HexEdit Documentation

About this Document

The main purpose of this page is to document the user interface for HexEdit. It does not attempt to describe the source code, how to modify the program, or what to use HexEdit for. The best resource for information regarding HexEdit development is the hexedit-dev mailing list.

In order to be brief, features which are similar to the ResEdit hex editor are not described. (If you aren't familiar with ResEdit, you probably shouldn't be using HexEdit!)

System Requirements

Macintosh (68K or PowerPC based, x86 not nativly supported)
MacOS version 7.5 or later
3.5 MB of HD space
1 MB of RAM

HexEdit can edit very large files (they don't need to fit into memory). At it's current memory setting of 600k-5000K, it can handle files of hundreds of megs in size. If you need to edit a larger file, increase HexEdit's memory partition.

Note that when HexEdit saves a file, it will (temporarily or permanetaly, depending on the "Create Backup" setting) need twice the disc space of the original file, plus a little extra for storing the changes you have made.

Note regarding memory usage and colour schemes: Before v1.8 colour windows used lots of memory. This is no longer true, so colour is now the default. In fact all windows are now really colour even when they're black and white, so you can switch back and forth between Black & White and a Colour Scheme without having to re-open windows.

Opening and Saving Files

Opening a File

HexEdit supports drag and drop, automatically opening files in “Auto” mode. You may find it useful to keep an alias to HexEdit on your desktop for this purpose.

When you use the Open command, HexEdit presents an Open dialog with three additional buttons, labelled ‘Data’, ‘Resource’ and ‘Auto’.

‘Data’ opens the data fork.
‘Resource’ opens the resource fork.
‘Auto’ opens the data fork, if there are any data in it, otherwise it opens the resource fork.

Saving a File

When you save a file with HexEdit, it automatically backs up the last version of the file, renaming it to “OriginalName~” (the original name with a tilde (~) after it). You can turn this backup feature off in the Options menu.

Program Menus

File Menu

New: Creates a new, untitled file. The first Save will be a ‘Save As…’ for untitled files.
Open: Allows you to open an existing file.
Close: Closes the currently open, frontmost file.
Edit Other Fork: Simply switches to the window containing the other fork for the file. If the window doesn't exist, HexEdit automatically opens the file's other fork in a new window and makes that window active.
Disassemble PPC Code: This causes the data, starting at the first byte in the window, to be interpreted as PowerPC assembly code. The resulting assembly‐language interpretation of that binary data is displayed in the window. Branches and so forth are displayed as well as common routine entry and exit points.
Compare Files: Brings up two Open dialogs, one after the other. From each, select one of the two files you wish to compare. Canceling either dialog cancels the entire compare. Once both files are selected, their windows will open one below the other with a button bar underneath. This bar has four commands: Find Next, Find Previous, Edit Them, and Done. The Find commands do as you would expect, Edit Them closes the button bar and allows you to edit both files, and Done closes all both windows. Note: the Compare Files command is very simplistic, and only compares bytes sequentially. It is not a diff‐like comparison. If anyone wants to add that to HexEdit it would be greatly appriciated :)
Save: Saves the frontmost edit window to it's opened file.
Save As…: Allows you to save the edit window to a different file.
Revert: Reverts the current edit window to its on‐disk state (i.e, undoing all edits since the file was loaded or last saved).
Page Setup: Setup how you want to print documents.
Print/Print Selection: Print the entire document, or just the selection, if there is one.
Quit: Exits HexEdit. (Not present in Mac OS X)

Edit Menu

Undo: Most actions are undoable
Cut: Cut current selection (not available in ovewrite mode without Destructive Delete checked)
Copy: Copy current selection
Paste: Paste clipboard (replacing selection or inserting at cursor)
Clear: Clears (zeros) current selection
Select All: Selects the entire document

Find Menu

Find/Replace: This brings up a dialog box allowing you to search for a sequence of hex bytes, or ASCII text. You can also enter a replacement string and use the Replace or Replace All buttons to replace the next occurance of the search string with the replacement string, or all subsequent occurances, withing the topmost edit window. The dialog is movable and modeless, meaning it will stay open after you do a find. The "Ignore Case" option causes finds to match strings regardless of case, while the "Wrap" option causes searches to wrap around the ends of the file.
Search Forward: This searches for the last search string, forward until the end of the file.
Search Backward: This searches for the last search string, backward until the beginning of the file.
Replace & Find Next: Replaces current selection (ie, result of find?) and finds the next occurance of the last used find string (using last find's settings). Something must be selected for the replace to occur (avoids mistaken replacements)
Goto Address: This brings up a dialog which allows you to specify an address, either in hex or in decimal, and scroll the current editing window to that address. The dialog is movable and modeless, meaning it will stay open after you do a goto.

Options Menu

Show Extended Chars: This displays ascii values in the ascii part of the dump which are higher than 0x80. You will see the accents, diacriticals and symbols that are in the Monaco font that HexEdit uses. This also makes it a little harder to pick out English text if you are searching for it in a large binary.
Decimal Addresses: This causes the addresses to be displayed in decimal, rather than hex.
Vertical Bars: If checked, vertical bars are drawn between four (4) byte boundries in the hex editing pane of the window. This makes it easier to reference where you are in each line. The bar is drawn in the header bar color.
Full Lines: If checked, windows are forced to a size that displays only full lines, and scrolling is set to not display partial lines at the top and/or bottom of windows.\
Overwrite: This toggles between insert mode (the default) and overwrite mode. Overwrite mode allows you to replace a sequence of bytes without affecting the offset of the subsequent bytes.
Destructive Delete: Option is only active when Ovewrite is checked. When this option is checked, and you are in Overwrite mode, the Delete key is "destructive" in that it does CAN change the size of the file, vs standard overwrite mode of non-destructively moving the cursor or zeroing bytes.
Unformatted Copies: When checked copies of Hex data are made without any formatting (ie, AAAAAA instead of AA AA AA) which is useful when pasting into certain applications. ASCII copies (made from the right side of the window) are always raw binary data.
Make Backups: If checked, when saving a file, renames the original by appending a tilde (~) to the name before saving the new data under the original filename. If not checked, the original file is overwritten and can not be restored.
Open File Dialog at launch: If checked HexEdit will present the Open File dialog when launched, unless a file is ready to be opened (ie, via dragging a file onto the HexEdit icon, etc.) or a compare files apple event caused HexEdit to launch. If unchecked the Open File dialog will not be presented (ie, will open with no window).
Compare Options: Brings up a dialog that lets you choose how file compares are performed. You can choose the data size as well as if you want to display where files are similiar or where they differ.

Colour Schemes Menu

Use Color Schemes: If selected, then all of the schemes below this item will be selectable as well, and the color of the frontmost window will be checked unless there is not a frontmost window, in which case the default color is checked. In that case, windows will be created in color and you can change the color scheme used to draw windows. The default is that only the frontmost window is effected by a scheme change. However, you can select a scheme with no open windows, or press Option while selecting a color with open windows, to change the default color scheme, which causes all open windows to update to that scheme. The default color HexEdit uses is only changed when you change the color of all windows in this way, as changing one window's color is considered a temporary selection.

Editing Key Commands

Delete: Deletes character to left of cursor (earlier in file). In ‘Overwrite’ mode without ‘Destructive Delete’ checked this will simply move the cursor as if the left arrow key was pressed.
Forward Delete: Deletes the character to right of the cursor (later in file). Not available in ‘Overwrite’ mode without ‘Destrucive Delete’ checked.
Option + Delete: "Clears" memory; either the selected range of bytes or the byte immediately to the LEFT of the cursor.
Clear: "Clears" memory; either the selected range of bytes or the byte immediately to the RIGHT of the cursor.
Tab / Return / Enter: These keys switch between the Hex and ASCII portions of the edit window
Left/Right/Up/Down: The arrow keys move the cursor within the editing window
Home / Option + Up Arrow: Take you to the first byte of the file
End / Option + Down Arrow: Take you to the last byte of the file
Page Up / Down: Page up and down within the file
(NOTE: if "paging only moves display" is checked, the display moves but the cursor (insert) position does NOT)

Modifiers on standard behaviors

Colour Schemes

Pressing Option when selecting a scheme makes it the default scheme for new windows. This choice is saved in the HexEdit preferences.

Find / Replace Dialog

Pressing Option when clicking Replace invokes a ‘Replace and Find Next’ action.

Edit Windows

Shift while clicking extends the current selection.
Option with Page Up / Down toggles ‘Movement Only’ preference.
Option with Backspace clears cursor to left of cursor (vs. deleting it).