Introduction
UltraEdit offers editing in hexadecimal format apart from the regular text editing in ASCII format. In the hexadecimal system, numbers are represented in a positional numeral system based on 16. While the decimal system represents the digits using 10 symbols, the hexadecimal system uses the values 0 to 9 and “A” to “F”. This results in the values from 0 to 15, or 16 in total. The letters “A” – “F” can be written in either upper or lower case, which has no significance for the interpretation.
The so-called Hex mode can be accessed via the keyboard shortcut Ctrl + H and switches between ASCII and Hex mode. Alternatively, the mode can be accessed over Edit → Hex mode (in Ribbon mode), via Edit → HEX functions → Hex edit (Traditional menu mode), or Edit → Hex mode → Hex edit (Contemporary menu mode).
Basics of the Hex Mode
Hex mode is intended for processing non-ASCII files in which certain characters are not printable and in cases not involving text files in the classic sense. In addition, there is a restriction in Hex mode because Insert mode is not supported – this is the alternative to Overstrike mode, which is used for regular editing. For the non-existing Insert mode, we will discuss a separate Hex Insert/Delete function later, which works independently of it.
As soon as UltraEdit is in Hex mode, the display is switched and the file content is displayed in 3 sections (see Figure 1):
Figure 1: Hex Mode representation
- File Offset: contains the byte numbering of the hex data. This data position is also hexadecimal and starts with 00000000h
- Hexadecimal representation: depending on how many hexadecimal characters are displayed per line, the hex values are displayed with 2 characters and separated by a space. For example, the value Fh is displayed as 0F
- ASCII representation: contains the ASCII representation of the values from the hexadecimal column, which corresponds exactly to the same quantity. Only printable ASCII characters are displayed and non-printable characters are replaced by a dot.
Data editing in Hex Mode
When data is changed in Hex Mode, whether in the hexadecimal representation or in the ASCII representation, this is always performed in overstrike mode. That means that entering a new value overwrites the existing value. When a value is entered in one representation column, the other representation column is automatically adjusted.
Example:
If in this example the value 56 (this is the 6th value from the left) is replaced by 76 in the Hexadecimal representation, UltraEdit automatically updates the ASCII representation:
Basically, the Windows Character Map is a good source for all ASCII characters and their hexadecimal position in the ASCII character set (see Figure 2).
Figure 2: Windows Character Map with the selected “V” character and it’s hex value 56h at the bottom.
There are also scenarios in which hex values must not only be changed, but inserted or deleted. For this purpose, UltraEdit offers the Hex insert/delete function, which can be accessed via the shortcut Ctrl + D. Alternatively, the function can be accessed via Edit → Insert/delete (in Ribbon mode), via Edit → HEX functions → Hex insert/delete (Traditional menu mode) or Edit → Insert/delete (Contemporary menu mode).
The current caret position is always decisive for the Hex Insert/Delete dialog, and one or more bytes can be inserted via a selection. The Insert button below adapts to the function selection and is always labeled the same as the selection above (see Figure 3).
Figure 3: Hex Insert/Delete dialog
Hex mode for EBCDIC Encoding:
EBCDIC stands for Extended Binary Coded Decimal Interchange Code and is an 8-bit character encoding used mainly on IBM mainframe and IBM midrange computer operating systems.
The Hex/EBCDIC mode works almost identically to the standard Hex mode with the exception of converting the EBCDIC data for viewing purposes only and show this as ASCII.The content of the file will not be modified, however the right-hand side that shows the ASCII representation in Hex mode will show the data converted to ASCII from EBCDIC.
While in this Hex/EBCDIC mode, editing in the ASCII area will allow data to be entered as ASCII and will be automatically converted to EBCDIC in the file. Editing in the Hex area will allow data to be entered directly as Hex and the ASCII representation (converted from EBCDIC) will be shown in the ASCII area.
Find/Replace in this mode will allow ASCII strings to be used and correctly found/replaced according to the settings in the Find/Replace dialog box. Regular Expressions however cannot be used in this mode because the results would be indeterminate.
Hex mode settings:
The Hex mode can be configured in the UltraEdit settings and is located in the category Editor → Hex mode (see Figure 4).
Figure 4: UltraEdit’s Hex mode settings
Three different parameters are possible:
- Open files containing hex 00’s (nulls) in hex mode: any file containing nulls which is not detected as a UTF-16 file will be opened automatically in Hex mode.If disabled, then the file would be opened as a normal text file for editing – UltraEdit will respect and retain the active mode (ASCII mode or Hex mode) for the active file when reloading the file (either via Revert to Saved, File Change Detection, or File Change Polling).
- Allow editing of text files with hex 00’s without converting them to spaces: when a file is loaded, UltraEdit checks the first 7K of the file and if it contains more than two nulls (hex 00), the file is considered as binary/hex file. Nulls are not valid in an ASCII file and will be converted to spaces if the user edit the file in ASCII mode and if this option is disabled (default). If the user views a hex file in ASCII mode but make no changes, UltraEdit should not convert the nulls to spaces, but if the user makes changes in ASCII mode to a hex file the change will occur.Selecting this option overrides this conversion of nulls (hex 00) to spaces, but it is still recommended not editing binary files in ASCII mode.Nulls are normally considered as string terminators and not generally valid in ASCII files.Using this setting may cause some functions not to work past the null although this should not affect general editing.
- Number of hex characters per line: defines the number of hex characters to be shown in each line of the display – UltraEdit must be restarted once this value is changed.
Hex mode in practical use
There are many practical approaches to Hex mode, all of which together would fill a book of their own. Every executable file (extension exe) and library (extension dll) in the Windows world is based on the so-called Portable Executable File Format (PE for short), whereby Portable Executable means that the format is not architecture-dependent.
Microsoft has defined a structure for this that can be used to determine many file properties, such as the machine type, pages per file, checksums, symbol tables and various characteristics – such as whether the application can process > 2 GB addresses. Microsoft has listed the structures on its own homepage.
Other scenarios for hex mode can be found in IT forensics, where images of disks and RAM are created and these images are examined or searched for evidence using a hex editor. Data can also be extracted from swap files and the Hyberfil.sys, as well as remnants of deleted files or other concealed information.
For computer games, hex editors can be used to falsify game saves, and there are instructions on the Internet that explain exactly which files need to be edited for which games – however, this requires the game saves to be saved on the local system. Games with an online link, such as Steam, synchronize their scores and achievements with online databases and can therefore only be modified to a limited extent.
The practical use of hex editors is always necessary when an interpretation of the data is to be prevented. When I open a picture in a hex editor, Microsoft Paint is not tasked with the interpretation, but I have access to the picture and metadata in hexadecimal raw form. This is a control level that is incredibly powerful, but also requires precise knowledge of data interpretation.
Summary
UltraEdit’s Hex mode allows the complete editing of files from the first to the last byte, regardless of whether the characters they contain are printable or not. This makes the Hex mode suitable for many areas of application, such as software development, administration, security experts, but also for forensic analysis, where raw data must be evaluated precisely for the collection of evidence.
The clear presentation in both ASCII and hex format combined with the ability to process extremely large files and data streams (such as disk & memory images) makes UltraEdit suitable for all conceivable application scenarios.
If you’re looking for a versatile text editor with hex editing capabilities, you can rely on UltraEdit. Download it now and try it for 30 days for free.
Try UltraEdit
