any file can be deleted, but then the operating system will not be able to open it, it will not understand which program to launch it with. In this case, the logical structure of the object will not change. The image shows text file, and next to it is the same thing, but without an extension and its icon is white.

If an object without an extension remains the same file with logical set symbol, which means the extension does not define its type, but then what? There is such a thing as format- this defines the type, it is also a specification of the data structure. Expansion is a completely different term. What to do if the user initially came across a file without an extension, but urgently needs to open it, and with what is unknown?

Descriptors

All files can be roughly divided into two components - a header, which contains object identification data, and various metadata. The second component is the “body” of the object, with the help of which the type of the object and parts of the header, which has the name of the descriptor, are determined. Two popular descriptors – ASCII And HEX. The second option is analyzed using the editors mentioned at the beginning.

The first ASCII method is defined using text editor, for example, Notepad++, however, it is worth considering one point - some sets of bytes cannot be converted to ASCII format, which means it is recommended to use HEX editors. By launching any file using such a utility, the window will display a matrix view with a sequence of bytes, where one byte is contained in one of the cells. Information about the descriptor is usually found in the first 3 cells, rarely in more quantities. Cells are counted horizontally. The data displayed in the cells is presented in hexadecimal code.

Decryption of the descriptor

To understand what kind of data is there, you need to decipher the code. To do this, you will need a special service that determines file formats, for example, open-file.ru. But there are other resources that are easy to find on the Internet. After uploading the file to the site, the data will be analyzed and then the result will be displayed. A table with the type, format and description of the file will appear below.

What we discussed above is the use of HEX editors. Now let's understand the ASCII code. This code can be analyzed using the same open-file.ru. In other words, both codes are checked on the resource and nothing actually needs to be entered.

Sometimes the format is not so easy to determine. This applies to ASCII headers. The fact is that the first few characters may be related to file extensions, and maybe to several formats.

Of course, there is an option to define the format. Multiple rows will be used for analysis rather than just one. Then any of the elements located there will, in any case, indicate the type of the object.

What else can you do with the HEX editor

In addition to the fact that HEX editors help analyze any file, it is possible to:

1. work with disk images;
2. edit sections;
3. change the contents of RAM;
4. change the virtual address space of the process, etc.

For example, utilities of this type are used in software development. When you need to enter data after compiling the program, but you don’t want to recompile it. Any program code can be changed using a HEX editor. Of course, you need to be able to do this and find the necessary data. In this way, they seek to correct errors in the code, or use it for hacking and cheating. This means that HEX editors are widely used.

Which HEX editors to use

There are many programs for editing data, and here they are presented below:

Popular utility for Windows. Using it, the user will not be able to open any type of file and change it. If something is edited incorrectly, the utility has a history of changes and you can always return to the original state.

The tool works very quickly, does not weigh much, and is capable of working with large files. The interface is simple and suitable for beginners, there is a Russian language.

This editor can be used in the demo version for a while, and then you need to purchase it. The tool is universal, where many interesting options are found.

It is possible to work not only with files, but also with hard drives, flash drives, optical discs and even floppy disks. All file files are supported Windows systems. Supports partition cloning and complete removal data beyond recovery

If you are a beginner, then this program will be enough for you, especially since in the Help section there is an option to switch to the Russian-language interface.

The utility is 2 in 1, as it has a file comparison function and a built-in HEX editor. Sometimes you may need to compare these files to determine differences and similarities, and analyze the structure of objects in different formats.

If there is a difference in two files, the areas on the matrix will be painted in a certain color, and the comparison itself takes place in a matter of seconds. However, files no larger than 4 GB are suitable for analysis.

The utility itself has the ability to change the interface. Which means the user can customize it for himself. The work will happen faster.

This thing comes free, but it can work with large data of any formats and encodings. It is possible to change the RAM and hard drive.

The program combines hexadecimal code output and ASCII text output. The interface for the English interface is quite simple, so working with it will not be difficult, especially if you have already worked in similar editors.

If a file does not open in one editor, then it will open in this one. That's why I've given here a list of several utilities. The specified tool is responsible for opening binary files. There are a lot of settings, but system requirements available for any computer.

Working in this editor is as simple as printing in Word. There are options for comparing files, their checksums and exporting analysis to various formats, for example, html.

If you need to convert one code to another number system, then Hex Workshop has a converter. The program is shareware, which can be considered one of the disadvantages.

Now you have learned what HEX editors are and why they are used. In the future I will try to write articles on working with them, for example, when you need to edit a file.

NOTE
The pictures are not shown on this page, but you can find them in the book.

What we will do now is, from my point of view, very interesting. This will be your first program in machine code (and, most likely, the only one))).

Assembly is a language low level, but still a language. Have you tried writing a program in machine code? Let's try it now.

You can write a program without any assembler-compilers or other tools - using any hex editor (or hex editor or hex editor).

Still, parsing programs in a hexadecimal editor is very useful. Especially for those who are going to work with electronics - after all, microprocessors do not understand either Pascal or C++. Although there are special devices and programs that “explain” these languages ​​to them.

To get started, you'll need a hex editor. You can use whatever you have on hand. However, I will be using the already mentioned McAfee FileInsight v2.1. This hex editor can be downloaded for free. All the actions described below are valid for this editor.

So, you have a hexadecimal editor installed. Let's launch it. Click on the OPEN button, find one of the COM files we created, for example, debug_1.com, and load it into the editor.

When the file is loaded, you will see the following in the editor (see also Fig. 1.12):

00000000 B4 02 B2 41 CD 21 CD 20 ...A.!. You can open two other files we created: mycode.com (created in emu8086) or ATEST.COM (which we created in the section). You will see the same thing. This means that all assemblers produce the same machine code. That is, the differences in the text of the programs are not fundamental - they are due only to the differences in the assemblers themselves.

NOTE
If in your case you see a different picture, then either you have opened a different file, or you are viewing it in text mode. In the latter case, click the View as Hex button on the toolbar (see Figure 1.12).

What do these numbers mean?

Everything is clear with zeros - this is the first memory cell in which the number B4 is written. This number will then be written to address 0100h (for the COM file). The line must contain 16 numbers, each of which consists of two digits. Numbers are written in hexadecimal form. But our program is small - only 8 bytes, so we have 8 numbers.

Well, what is B4? This is the command: “Enter a value in the AN register.” What value do we enter? Correct: 02 (the next number on the line).

AX=0200 BX=0000 CX=0000 DX=0000 SP=FFEE BP=0000 SI=0000 DI=0000 DS=0B72 ES=0B72 SS=0B72 CS=0B72 IP=0102 NV UP EI PL NZ NA PO NC 0B72:0102 B241 MOV DL,41 See B241 in the last line? Sounds like a familiar combination? This is the MOV DL command code, 41.

All that remains is to deal with the mysterious characters at the end of the line. But here everything is simple: each digit in the number corresponds to a character code in the ASCII table, and these characters are output in the same sequence as hexadecimal digits. In this text, some characters are replaced by dots (.) - these are simply codes for non-alphabetic characters.

Well, now let’s write and create our thoroughly studied program without assemblers and linkers. Open the editor, create a new file (to do this, click the NEW button on the toolbar), then click the View as Hex button and enter the data:

00000000 B4 02 B2 41 CD 21 CD 20 Save the file under the name, for example, hex_1.com. All. The program is ready. Now you can launch it and once again admire your creation. The result will be the same as in all previous cases.

And another pleasant surprise from the McAfee FileInsight v2.1 editor - it has its own disassembler! If you load an executable file into the editor, and select the DISASSEMBLY tab in the lower left corner, you can see source loaded program in assembly language (Fig. 1.12).

Why do we need hex editors and disassemblers at all? It's so difficult. Yes, it's not easy. However, hackers don't think so. It is with the help of hex editors and disassemblers that they break programs. They find the places they need in the code and fix them in accordance with their hacker whims.

Of course, we are not hackers. We won't break programs. However, disassemblers and hex editors are very useful for law-abiding programmers. They are used, for example, for debugging, studying machine codes, etc. For example, you know what a command looks like in assembly language, but you want to know its machine code. If there is no documentation, then there is only one way out - a hexadecimal editor and/or disassembler. However, it should be taken into account that not all commands fit into two-number machine code. Some commands are quite complex and require more numbers to be represented in machine code.

This article will talk about working in the free hex editor Free Hex Editor Neo, using the example of editing a file BkEnd.dll from the delivery for correct operation of this system with .

1. A little about hex editors and files

As you know, any file stored on a computer’s hard drive is a sequence of machine words - bytes. A byte, in turn, consists of 8 bits, each of which can take the value “0” or “1”, which means that one byte can take 2 8 = 256 values ​​in the range from 0 to 255. The number is 256 10. written in the hexadecimal system, is a round three-digit number - 100 16, i.e., to represent any number from the range 0-255, no more than 2 digits will be required. This means that it is very convenient to write the value of each byte as a two-digit number in the hexadecimal number system.

The hex-editor shows us the file the way the machine “sees” it, namely, as a sequence of bytes. For example, opening a file in the editor, we will see a matrix consisting of 16 columns and the number of rows depending on the file size. Each matrix value corresponds to one byte, written as a two-digit hexadecimal number. By changing the value of the desired byte, we can, accordingly, change the file itself.

In addition, next to the table we can see:

• To the left of the matrix a line of numbers is displayed: each line corresponds to a number indicating the address/offset of the first byte of this line. The address step is equal to the number of columns.
• Another ruler is displayed at the top of the matrix: above each column the offset of the byte in this column relative to the first byte of the corresponding line is displayed. The sum of the number corresponding to the i -th row and the number corresponding to the j -th column is the address/offset of the byte (i;j) located at the intersection of the taken row and the taken column.
• To the right of the matrix the same data is displayed, but in a different interpretation. The most common alternative is to display data as ASCII text, with bytes whose values ​​correspond to non-printable characters displayed as dots (·). You can also edit values ​​in this area.

2. Install Free Hex Editor Neo

For example, I need a byte with an offset 000d9cca write value eb. To do this, I find the row “000d9cco” and column “0a”, double-click on the desired cell and enter a new value.

Proceeding similarly, I make the following changes:

1. To fix the error " MS required SQL Server 6.5 + Service Pack 5a or higher!» change the fields:
   by offset 000d9cca meaning 83 change to eb
   by offset 000d9ccb meaning e8 change to 15
   by offset 000db130 meaning 83 change to eb
   by offset 000db131 meaning e8 change to 10
2. To fix the error " The sort order set for the database differs from the system one!»:
   by offset 0018a79d meaning 75 change to eb
3. To fix the error " Incorrect syntax about keyword"TRANSACTION»
   Phrase DUMP TRANSACTION %s WITH TRUNCATE_ONLY, which is located at the offset 002856B0 replace with a phrase ALTER DATABASE %s SET RECOVERY SIMPLE
4. To fix the error " The database cannot be opened in single-user mode", change the fields:
   by offset 0028549c meaning 64 change to 6b
   by offset 0028549d meaning 62 change to 70

After all changes are made, save the file by clicking " File» — « Save» .

Did this article help you?