WerWolv/ImHex
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM. - WerWolv/ImHex
54.4k stars · 2.4k forks · 517 watchers
README
A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM. /ˈɪmhɛks/
Supporting If you like my work, please consider supporting me on GitHub Sponsors, Ko-Fi or PayPal. Thanks a lot!
Notable Sponsors
JetBrains, providing us with free All Products Pack licenses for development
SignPath, providing us with free Code Signing Certificates for our Windows builds
Amazon, providing us with free AWS Cloud Credits for our CI
Would you like to appear here as well? Contact us at imhex@werwolv.net! Screenshots
More Screenshots
Features
Featureful hex view
Byte patching Patch management Infinite Undo/Redo "Copy bytes as..."
Bytes Hex string C, C++, C#, Rust, Python, Java & JavaScript array ASCII-Art hex view HTML self-contained div
Simple string and hex search Goto from start, end and current cursor position Colorful highlighting
Configurable foreground highlighting rules Background highlighting using patterns, find results and bookmarks
Displaying data as a list of many different types
Hexadecimal integers (8, 16, 32, 64 bit) Signed and unsigned decimal integers (8, 16, 32, 64 bit) Floats (16, 32, 64 bit) RGBA8 Colors HexII Binary
Decoding data as ASCII and custom encodings
Built-in support for UTF-8, UTF-16, ShiftJIS, most Windows encodings and many more
Paged data view
Custom C++-like pattern language for parsing highlighting a file's content
Automatic loading based on MIME types and magic values Arrays, pointers, structs, unions, enums, bitfields, namespaces, little and big endian support, conditionals and much more! Useful error messages, syntax highlighting and error marking Support for visualizing many different types of data
Images Audio 3D Models Coordinates Time stamps
Theming support
Doesn't burn out your retinas when used in late-night sessions
Dark mode by default, but a light mode is available as well
Customizable colors and styles for all UI elements through shareable theme files Support for custom fonts
Importing and Exporting data
Base64 files IPS and IPS32 patches Markdown reports Binary arrays for various programming languages
Data Inspector
Interpreting data as many different types with endianness, decimal, hexadecimal and octal support and bit inversion
Unsigned and signed integers (8, 16, 24, 32, 48, 64 bit) Floats (16, 32, 64 bit) Signed and Unsigned LEB128 ASCII, Wide and UTF-8 characters and strings time32_t, time64_t, DOS date and time GUIDs RGBA8 and RGB65 Colors
Copying and modifying bytes through the inspector Adding new data types through the pattern language Support for hiding rows that aren't used
Node-based data pre-processor
Modify, decrypt and decode data before it's being displayed in the hex editor Modify data without touching the underlying source Support for adding custom nodes
Loading data from many different data sources
Local Files
Support for huge files with fast and efficient loading
Raw Disks
Loading data from raw disks and partitions
GDB Server
Access the RAM of a running process or embedded devices through GDB
Intel Hex and Motorola SREC data Base64 encoded data UDP Packets
Support for displaying raw data received over UDP
Process Memory
Inspect the entire address space of a running process
Remote Files over SSH with SFTP
Support for loading files from remote servers using SSH and SFTP
Data searching
Support for searching the entire file or only a selection String extraction
Option to specify minimum length and character set (lower case, upper case, digits, symbols) Option to specify encoding (ASCII, UTF-8, UTF-16 big and little endian)
Sequence search
Search for a sequence of bytes or characters Option to ignore character case
Regex search
Search for strings using regular expressions
Binary Pattern
Search for sequences of bytes with optional wildcards
Numeric Value search
Search for signed/unsigned integers and floats Search for ranges of values Option to specify size and endianness Option to ignore unaligned values
Data hashing support
Many different algorithms available
CRC8, CRC16 and CRC32 with custom initial values and polynomials
Many default polynomials available
MD5 SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 Adler32 AP BKDR Bernstein, Bernstein1 DEK, DJB, ELF, FNV1, FNV1a, JS, PJW, RS, SDBM OneAtTime, Rotating, ShiftAndXor, SuperFast Murmur2_32, MurmurHash3_x86_32, MurmurHash3_x86_128, MurmurHash3_x64_128 SipHash64, SipHash128 XXHash32, XXHash64 Tiger, Tiger2 Blake2B, Blake2S
Hashing of specific regions of the loaded data Hashing of arbitrary strings
Diffing support
Compare data of different data sources Difference highlighting Table view of differences
Integrated disassembler
Support for all architectures supported by Capstone
ARM32 (ARM, Thumb, Cortex-M, AArch32) ARM64 MIPS (MIPS32, MIPS64, MIPS32R6, Micro) x86 (16-bit, 32-bit, 64-bit) PowerPC (32-bit, 64-bit) SPARC IBM SystemZ xCORE M68K TMS320C64X M680X Ethereum RISC-V WebAssembly MOS65XX Berkeley Packet Filter
Support for writing custom disassemblers for your own architectures
Bookmarks
Support for bookmarks with custom names and colors Highlighting of bookmarked region in the hex editor Jump to bookmarks Open content of bookmark in a new tab Add comments to bookmarks
Featureful data analyzer and visualizer
File magic-based file parser and MIME type database Byte type distribution graph Entropy graph Highest and average entropy Encrypted / Compressed file detection Digram and Layered distribution graphs
YARA Rule support
Scan a file for vulnerabilities with official yara rules Highlight matches in the hex editor Jump to matches Apply multiple rules at once
Helpful tools
Itanium, MSVC, Rust and D-Lang demangler based on LLVM ASCII table Regex replacer Mathematical expression evaluator (Calculator) Graphing calculator Hexadecimal Color picker with support for many different formats Base converter Byte swapper UNIX Permissions calculator Wikipedia term definition finder File utilities
File splitter File combiner File shredder
IEEE754 Float visualizer Division by invariant multiplication calculator TCP Client/Server Euclidean algorithm calculator HTTP Requests
Built-in Content updater
Download all files found in the database directly from within ImHex
Pattern files for decoding various file formats Libraries for the pattern language Magic files for file type detection Custom data processor nodes Custom encodings Custom themes Yara rules
Modern Interface
Support for multiple workspaces Support for custom layouts Detachable windows
Easy to get started
Support for many different languages Simplified mode for beginners Extensive documentation Many example files available on the Database Achievements guiding you through the features of ImHex Interactive tutorials
Pattern Language The Pattern Language is the completely custom programming language developed for ImHex. It allows you to define structures and data types in a C-like syntax and then use them to parse and highlight a file's content.
Source Code: Link Documentation: Link
Database For format patterns, libraries, magic and constant files, check out the ImHex-Patterns repository. Feel free to PR your own files there as well! Requirements To use ImHex, the following minimal system requirements need to be met. ImportantImHex requires a GPU with OpenGL 3.0 support in general. There are releases available (with the -NoGPU suffix) that are software rendered and don't require a GPU, however these can be a lot slower than the GPU accelerated versions. If possible at all, make ImHex use the dedicated GPU on your system instead of the integrated one. ImHex will usually run fine with integrated GPUs as well but certain Intel HD GPU drivers on Windows are known to cause graphical artifacts.
OS:
Windows: Windows 7 or higher (Windows 10/11 recommended) macOS: macOS 15 (Sequoia) or higher,
Lower versions should still work too, but you'll need to compile ImHex yourself. The release binaries will NOT work due to GitHub not having any macOS 15 or lower CI runners available. The macOS build is not signed and will require you to manually allow them in the Security & Privacy settings.
Linux: "Modern" Linux. The following distributions have official releases available. Other distros are supported through the AppImage, Flatpak and Snap releases.
Ubuntu and Debian Fedora RHEL/AlmaLinux Arch Linux Basically any other distro will work as well when compiling ImHex from sources.
FreeBSD: Tested on FreeBSD 14.3
Other versions will most likely work too but are untested
CPU: Officially supported are x86, AMD64 and ARM64, though any Little Endian CPU should work. GPU: OpenGL 3.0 or higher
Integrated Intel HD iGPUs are supported, however certain drivers are known to cause various graphical artifacts, especially on Windows. Use at your own risk. In case you don't have a GPU available, there are software rendered releases available for Windows and macOS
RAM: ~50MiB, more is required for more complex analysis Storage: ~100MiB
Installing Information on how to install ImHex can be found in the Install guide Compiling To compile ImHex on any platform, GCC (or Clang) is required with a version that supports C++23 or higher. Windows and Linux releases are being built using latest available GCC. MacOS releases are being built using latest available LLVM Clang. Important to note is, the MSVC and AppleClang compilers are both NOT supported since they're both generally severely outdated and lack features GCC and LLVM Clang have. NoteMany dependencies are bundled into the repository using submodules so make sure to clone it using the --recurse-submodules option. All dependencies that aren't bundled, can be installed using the dependency installer scripts found in the /dist folder.
For more information, check out the Compiling guide. Contributing See Contributing Plugin development To develop plugins for ImHex, use the following template project to get started. You then have access to the entirety of libimhex as well as the ImHex API and the Content Registry to interact with ImHex or to add new content. To build a plugin, you will need to use our SDK Getting the SDK locally You can build the SDK by compiling ImHex like this:
cmake -G Ninja -DIMHEX_BUNDLE_PLUGIN_SDK=ON -B build cd build DESTDIR=install ninja install The SDK will then be available at install/usr/local/share/imhex/sdk. You will need to set the variable IMHEX_SDK_PATH to that (absolute) path.
Getting the SDK in a Github Actions CI You can use this action to automatically download the SDK to your Github Runner
ImHex Plugin Template
Credits Contributors
AxCut for a gigantic amount of contributions to the Pattern Text Editor and tons of other parts of ImHex iTrooz for getting ImHex onto the Web as well as hundreds of contributions in every part of the project jumanji144 for huge contributions to the Pattern Language and ImHex's infrastructure Mary for her immense help porting ImHex to macOS and help during development Roblabla for adding MSI Installer support to ImHex Mailaender for getting ImHex onto Flathub Everybody else who has reported issues on Discord or GitHub that I had great conversations with :)
Dependencies
Thanks a lot to ocornut for their amazing Dear ImGui which is used for building the entire interface
Thanks to epezent for ImPlot used to plot data in various places Thanks to Nelarius for ImNodes used as base for the data processor Thanks to BalazsJako for ImGuiColorTextEdit used for the pattern language syntax highlighting
Thanks to nlohmann for their json library used for configuration files Thanks to vitaut for their libfmt library which makes formatting and logging so much better Thanks to btzy for nativefiledialog-extended and their great support, used for handling file dialogs on all platforms Thanks to danyspin97 for xdgpp used to handle folder paths on Linux Thanks to aquynh for capstone which is the base of the disassembly window Thanks to rxi for microtar used for extracting downloaded store assets Thanks to VirusTotal for Yara used by the Yara plugin Thanks to Martinsos for edlib used for sequence searching in the diffing view Thanks to ron4fun for HashLibPlus which implements every hashing algorithm under the sun Thanks to mackron for miniaudio used to play audio files Thanks to all other groups and organizations whose libraries are used in ImHex
License The biggest part of ImHex is under the GPLv2-only license. Notable exceptions to this are the following parts which are under the LGPLv2.1 license:
/lib/libimhex: The library that allows Plugins to interact with ImHex. /plugins/ui: The UI plugin library that contains some common UI elements that can be used by other plugins
The reason for this is to allow for proprietary plugins to be developed for ImHex. Code Signing Policy Free code signing provided by SignPath.io, certificate by SignPath Foundation. This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. People with direct push access
WerWolv iTrooz jumanji144 AxCut