• Main
• User manual
• Hexadecimal viewer

Hexadecimal viewer

Overview

Hexadecimal viewer is an incorporated tool that facilitates low-level data analysis of files in hexadecimal representation. Please mind that all files are handled in a safe read-only mode, so the original data on the source never gets altered.

In order to examine hexadecimal contents of a file, select it in the main content area of the Explorer window and hit the "View" option under its thumbnail preview on the right-side pane. As an alternative, you may just double-click it or select it and press the "Enter" key.

Then, if necessary, switch to the "Hexadecimal contents" tab.

In the opened tab, you’ll see the main content area (1) at the center, the main toolbar (2) above it and the contextual line (3) together with the encoding box (4) below it.

1. Main content area
   The main content area of Hexadecimal viewer consists of four sections:

   • Byte address pane
     Depending on the selected address mode, this pane shows the offset for every column of bytes under it as a hexadecimal or decimal value. There are 16 columns by default, but it is possible to change their number: double-click the number next to the pane and enter a new value or use the arrow-like buttons to alter it.

   • String address pane
     In this pane one can check the position of the first byte in the corresponding line (the so-called offset). The button at the top of it allows switching between the hexadecimal and the decimal address modes ([HEX]/[DEC]). The address of a particular byte of data can be found at the crossing of the string and byte address panes.

   • Hexadecimal data pane
     This pane presents an array of hexadecimal bytes, i.e. the actual data content. Every byte is represented by two hex digits (from 0 to 9 and from A to F), each of which stands for 4 bits.

     

   • Text data pane
     This pane shows the hexadecimal data pane’s content in the form of a series of text characters in the encoding selected in the corresponding box right under it. The two panes are synchronized: when a byte or a range of bytes is selected in the hexadecimal view, its text representation on the neighbor pane gets highlighted respectively.

2. Main toolbar
   The main toolbar of Hexadecimal viewer offers a set of instruments to work with the data content presented in the main content area:

   

   • Previous location
     This tool helps to take one step backwards and return to the previous position of the cursor in the hexadecimal/text data pane.

   • Next location
     With this option one can take a step in the forward direction to the position of the cursor in the hexadecimal/text data pane it has been located at before the "Previous location" tool was used.

   • Go to…
     This option opens a dialog window where you can specify the parameters of the position you’d like to jump to in the hexadecimal data pane: offset, units (bytes, blocks of the defined size) and direction.

   • Mark position
     With this tool you can open a dialog window to save the current position of the cursor in the hexadecimal data pane, together with a custom comment about it. All marked positions are added to a special list that can be used to perform "jumps" to any of them. To open or hide the list, click on the "All positions" option in the dropdown menu of this tool. Please note that the list of marked positions will be lost once you close the software, unless you save it locally on your PC using the corresponding option at the top of the list pane.

   • Previous position
     Click it to go to the previous position in the list of marked positions.

   • Next position
     Click it to go to the next position in the list of marked positions.

   • Bind a structure
     This tool allows applying the previously specified structure template to the data block at the current cursor position in the hexadecimal data pane. One can add a template using the "Import" button of this tool’s dialog. Once the template is uploaded, you can have a look at its details in the above-mentioned dialog window using the "View details" button or in the Information pane that can be opened or hidden with the "Toggle Inspector panel" tool of the main toolbar.

   • Find data
     Using this tool you can look for a data pattern by its parameters. It lets you search within the text or the hexadecimal data pane. In addition, there is an option to perform an advanced hexadecimal data search employing a special syntax (only for experienced users).

   • Select range
     This instrument serves for specifying a particular range of data to be selected in the hexadecimal/text data pane for further operations.

   • 2.10 Copy
     This option opens a dropdown list of data copying modes. One can choose among the following options:

     

     • Copy raw data – to copy the raw unformatted data selected in the hexadecimal data pane.

     • Copy text – to copy the selected sequence of characters from the text data pane.

     • Copy Unicode – to copy the selected sequence of characters in the two-byte Unicode encoding.

     • Copy UTF-8 – to copy the selected sequence of characters in the one-byte UTF-8 encoding.

     • Copy hex text – to copy the data selected in the hexadecimal data pane as text.

     • Copy position – to copy the value of the current position of the cursor.

   • Refresh
     This function updates the information displayed in Hexadecimal viewer.

   • Toggle inspector panel
     Clicking on this tool opens the Information pane that presents more details about the currently selected position or data range. In order to hide it, press the same button once again.

3. Contextual line
   Here you can check the details of the cursor position in the hexadecimal/text data pane. The values it shows depend on the enabled address mode (hexadecimal, decimal). This line includes several elements:

   

   • Current position
     This field displays the address of the current cursor position. When double-clicked, it opens the "Go to position" dialog where you can specify the position you’d like to jump to. Additionally, you can use this window to copy the current position address to the clipboard.

   • Selected bytes position
     In this field you can find the positions of the first and the last byte in the range that is presently selected in the hexadecimal/text data pane. When double-clicked, it opens the "Define range to select" dialog where you can manually enter the first and the last positions for a new selection.

   • Selected bytes number
     This field shows the number of bytes in the currently selected range. When double-clicked, it opens the "Define range to select" dialog where you can manually define the number of bytes to be selected.

4. Encoding box

   

   This box indicates the encoding that is presently used for bytes representation in the text data pane. Click it to choose the necessary encoding from the drop-down list.

Exploring hexadecimal content

Hexadecimal viewer is an integrated tool for viewing the binary content of a file. To access it, just switch to the "Hexadecimal contents" tab of the File viewer window.

The content of the opened file is displayed in the hexadecimal and text data panes equipped with horizontal and vertical scroll bars.

When you put the cursor in any of these panes, it changes to a vertical line that allows selecting the position the further command will be applied to. The current cursor position is highlighted in dark blue, and its address appears automatically in the Current position field below.

The current cursor position can also be used as a starting point for range selection. If you select a sequence of bytes, the position of the first and the last one in the selected range is indicated in the Selected bytes position field, whereas its size in bytes is displayed in the Selected bytes number field.

When the cursor is located in one pane, for instance, in the Hexadecimal data pane, its position in the other one, in our example, in the Text data pane, gets highlighted in light blue. You may switch quickly between the panes with the mouse or the Tab key.

More details about the current cursor position can be found in the Information pane that gets visible once you hit the "Toggle inspector panel" option on the toolbar (or Ctrl+I keys). The pane itself consists of several sections that can be displayed or hidden with the plus/minus buttons next to their names:

Status information

Here you can find the addresses of the current cursor’s position and the selection of bytes. The values in it depend on the activated address mode (decimal, hexadecimal).

Current position – the address of the current position of the cursor. The tiny arrow button next to it opens the "Go to position" dialog window that lets you jump to another position.

Selection start – the first position in the selected range of bytes. The tiny arrow button next to it opens the "Define range to select" dialog window that allows specifying a new data range for selection.

Selected bytes – the number of bytes in the presently selected range.

Position as percentage – the value in percentage that is calculated for the address of the current position of the cursor in relation to the overall size of the currently opened file.

Offset in sectors – the current position’s address in sectors.

Structure information

The "Structure information" section appears when there is a structure template applied.

Type name – the name of the structure template that is currently applied.

Base position – the starting position of the currently applied structure template.

Structure fields – the structure fields of the structure template file specified by the user.

Raw data inspector

The "Raw data inspector" section presents the data selected in the hexadecimal/text data pane in different formats. You can add or remove certain data formats from the Inspector using the "Data inspector" option in the "Configuration" section at the bottom of this very pane. Just find the above-mentioned option and hit "Configure" in its drop-down list. The data formats activated by default are the following:

Byte – the hexadecimal value for the current position of the cursor.

Word – the hexadecimal values of two consecutive bytes, starting from the current position of the cursor, in the little-endian order.

Dword – the hexadecimal values of four consecutive bytes, starting from the current position of the cursor, in the little-endian order.

Qword – the hexadecimal values of eight consecutive bytes, starting from the current position of the cursor, in the little-endian order.

Big-endian word – the hexadecimal values of two consecutive bytes, starting from the current position of the cursor, in the big-endian order.

Big-endian dword – the hexadecimal values of four consecutive bytes, starting from the current position of the cursor, in the big-endian order.

Big-endian qword – the hexadecimal values of eight consecutive bytes, starting from the current position of the cursor, in the big-endian order.

ASCII – the text value corresponding to the one-byte hexadecimal value in the current position of the cursor.

UTF-16 – the text value corresponding to the two-byte hexadecimal value in the current position of the cursor in the little-endian order.

Big-endian UTF-16 – the text value corresponding to the two-byte hexadecimal value in the current position of the cursor in the big-endian order.

Unix time – the four-byte timestamp in the little-endian order for the data in operating systems similar to Unix.

Long unix time – the eight-byte timestamp in the little-endian order for the data in operating systems similar to Unix.

Big-endian unix time – the four-byte timestamp in the big-endian order for the data in operating systems similar to Unix.

Windows file time – the eight-byte timestamp for the data in Windows.

DOS file date – the two-byte timestamp for the data in the DOS operating system.

Data source properties

The "Data source properties" section contains a brief summary of properties of the processed source of data:

Source type – the type of the processed source of data.

Source size – the overall size in bytes of the processed source of data.

Configuration

The last section is "Configuration". It displays the current settings of the Information pane and allows its configuring:

Text encoding – the encoding that is currently applied to the text representation of the data. You can change it to the necessary one by choosing it from the drop-down list.

Separation to blocks – enables/disables the division of content in the Hexadecimal/Text data pane into blocks of a given size. At the moment of enabling it, you can choose between separation with global addresses (each block’s address starts from the address of the previous one) or with internal addresses (each new block’s address starts from zero).

Data inspector – allows configuring the "Raw data inspector" section. You may hide this section of the Information pane or choose the formats of data to be displayed in it by ticking the necessary ones in the list of all available formats.

Structures – sets whether the applied structure template's details should be displayed in the Information pane.

Assign structures automatically – enables/disables the automatic assigning of the current structure template to all files of the same type.

Content navigation

The simplest way of navigation in Hexadecimal viewer is to move the cursor manually using the mouse or the arrow keys of the keyboard. On the other hand, you can jump instantly to the required address by entering it in the "Go to position" dialog. This dialog is opened with the "Go to" option of the toolbar or the Ctrl+G shortcut. Alternatively, you can open it by double-clicking the "Current position" field in the contextual line pane at the bottom or by clicking the arrow button next to the "Current position" property in the Information pane.

In the "Go to position" window, enter the address of the offset you’d like to jump to into the "New position" field. The arrow button next to it allows viewing the navigation history.

In addition, you can change the unit used for a "jump" to blocks of a given size and configure the direction: jump in a forward or backward direction from the current position, or from the beginning/end of the data source, or from the manually defined offset.

When you click the "Go" button at the bottom of the dialog, the cursor will move to the specified position.

Once you change the position of the cursor, the "Previous location" function becomes active on the main toolbar of Hexadecimal viewer. With its help, you can go back to the previous position of the cursor. You can press it or the Backspace key multiple times to get to the previous position you need.

After using the "Previous location" function, the "Next location" one becomes active (Shift+Backspace) allowing retrieving the backward steps taken.

Position bookmarks

Hexadecimal viewer allows bookmarking important positions in a simple and quick manner. To bookmark a position, first select it and then hit the "Mark position" tool on the main toolbar or press the Ctrl+D keys.

In the "Mark current position" window, type a note/name for your bookmark and click "Ok".

A new position will be added to the positions list that can be opened in the Bookmarks pane. If there is an existing bookmark for this position, it will be replaced with a new one.

To open the Bookmarks pane, click the "All positions" option in the dropdown list of the "Mark position" tool or use the combination of keys Ctrl+Shift+P. In the Bookmarks pane, you can double-click any marked position to jump to it. You can also hit the "Go to" option in its context menu or use the "Go to" button of the pane’s toolbar with the same purpose.

To remove a bookmark, select it in the Bookmarks pane and press the "Delete" option in its context menu. In addition, you can use the "Comment" option from that very menu to change the bookmark’s name.

For backup purposes, the list of bookmarks can be exported with the "Save positions list to a file" button of the Bookmarks pane’s toolbar. Later, you may upload the previously saved file with the "Load saved positions from a file" button of that very pane.

To delete the entire list of bookmarks, use the "Clear current list of marked positions" button.

Data search

With the "Find data" function of the Hexadecimal viewer’s main toolbar or the Ctrl+F combination of keys you can find any set of hexadecimal bytes or a text string within the opened file.

This option opens a window to set search parameters. In particular, there you can enter a search pattern in the "Search for" field.

Then you should choose between "Text" or "Hex values" in the dropdown list of the "Search as" parameter, or opt for the "Advanced hex search", in case you need to apply a regular expression to get better search results.

The "Search direction" parameter allows defining whether the next or previous occurrence of the specified search pattern should be found.

By default, the search is performed within the entire file. Still, it is also possible to limit the search area. Particularly, you can configure looking for the given search pattern at the specific position in every block of the defined size. For this, tick the "At position" parameter and enter the necessary position number and block size. If the program can’t find this pattern in the first block, it will look for it in the next one and so on.

The software is automatically set to look for the first occurrence of the entered search pattern in the given direction. If you need to find all the occurrences, mark the "Enumerate positions" option to make the program find and list them as position bookmarks. In addition, you may limit the number of positions shown in the list with the "Maximum positions" parameter.

If you select "Text" in the dropdown list of the "Search as" parameter, there will be two additional parameters to configure:

Text encoding – the encoding of the string to be searched;

Search is case-sensitive – if activated, the program will differentiate among uppercase and lowercase characters.

As for the "Advanced hex search" mode, when activated, it allows specifying the search pattern using the following special syntax:

• ? – any 4 bits in a hexadecimal sequence (for instance, 0?22 may mean 0022, 0222…0F22).

• *N* – any "N" (number) of bytes (for instance, *15* stands for any 15 bytes).

• !B! – any value different from "B" (for instance, !1! means "not equal to 1" and !ff! – "not FF").

• {B1,B2...} – valid bytes enumeration (for instance, {00,?1,1f} means 0, any of 01…F1 or 1F).

• {??,!B2!...} – a case of "except" enumeration (for instance, the byte matches the first value and doesn’t match the second one).

• 's' – an ASCII string (for instance, 'str' means "73 74 72").

• "s" – a Unicode string (for instance, "str" means "73 00 74 00 72 00").

• `s` – a UTF-8 string (similar to an ASCII string, but it encodes the "localized" symbols to UTF-8).

• + – when specified at the beginning of a string, makes the search case-sensitive.

• - – when specified at the beginning of a string, makes the search not case-sensitive.

After setting all the necessary search parameters, press the "Find" button. When a match is detected, the cursor will move to the start of the found pattern.

Data selection

To select a range of values in the hexadecimal/text data pane, press the left button of the mouse and move the cursor in the necessary direction. Alternatively, you may use Shift in combination with the arrow keys for the same purpose.

In addition, it is possible to select a sequence of continuous bytes with the "Select range" tool of the main toolbar of Hexadecimal viewer, or using the Ctrl+R keys combination, or by clicking on the "Selected bytes position" and the "Selected bytes number" fields in the contextual line at the bottom.

In the "Define range to select" window, enter the first byte’s address and the number of consecutive bytes to be selected.

You may set the current cursor position as the starting point of a new selection.

On the other hand, you may enter the first and the last byte of the range to be selected. For this, choose the corresponding options in the drop-down lists.

Then press the "Ok" button at the bottom of the dialog to make a new selection. Its first and last bytes, as well as its size, will be displayed in the contextual line under the main content area of the viewer.

Data copying

Hexadecimal viewer allows copying to the clipboard a range of values selected in the hexadecimal/text data pane. For this, use the "Copy" function of its main toolbar.

Click on the arrow button next to it to choose a format the selected data must be copied in. The available variants are the following:

Raw data – to copy the range of raw unformatted data that is currently selected in the hexadecimal data pane.

Text – to copy the sequence of characters selected in the text data pane in the encoding that is currently enabled in the encoding box.

Unicode – to convert the selected sequence of characters into two-byte Unicode and then copy it to the clipboard.

UTF-8 – to convert the selected sequence of characters into one-byte UTF-8 and then copy it to the clipboard.

Hex text – to treat the sequence of bytes selected in the hexadecimal data pane as textual data and copy it to the clipboard.

Position – to copy the address of the current cursor position.