These hex editors allow you to change hexadecimal values, thereby allowing users to modify file behavior even if they don’t have access to source code. However, the data represented by a hex editor is not exactly human readable. Reading and interpreting hexadecimal values to infer program logic and behavior is not an easy task by any means and it takes considerable efforts to find values and make even the smallest of change. A hex editor is one of the first tools used while reverse engineering a file.
Xxd
Xxd command allows you to dump hexadecimal data from a binary file. It can also reverse dump the hexadecimal data into a binary file, thus making it a useful command line hex editor. It is available in repositories of almost all major Linux distributions, usually as a part of the Vim text editor package.
To dump hex data from a file, run a command in the following format:
To convert a hexdump to binary, use “r” switch:
You can explore all of its options by running the two commands mentioned below:
$ man xxd
Jeex
Jeex is an open source hex editor that can view and edit binary files. It can present data in binary, ASCII, hexadecimal and octal formats. It can be used to find and replace values in a variety of formats, explore data types and parse strings. It can also be used to view differences between two binary files.
You can install Jeex in Ubuntu by using the command mentioned below:
Jeex is available in repositories of all major Linux distributions, so you can install Jeex from the package manager. You can also compile a build from source code available here.
GHex
GHex or “GNOME Hex Editor” is part of the GNOME3 application stack and is available in default repositories of most Linux distributions. It can present data in both hex and ASCII formats and you can edit and save your changes to the original binary file. You can also use it to show a table of values converted into different notations.
You can install GHex in Ubuntu by using the command mentioned below:
GHex is available in repositories of all major Linux distributions, so you can install GHex from the package manager. You can also download it from the Flathub store.
wxHexEditor
wxHexEditor is a hex editor that is specially designed to handle large binary files whose size can run in GBs. Its other features are on par with GHex and Jeex as it can both modify contents of a binary file and save them into the original file.
You can install wxHexEditor in Ubuntu by using the command mentioned below:
wxHexEditor is available in repositories of all major Linux distributions, so you can install wxHexEditor from the package manager. You can also compile its executable binary file from source code.
Okteta
Okteta is a hex editor written in C++ and Qt libraries. It is part of the KDE application suite and it features a multi-pane layout for better visibility and readability of binary data. Okteta’s main features include multiple data views, dockable panes, numerical and character encodings, tabbed views and so on.
You can install Okteta in Ubuntu by using the command mentioned below:
Okteta is available in repositories of all major Linux distributions, so you can install Okteta from the package manager. You can also download it from the Flathub store.
Hexedit
Hexedit is an open source command line tool that can view and edit binary files by presenting data in hexadecimal and ASCII formats. It supports searching data by values and can show scrollable output. It also accepts numerous keyboard shortcuts to navigate through the hex data. Hexedit also features useful editing shortcuts for copying, pasting and selecting the data.
You can install Hexedit in Ubuntu by using the command mentioned below:
Hexedit is available in repositories of all major Linux distributions, so you can install Hexedit from the package manager. You can also compile its executable binary file from source code.
To open a binary file in Hexedit, use a command in the following format:
To learn more about its usage, run the following two commands:
$ man hexedit
Hexer
Hexer is a command line hex editor that supports vi-like interface and keybindings. It can show multiple buffers and supports auto-completion. It can also use RegEx expressions to search data and allows users to undo their changes.
You can install Hexer in Ubuntu by using the command mentioned below:
Hexer is available in repositories of all major Linux distributions, so you can install Hexer from the package manager. You can also compile its executable binary file from source code.
To open a binary file in Hexer, use a command in the following format:
To learn more about its usage, run the following two commands:
$ man hexer
Conclusion
Hex editors are really useful to view binary data of pre-compiled files whose source code is typically not available. However, viewing hex data, finding right values, understanding patterns and editing data can be an extremely difficult task as often human readable data is not available. In Spite of these challenges, developers often use hex editors to reverse engineer binary data.