HexFiend - A fast and clever open source hex editor for Mac OS X(ridiculousfish.com)
ridiculousfish.com
HexFiend - A fast and clever open source hex editor for Mac OS X
http://ridiculousfish.com/hexfiend/
8 comments
Just wanted to say, thanks so much for HF! Reading source of HF1 (and more recently HF2) taught me more about AppKit than anything else and not to mention a pleasure to use. (I emailed you about writing a data analysis plugin a few years ago to which you replied a very thorough and informative write up. It's still on back burner heh)
Also, your blog rocks.
Also, your blog rocks.
First of all, I love your app. It has been _invaluable_ to me in my work.
I do however, have a few UI niggles you might be interested in hearing. When I jump to an offset, I have the hardest time spotting the cursor. There's that nice brief yellow line flash so I can see what line the cursor is on, which is already a lifesaver, but I just can't spot the little blinking line, the grey on white just doesn't stand out enough I guess. I have to click on the line and basically binary search down to the right offset. Some sort of call out for the quad of bytes containing the cursor as well as the line would be _awesome_.
Also, since I'm mostly looking at scientific data I'm trying to parse, it is _awesome_ to hear that you've added signed floats and integers.
Let me just reiterate, thanks for this app.
(Also, apologies if I'm referring to an old version - I don't know offhand which one I have)
I do however, have a few UI niggles you might be interested in hearing. When I jump to an offset, I have the hardest time spotting the cursor. There's that nice brief yellow line flash so I can see what line the cursor is on, which is already a lifesaver, but I just can't spot the little blinking line, the grey on white just doesn't stand out enough I guess. I have to click on the line and basically binary search down to the right offset. Some sort of call out for the quad of bytes containing the cursor as well as the line would be _awesome_.
Also, since I'm mostly looking at scientific data I'm trying to parse, it is _awesome_ to hear that you've added signed floats and integers.
Let me just reiterate, thanks for this app.
(Also, apologies if I'm referring to an old version - I don't know offhand which one I have)
That's a good suggestion. Please feel free to add any requested features or bugs you find to the wiki page at http://ridiculousfish.com/hexfiend/docs/wiki/Bugs/Bugs . Thanks!
Two questions:
1) Will it be available on the Mac Appstore? :)
2) You mention that adding some bytes on the end is instant, and so is modifying bytes in the middle. It seems that for most filesystems (and definitely HFS+), it should be possible to insert data in the middle of a file (not really that common in most of my hex editing habits, but maybe for some people?) without incurring much of a cost either. If the inserted data is between extents, then you simply stick a new extent between them, and if it's within an existing extent, you can split it in constant time and do the same thing. Do you know of any Mac OS APIs provide low-enough-level access to do this? Or does it not seem feasible for some other reason?
1) Will it be available on the Mac Appstore? :)
2) You mention that adding some bytes on the end is instant, and so is modifying bytes in the middle. It seems that for most filesystems (and definitely HFS+), it should be possible to insert data in the middle of a file (not really that common in most of my hex editing habits, but maybe for some people?) without incurring much of a cost either. If the inserted data is between extents, then you simply stick a new extent between them, and if it's within an existing extent, you can split it in constant time and do the same thing. Do you know of any Mac OS APIs provide low-enough-level access to do this? Or does it not seem feasible for some other reason?
Thanks! I was looking for something like this
Sort of old news, I guess, but worth saying: this is one of the 3 most-used tools at Matasano. It's a really excellent piece of code.
What are the other two tools? Would my guess that another one of them was either otool, class-dump, nm or ld be right?
IDA and Burp, maybe? Not everyone uses IDA and not on every project. Burp's definitely #1.
What makes Burp stand out? Every time I need something like that I end up downloading 17 free and pay/trial tools, mucking about till one works, mumbling 'God, I'd pay not to have to do that again' and forgetting about it, till next time.
Burp is basically the industry standard. It's the tool most widely used by professionals on web pentests. I could do a detailed comparison, but it'd be 3-4 years dated; I used a lot of tools back in '06, but haven't looked back since then.
The thing that sets Burp apart from (say) Tamper Data in Firefox is the fuzzer (Burp calls it the "intruder"). The free OWASP WebScarab also has a fuzzer, but it's not as good.
The thing that sets Burp apart from (say) Tamper Data in Firefox is the fuzzer (Burp calls it the "intruder"). The free OWASP WebScarab also has a fuzzer, but it's not as good.
I was a little apprehensive of the last release being 7/30/09, and no mention of 10.6, but it looks like it's still under development somewhat - The svn.ridiculousfish.com/HexFiend2/experimental/ branch was last modified two days ago.
Is an Intel-only version and an update of the website in the plans somewhere?
Is an Intel-only version and an update of the website in the plans somewhere?
Is it better than 0xED ?
Don't work that much on the Mac anymore, always found 0xED quite nice.
That's quite interesting, what are the other two? And why specifically a Mac Hex editor?
We're an all-Mac shop, and HexFiend is the best hex editor on the platform (0xED is more featureful, though... but "lots of features" isn't what I want out of a hex editor).
Interesting. Is there any particular reason why you went all mac? We run a mix of everything for infrastructure, but it's pretty much 7 on the laptops, VMs for testing from.
I also want to know what the two other apps are :)
I also want to know what the two other apps are :)
>Interesting. Is there any particular reason why you went all mac?
Unix, works well, has some of the nicest apps out there is my guess.
(I split most of my work between my Mac and Linux)
Unix, works well, has some of the nicest apps out there is my guess.
(I split most of my work between my Mac and Linux)
did you guys ever modify it?
We've done all sorts of strange things to it over the years; 'yan is planning on embedding it wholesale into one of our projects, so that may be the direction we're going with it.
I hope they did; We tried this app, but ended up having to roll our own because of missing features. Of course, we were using it for hex display, not hex editing, so what we came up with was mostly better visualization of binary wire data (specifically, more custom data types than int and float)..
I prefer 0xED.app:
http://www.suavetech.com/0xed/0xed.html
http://www.suavetech.com/0xed/0xed.html
I hit "Post to Delicious" on this and noticed I'd already done so on March 28, 2006. The Internet is now officially too big by my reckoning :-)
Incidentally, the author was also the one who wrote this delightful piece: http://ridiculousfish.com/blog/archives/2006/05/30/old-age-a...
If you, like me, wonder about the Windows alternatives; Hexplorer ( http://artemis.wszib.edu.pl/~mdudek/ ) is a very nice and capable hex editor for Windows. The only downside is that it chokes on rather big files. Then again, I don't use it daily for my work, so I might be missing some big pros or cons.
Ye olde friend, ridiculousfish.com:
http://www.google.com/search?q=site:news.ycombinator.com+rid...
:-)
And couldn't help but notice in the results:
http://news.ycombinator.com/item?id=734727
http://www.google.com/search?q=site:news.ycombinator.com+rid...
:-)
And couldn't help but notice in the results:
http://news.ycombinator.com/item?id=734727
I'm not sure if Okteta is available for Mac as well, but it's a beautiful hex editor I use when on linux. WinHex is great on windows. I'll take a look if this might a good choice to use on my mac.
Okteta's beautiful from a user interface perspective, but like most hex editors it fails when trying to deal with large files. There are very few hex editors around that will open files that are larger than the amount of RAM that you have.
I'm very actively developing Hex Fiend, which is nearing a new release. Some major new features are bookmarks, support for text encodings (including multibyte, though sadly not variable width), support for opening files only readable by root, including device files (after authentication, naturally), and a visual binary diff (a true LCS diff). There's many other miscellaneous improvements and bug fixes, including the longstanding request of preserving the Undo stack after Save, when doing so would not require too much memory.
For those unfamiliar with Hex Fiend, the features that set it apart from other hex editors are:
- Very deep support for large files. Many other hex editors have some support for large files, but it's easy to get into a situation where they consume all your memory, or do some O(n) blocking operation that hangs the UI. Hex Fiend never does either.
- Natural Mac-like editing, including insertion and deletion, smooth scrolling, multiple discontiguous selection, anchored selection, coalesced undo, key bindings, lots more.
- It's provided as a framework which is easy to embed in other apps.
- It's open source with a permissive BSD style license.
Some have asked how Hex Fiend compares to 0xED. Not to pick on anyone, but I'll give some examples that illustrate Hex Fiend's strengths relative to 0xED (and most other hex editors):
1. Open a large file (say 5 GB), overwrite some bytes in the middle, add some bytes to the end, then hit Save. Hex Fiend will appear to save instantly because it makes the changes in-place, while 0xED will require time proportional to the file size as it writes the entire file to disk.
2. Search for some text. 0xED will block the UI until the text is found or the file is exhausted, while Hex Fiend performs the search in the background, including a progress indicator and cancel button.
3. Select everything in the file and choose Edit->Copy. Hex Fiend will do this instantly, while 0xED will require time and space proportional to the file size, as it attempts to read the entire file into memory. Now select all and hit the delete key. Hex Fiend again does this instantly, while 0xED will again try to read the file into memory (to service its Undo stack).
Let me know if you have any questions and I'll be happy to answer them in this thread!