Binary File Editor
     

Q. What is a binary file editor?

A. To edit a text file you can use a "text editor" (or just "editor").  But most text editors normally do not allow you to edit binary files.   For this you need a binary file editor.

Q. How do I quickly jump forward in a file by 42 bytes?

A. The simple answer is press Ctrl+G, type "+42" and press Enter.  (This works for any value, 42 just being used as an example.)

This procedure invokes the Go To dialog (which is just the calculator in disguise).  The default value in the dialog is the current address, so by pressing "+" you invoke the add button and typing "42" you enter the 2nd operand to the addition.  Pressing Enter invokes the "GO" button which adds 42 to the current cursor location and then positions the cursor at the new location in the file.

You can perform subtraction, and even far more complicated address calculations this way too.  You can also record all calculator buttons in a keystroke macro if you need to perform the same calculations repeatedly.

Q. How do I quickly change the font size?

A. There are buttons to quickly increase and decrease the font size on the Standard Toolbar.  There is also a drop-down list for selecting the font size on the Format Toolbar.

Q. When I try to run HexEdit I get the message "HexEdit has not been installed on this machine". 

A. If you copy hexedit.exe to a different computer and run it without running the setup program you will see this message.  To solve this problem simply install hexedit by running setup.exe from the distribution zip file.

This may also indicate that some hexedit files or registry entries have been corrupted.  In this case the solution is to uninstall HexEdit (using the "Add/Remove Programs" option in the Control Panel) and then reinstall.

It's possible, though very unlikely, that you may not be able to uninstall HexEdit if the uninstall information has been lost or corrupted.  In this case you have to uninstall manually.   (You will also have to do this if you just deleted all the hexedit files without uninstalling and you want to reinstall.)  To do this delete all the files in the directory where HexEdit was installed and delete all registry entries under HKEY_LOCAL_MACHINE\Software\ECSoftware using regedit.   If you are unfamiliar with regedit be very careful and follow the detailed instructions below:

1. From the Start menu choose Run and type "regedit" into the text box and hit Enter.

2. Expand "HKEY_LOCAL_MACHINE" in the tree view on the left by clicking the plus (+) sign.

3. Expand "Software" underneath that.

4. Click on "ECSoftware" underneath that so that it is selected - ie. has blue background (in default colour scheme).

5. Hit the Del key and click the "Yes" button to confirm deletion. (Make sure you only delete the "ECSoftware" entry.)

6. Close regedit.

You can now reinstall HexEdit.

Q. When printing (in HexEdit 2.2 and earlier), the header and the first line of data get printed on top of each other.

Q. When printing (in HexEdit 2.5 and later), the header or footer is not printed.

A. Like MSWord the header and footer are printed inside the margins.  If the top margin is too small or zero and you have a header then the top data line on the page will overlap it.  Similarly if the bottom margin is too small the bottom data line will overlap the footer.  In HexEdit 2.2 this resulted (with most printers) in the header or footer overwriting the data but has been addressed in 2.5.

In HexEdit 2.5 if the header (or footer) overlaps the data area then it is not printed at all.  This can be due to the top (or bottom) margin being too small.  But also note that in 2.5 you can position the header and footer vertically so it may be that the "From top:" (or "From bottom") value is too large.

To avoid this problem increases the size of the top (or bottom) margin, or in 2.5 reduce the "From top" (or "From bottom") value in the Printer page of the Options dialog.

Q. I have installed Hex Edit on NT 4 but when I run it I get an error message like "The procedure entry point __lc_collate couldn't be located in MSVCRT.DLL".

A  You don't have a recent enough version of MSVCRT.DLL (or whichever DLL is mentioned in the error message).  This may happen on NT even if you thought you installed the files but you don't have administrator rights.

To fix this problem install the required DLLs (see the Downloads page for how to obtain them) while logged in as administrator, or have your system administrator install them.  The following or later versions of the Microsoft DLLs are required:

MSVCP60.DLL   17 Jun 1998
MSVCRT.DLL   23 Apr 1999
MFC42.DLL   27 Apr 1999

Q. You say that HexEdit is like Developer Studio and MSWord but I cannot see the similarities.

A.. HexEdit is not especially like Visual Studio and Word but we have tried to keep it compatible when possible for several reasons.  We try to keep the behaviour the same unless there is an advantage in deviating it.  For example, most top-level menu names (File, Edit, View, Tools, Window, and Help) are present in these and many other Windows programs.  Further, menu items that have similarities are positioned in the same menu  (Edit/Find, Edit/Goto, Tools/Options, Tools/Customize etc).

For compatibility purposes HexEdit uses the same binary format on the clipboard that Visual Studio uses.  This means that you can cut and paste between HexEdit and the Visual Studio hex editor.

When the Visual Studio behaviour is not so good then we do not duplicate it.  For example, "undo" in the text editor was obviously designed as an "undo changes" with cursor movement etc later tacked on.  This has made it much more clumsy than HexEdit's undo -- for example, if you select some text and accidentally press a cursor key you cannot just undo to get back the selection.  It also means that there are bugs -- an example, that has been there for at least 5 years is easily demonstrated: open a file in the Visual Studio editor (make sure you start in Insert mode) then type a few characters, change to overtype mode and type a few more characters, now undo all your changes and note the incorrect result.

On the other hand HexEdit (starting in 2.5) now includes a bookmark facility modelled very closely on Visual Studio's bookmarks, since it works very well.  Bookmarks are attached to a file at a location; as the file is edited the bookmark location moves with the character it is attached to.  Actually HexEdit enhances this system in a few ways like keeping track of the bookmark modification and access time (ie. when a bookmark was last set or jumped to), adding persistent unnmaed bookmarks and allowing you to hide bookmarks.

Q. I don't trust using my credit card on the Internet.  Is there another way to pay?

A. There is an enormous amount of credit card fraud on the Internet, but oddly buying over the Internet using a credit card is usually very safe.  Most fraud comes from the use of credit card numbers obtained from a non-Internet source (such as restaurants etc) and used to buy products on the Internet.  Moreover, it is normally the vendor, not the customer (as long as they check their statement), and never the banks (despite how wonderful they make themselves sound), that loses out.

Note that all of our credit card transactions are handled by RegNow and Digital Candle.  They have a very high level of security in their credit card transactions including SSL.  They handle thousands of these transactions a day.

If you still don't want to pay by credit card you can send me a cheque or money order.  RegNow also has a pay by phone facility for a small fee (see their web site).

Q. How do I perform a find and replace operation?

A. In HexEdit 2.5 you can use the Replace page in the Find dialog.  This is invoked using the Edit/Replace menu item.

Versions prior to 2.5 (including the free version 2.0) have no find and replace command but it is easy to use a macro to do the same thing:
     - start macro recording by pressing F7 and search for the first occurrence of the hex bytes or characters you want to replace
     - type the new text to replace the search text and stop macro recording by pressing F7 again
     - run the macro repeatedly by pressing F8 or run it multiple times using the Multi-play option
Note: If you accidentally change something it's easy to fix it with the Undo command (Ctrl+Z).

Q. Why can't I find the bytes I am looking for?

A. There could be many reasons.  Here are some recommendations when searching:
     - double check the options used in the Find dialog (eg. you might have intended to do a hex search but instead searched for ASCII text)
     - try going to the top of the file (Ctrl+Home) and repeating the search (F3) - only the bytes from the cursor to the end of file are searched
     - rather than typing in values to find the next occurrence in the file, it is less error-prone to select the bytes and press Ctrl-F3
     - use case-insensitive text searches since it is easy to get the case of characters wrong (and it often turns up other useful info)
     - when searching for text make sure you haven't mistaken a lowercase-L for a 1, an O for a zero etc
     - if searching for a binary number check that you have the format and byte order correct (little- or big-endian)
     - if searching for text in a .DLL or .EXE file try a Unicode search as well as an ASCII search

Q. Can you change or enter floating point values?

A. You can enter a new floating point value in the fields of the Properties dialog.  Just type the new value into the "value" field and press Enter (or Esc to abort).  You can enter IEEE floating point values using the "IEEE" page or IBM floating point values using the "IBM FP" page.  You can also change the byte-order using the "Big-endian" check box and enter 32-bit or 64-bit values depending on the format selected.  You can also type the special value "Inf", "-Inf" and "NaN" when using IEEE floats (not supported by IBM floats).

The "Value" field may be disabled to prevent you from entering a value.  This will happen if the file is open in read-only mode or there are not enough bytes before the end of file to enter a floating point number.

Some of the other pages also support entering of values.  You can also enter a byte value in decimal, octal or binary (on the Character page), as well as 8, 16, 32 or 64 bit integers in decimal (on the Decimal page), and dates in several different formats (Date page).

Q. How can I convert EBCDIC text to ASCII?

Q. Why does my macro slow down while it is running?

A. Hex Edit macros typically run very fast, but due to the way Hex Edit stores information about the changes made to a file, as changes are made each subsequent change takes slightly longer.  This is not noticeable when editing manually but is evident to a small number of users who use a macro that modifies a large file and which is run a large number of times.  This is simply due to the fact that HexEdit was originally optimised for display speed, not speed of changes.

The technical reason is that whenever you add, delete or modify some bytes this is added to the stack of undo info, then a list is built of all the places that the current file comes from.  As the undo stack gets bigger this list takes longer and longer to rebuild after each change.  However, when you save the file to disk the undo info can be discarded (as the file you are editing is now the same as the file on disk) and file modifications are fast once more.

To avoid this effect the answer is to simply save the file to disk but this means you can then not undo any changes.  Note that macros that do not modify a file always run fast.

Q. I want to copy bytes from 2 different binary files alternately into a third binary file.   Is this possible?

A. Yes.  In fact it's fairly easy to do this and similar things with keystroke macros.

For example, to do what you want, open the 2 "source" binary files in HexEdit and create a new, empty "destination" file.  Move the cursor to the start of both source binary files and start macro recording using F7.  In the first file select the first byte using Shift+RightArrow and copy it to the clipboard (Ctrl+C) then move the cursor to the next byte with the Right Arrow key.  Now select the target binary file making sure that the cursor will be at the end (either click the title bar with the mouse so the current cursor position does not change or click anywhere in the window and press Ctrl+End to move to the end of the file).  Do the same using the second binary file.   Click on the title of the first binary file again and turn off macro recording (F7).

You can then replay this macro repeatedly using F8.  Use the multiplay feature with a very large number to do the whole file -- the macro will stop with an error when it reaches the end of one or both of the source files.

There are some problems with HexEdit and multiple monitors due to problems with 3rd party libraries we use.  Sometimes dialog "tips" come up in the wrong place when a dialog is displayed on a non-primary monitor.  Also, bringing up a context menu then clicking outside it may cause HexEdit to crash it the monitor has negative screen coordinates.  For this reason it is strongly recommended that you do not have any monitors positioned above or to the left of the primary monitor.

Q. I don't know XML.  Is there an easier way to create templates?

A. HexEdit 2.5 contains a built-in template editing facility.  This facility should be regarded as "beta" as it has not been thoroughly tested and there are a few things to watch out for as mentioned below.  However, it is generally much easier than creating templates by writing the XML code directly.

You can turn the template editing on by double right clicking in the Display page of the Options dialog. Another way is to directly edit the registry entry that controls this using regedit by changing 
HKCU\Software\ECSoftware\HexEdit\DataFormat\Edit from 0 to 1.

Once editing is turned on you can right click any entry in the tree view which brings up options such as allowing to edit it as well as inserting, deleting etc.

You can also drag and drop items to move them around. This can be a big time-saver. Note that you can only drag into structs as they are the only items that can have multiple sub-items. You can also copy items instead of moving them using the Ctrl key while dragging. Also you can copy between templates (with 2 different types of files open) which is handy if 2 different formats share similar sub-elements.

One thing to watch out for when template editing is turned on is that it is very easy to drag a struct item into itself (if you select a struct then click it again and slightly move the mouse before you release the button). Many times I have inadvertently created a copy of a struct inside itself, which can be very confusing if you don't know what is happening.

The above problem will of course, be addressed in the next version when template editing is "released". I will also be adding a few other template editing features, such as the ability to parse C/C++ structs/classes. I welcome any ideas in this area.

---------- End of FAQ ----------

Back to Top