Home Graphics

How To Use A Hex Editor

A hex editor is a great way to read files, find file signatures, and can be fun to play with. This guide will just focus on learning how to use the hex editor and will not cover things like file signatures.

Getting a hex editor

There are many different hex editors out there with their own advantages and disadvantages. Some will work for Windows while others may only work with Mac, Linux, and or BSD. For the purpose of this lesson we will be useing Frhed which is a free hex editor for Windows users, most of what I say here though will aply to other hex editors as well just with different controlls. If you already have one or have found one you'd rather try out you can skip to the next section. To get started first go to this link here Frhed and click on the most recent stable release download. Once on the download page you want to click on the green download button that says Frhed-1.7.1-exe.7z at the bottom. Once downloaded click on the setup button and follow the prompts shown. Now we are ready to begin our lesson.

Typing with the hex editor

One of the most important things to know about hex editors is that there are two different sections. The section on the right is the human readable side shown in plain text. The left section on the other hand is written in hex code which is the foundation for every character you've ever typed in. At the bottom of this page I will include the basic hex codes that you'd use most often as there so many characters out there it would be impossible to list them all on this page alone. To give you a basic idea of how this works lets look at how you'd display numbers via hex code. All number characters would start with 3 the number you put afterwords would determine the number that gets displayed. For example 30 displays 0 on the human readable side. 35 displays 5 you get the point. Of course just typing from 30 - 39 isn't the end of the characters begining with 3. This goes all the way from 3A - 3F with A comming right after 9. Contrary to belife you may have 3A does not display A but rather : the A does not begin till 41 which yes just like in the real world goes in alphebetical order till it hits 5A marking the end of the capital letters. For lower case you'd have to look from 61 - 7A. Knowing this if you haven't opened up the hex editor already go do so and just play around with this info in any file. Note as this can corrupt certain files such as image files please only edit the hex vaules on files that are not important or create a test file for this purpose. Another thing to keep in mind is that once a hex vaule is added in it can only be altered into a different character without going into a text editor such as notepad.

Finding a hex vaule

This next tool is particularly useful for those who wish to get into data recovery or digital forensics. Lets say you open up a very large file and or you are looking for a very specific hex vaule/digital signature. Thats where the find tool comes in to play. How you actualy find the hex vaule will vary on what hex editor you are useing. In the case of Frhed click on edit and in the menu go to Find and Replace and click on find. From there you'll want to type in < bh:hexnumber > for example if you wanted to find the hex vaule 39 you'd type in < bh:39 > and so on. To get to the end of a jpg file just type < bh:ff > < bh:d9 > this is the last hex vaule in all jpg files.

Final Toughts

This is just the basics of what a hex editor can do next time we will talk about file signatures so stay tuned for that one. As promised here is the basic guide of the common characters.

Hex Character Guide

20: Space

21:!

22:"

23:#

24:$

25:%

26:&

27:'

28:(

29:)

2A:*

2B:+

2C:,

2D:-

2E:.

2F:/

30:0

31:1

32:2

33:3

34:4

35:5

36:6

37:7

38:8

39:9

3A::

3B:;

3C:<

3D:=

3E:>

3F:?

40:@

41:A

42:B

43:C

44:D

45:E

46:F

47:G

48:H

49:I

4A:J

4B:K

4C:L

4D:M

4E:N

4F:O

50:P

51:Q

52:R

53:S

54:T

55:U

56:V

57:W

58:X

59:Y

5A:Z

5B:[

5C:\

5D:]

5E:^

5F:_

60:`

61:a

62:b

63:c

64:d

65:e

66:f

67:g

68:h

69:i

6A:j

6B:k

6C:l

6D:m

6E:n

6F:o

70:p

71:q

72:r

73:s

74:t

75:u

76:v

77:w

78:x

79:y

7A:z

7B:{

7C:|

7D:}

7E:~