Editing Dump in HEX Mode in BitEdit

Opening HEX Editor

There are several alternative ways to open the HEX editor in BitEdit:

1. Select Tools → Edit Dump from the main menu
2. Double-click "Edit Hex Dump" in the Map Tree
3. Click Dump button in the Tools section of the Main Ribbon tab

HEX Editor Interface

First of all, every toolbar element has a tooltip that appears when you hover the mouse over it. This tooltip provides a brief description of the element's function.

However, we provide a more detailed description of the toolbar elements below:

1. Help & Settings section contains three buttons:
   • Hotkey Help button opens the Hotkey Help dialog. More on that below.
   • Head to BitEdit website for help button opens this document in your default browser.
   • Color Settings button opens the HEX Editor Highlighting Settings Page.
2. Format section contains the following elements:
   • Binary Format Combo Box allows you to switch between different binary formats. Supported display formats are:
     • Signed and Unsigned Integers (8, 16, 32, 64 bits)
     • IEEE 754 Floating Point Numbers (32 and 64 bits)
   • HEX/DEC Toggle Button switches between HEX and DEC display modes.
     • In HEX mode, the editor displays the data in hexadecimal format. In particular, if the format is set to Float, the editor shows the raw hexadecimal representation of the floating-point number.
     • In DEC mode, the editor displays the data in decimal format. If the format is set to Float or Double, the editor parses the dump bytes as the corresponding floating-point number, while taking the current endianness into account.
   • Endianness Toggle Button switches between Little-Endian and Big-Endian byte order.
3. Aux Column Toggles section controls visibility of the auxiliary columns:
   • ASCII Toggle Button shows/hides the ASCII column, similar to those in the classic HEX editors.
   • Bars Toggle Button shows/hides the special column that show bars of height proportional to the cell value offset from the minimum value in the current view. This column is useful for visualizing the distribution of values in the current view.
     • Hint: disabling Bars may improve performance on slower machines.
4. Column Count and Offset section
   • Column count controls the number of columns displayed in the editor.
     • When you change the display format, the column count is automatically adjusted to fit the same number of bytes in the row, if possible.
   • Shift controls the physical address of the value displayed at Row 0, Column 0. This value is set in BYTES, which could be used to read multibyte values with bad alignment.
     • For example, setting Shift to 1 with the current format set to "32-bit Float" will result in editor reading the 4 bytes starting from the second byte in the dump as a floating-point number and displaying it at Row 0, Column 0.
     • Notice that if you set a non-zero shift, the Address column will properly calculate the physical address of the value displayed at each row's first column.
5. Navigation Section contains dump navigation controls:
   • Cursor Tracker just shows the current cursor byte address in the dump. This tracks the currently highlighted cell, not the keyboard input caret which can move within the cell.
     • If you hover the cursor tracker, a tooltip will inform you that you can always hit Ctrl+G to jump to a specific HEX byte address. Notice that address is always counted in bytes, rather than cells, and is always input in HEX format.
   • Half-page jumps/Full-page jumps toggle button switches between half-page and full-page jumps when using the PgUp and PgDn keys. Some people prefer to jump by half-page to keep the current cursor in the middle of the screen.
   • Find section allows to search for a specific byte pattern or text in the dump, and navigate between the search results.
     • First, Previous, Next, and Last buttons allow you to navigate between the current search results.
     • Open Find Dialog initiates a new search.
   • Diffs section allows you to navigate between the differences in the dump. This is useful when reviewing the changes compared to the original dump.
     • First, Previous, Next, and Last buttons allow you to navigate between the current differences.
     • Open Diff Navigator opens the Diff Navigator dialog that tracks all the changes made to the dump and controls how they are merged into logical blocks based on their proximity.
6. Editing Section contains controls that perform operations on currently selected cells:
   • Copy button copies the selected cell values to the clipboard.
   • Paste button pastes the clipboard contents into the selected cells.
   • Fill button fills the selected cells with the specified pattern. More on that below.
   • Zero button fills the selected cells with zeros.
   • To Original button reverses the selected cell values to the original dump values.
   • Percent Inc/Dec buttons increase or decrease the selected cell values by X% of the original value or the current value, depending on the Percent Mode toggle (linear or exponential). The input box allows you to specify the percentage per click.
   • Delta Inc/Dec buttons increase or decrease the selected cell values by X units. The input box allows you to specify the delta per click.

Keyboard navigation

• Arrow keys move the caret. On the Hex Editor Settings page, you can control how BitEdit handles the caret movement:
  • Wrap mode: you jump from the last cell in the row to the first cell in the SAME row, and vice versa;
  • Flow mode: you jump from the last cell in the row to the first cell in the NEXT row, and vice versa;
  • Restricted mode: you can't move the caret outside the current row with left/right arrow keys.
• PgUp and PgDn keys jump the caret by half-page or full-page, depending on the Half-page jumps/Full-page jumps toggle. This does NOT change the selection.
• Ctrl+G opens the Go to Address dialog, where you can input the address in HEX format to jump to a specific byte in the dump.
• Home and End keys jump the caret to the beginning or the end of the dump, respectively.

Binary Format Hotkeys

• Ctrl+1 switches to 8-bit Integer format. Pressing again when already in 8-bit will toggle between signed and unsigned.
• Ctrl+2 same as above, but for 16-bit Integer format.
• Ctrl+3 same as above, but for 32-bit Integer format.
• Ctrl+4 same as above, but for 64-bit Integer format.
• Ctrl+5 switches to 32-bit Float format. Pressing again when already in 32-bit will switch to 64-bit Float.
• Ctrl+6 switches between Little-Endian and Big-Endian byte order.
• Ctrl+7 switches between HEX and DEC display modes.

Manipulating Selection

BitEdit supports flexible selection, not limited by a single continuous range. You can select multiple cells in a non-continuous manner, and the editor will keep track of all the selected cells. Some features do take this possibility into account. More on that below.

Mouse Selection

Just clicking on a cell will select it. You can drag the mouse to select multiple cells. The following keyboard modifiers are recognized:

• Ctrl will result in the current selection being extended by the new selection, rather than replaced by it.
• Alt will result in the new selection being a rectangle, rather than a continuous range.

Keyboard Selection

• If you press arrow keys without holding any modifiers, the current selection will be discarded entirely, and only the cell under the caret will be selected instead.
• Holding down Shift starts the range selection from the current caret position. Travel with arrow keys to extend the new selection range, and release Shift to finish the selection. If you didn't hold Ctrl when you pressed the Shift, the old selection will get immediately discarded. If however you held Ctrl, you will also need to hold it when releasing Shift to keep the old selection.
• If you hold just Ctrl, the caret will move as you press the arrow keys, but the selection will remain the same.
• If you need to add a single cell to the current selection, you can travel to it with Ctrl key held, and press Space.

Continuous Block Selection

• Shift+G will discard the current selection and select a continuous range from the current caret position, of length specified in the input window that will appear.
• Ctrl+Shift+G will add a continuous range to the current selection, of length specified in the input window that will appear.

Important things to know:

• you can specify a NEGATIVE HEX number, e.g. -1A, to select the range in the opposite direction.
• the block size can be counted from the current caret position, or from the next cell, depending on the Hex Editor Settings:
  • if you check "Current cell is included in selection counter", and want to select 16 bytes starting from the current caret position, you should input 10 in the input window (assuming the current format is set to 8-bit bytes).
  • if you uncheck "Current cell is included in selection counter", and want to select 16 bytes starting from the current caret position, you should input F in the input window (assuming the current format is set to 8-bit bytes), because the current cell is not counted.
• If the requested block size is too large, the selection will be truncated to the dump's boundaries.

Keyboard value input

If in HEX mode, you can input the value directly in HEX format. The editor will automatically convert the input to the current format. If in DEC mode, you can replace the currently stored HEX value letter by letter, just as if you were typing in a text editor.

Hitting a digit or a letter a..f will replace the currently highlighted hex digit inside the caret (and move the caret to the next cell if the current digit is the last one in the cell).

Hitting Space will move the keyboard input caret to the next digit in the current cell or to the next cell if the current digit is the last one in the cell. This basically means skipping the current digit (leaving it unchanged) as you type.

Hitting Shift+Space will move the caret to the previous digit in the current cell or to the previous cell if the current digit is the first one in the cell without changing anything.

Hitting Backspace will move the caret to the previous digit in the current cell or to the previous cell if the current digit is the first one in the cell -- and restore the ORIGINAL digit there. This is most usually used to correct a mistake in the input.

Do try to input some values in the editor to get a feel for how it works.

Selection Modifying Operations

Revert to Original

One of the most important operations, this will revert the selected cells to the original dump values. This is useful when you want to undo some changes you made.

Copy/Paste

Just as in virtually any editor, you can copy the selected cells to the clipboard and paste the clipboard contents into the selected cells. The editor will automatically adjust the pasted data to fit the current selection size.

However, BitEdit also comes with its own clipboard, which can store multiple selections. You can copy multiple selections to the clipboard, and then paste them into the dump in any order. This is useful when you want to copy multiple non-continuous ranges of data. To open BitEdit Chunk Clipboard, hit "Ctrl+Alt+C".

The Chunk Clipboard toolbar contains three groups of controls:

• Regular Copy/Paste, that duplicates the Ctrl+C/Ctrl+V functionality of the Hex Editor.
• Windows Clipboard interaction controls:
  • Copy to/Paste from Windows Clipboard (useful to transfer chunks between different instances of BitEdit)
  • Enable/disable Windows Clipboard Usage when copying/pasting (if disabled, the editor will use the Chunk Clipboard when you hit Ctrl+C or Ctrl+V).

Do remember though, that the chunk clipboard is not persistent between sessions, and will be cleared when you close BitEdit.

Also, do try to avoid copy-pasting to and from Windows Clipboard in Float or Double formats, as sometimes this will result in precision loss due to the way the floating-point numbers are stored in memory. BitEdit reads and writes actual decimal values to and from Windows clipboard, while Chunk Clipboard stores the raw bytes, preventing any possible precision loss.

Hover the mouse over the buttons in the Chunk Clipboard toolbar to see what they do.

Fill Selection

This is a powerful feature that allows you to fill the selected cells with a pattern. The pattern can be specified in the Fill Dialog, which can be opened by hitting Ctrl+E.

If the input sequence is shorter than the selection, it will be repeated. If it is longer, it will be truncated. If the selection contained multiple non-continuous ranges, the input sequence will be repeated for each continuous range, starting from the beginning of the sequence each time.

If in HEX mode, the input sequence is just a sequence of HEX bytes. If in DEC mode, the input sequence is a sequence of decimal numbers separated by spaces. To skip a value, type a single asterisk * in DEC mode.

The values in DEC mode will be parsed as the current format. Floating-point numbers additionally allow the following special case-invariant values in the sequence:

• NaN will be parsed as a NaN value.
• Inf, +Inf, Infinity, +Infinity will be parsed as an infinity value.
• -Inf, -Infinity will be parsed as a negative infinity value.

For example, filling the selection with 1 2 * 4 in DEC mode will process the selection as shown below:

Set to Zeroes

This operation will zero out the selected cells. It is equivalent to manually filling the selection with 0s.

Increment/Decrement

These operations will increase or decrease the selected cells by a specified percentage or delta. The percentage can be specified in the input box, and the delta can be specified in the input box or by hitting the + or - buttons.

The Percent Mode toggle allows you to switch between linear and exponential percentage increase. In linear mode, the selected cells will be increased by the specified percentage of the original value. In exponential mode, the selected cells will be increased by the specified percentage of the current value.

Search Navigation

After you initiate a search (via Ctrl+F or Find button), you can navigate between the search results using the First, Previous, Next, and Last buttons in the Toolbar. The editor will automatically scroll to the found cell. Next and Previous buttons can also be accessed via F3 and Shift+F3 hotkeys.

A search can be done in HEX or ASCII mode. To search in HEX mode, just type the HEX sequence in the search box. To mark a digit as insignificant, type X instead of the digit.

For example, searching for 1X 33 will find all the cells that have 1 as the first digit of the first byte and the second byte equal to 0x33.

To search in ASCII mode, start by typing the prefix T or t in the search box, then type the ASCII sequence you want to find. The prefix and the sequence should be separated by a space. t indicates a case-insensitive search, while T indicates a case-sensitive search.

For example, searching for t hello will find all the cells that contain the ASCII sequence hello, regardless of the case.

After the search is initiated, the Search Navigator panel will appear, showing the entire list of search results (addresses and first hex bytes). Double-clicking on a result in the Search Navigator will jump to the corresponding cell in the dump.

Hitting the Discard button will discard the search results, clear the highlighting, and close the Search Navigator, effectively freeing the memory used to store the search results (which can be quite large for short search sequences with many occurrences).

The image below shows the Search Navigator panel with the search results for the sequence 11 22 in the HEX mode, and some of the search results highlighted in the HEX editor.

Diff Navigation

BitEdit tracks all the changes made to the dump and allows you to navigate between them using the First, Previous, Next, and Last buttons in the Diffs section of the Hex Editor Toolbar. The editor will automatically scroll to the changed cell. Next and Previous buttons can also be accessed via Ctrl+PgDn and Ctrl+PgUp hotkeys.

Hitting the Open Diff Navigator button (or pressing Ctrl+Shift+D) will open the Diff Navigator dialog, which allows you to control how the changes are merged into logical blocks based on their proximity. The dialog also allows you to navigate between all the chunks of changes in the dump.

By choosing the Merge Proximity, you can control how close the changes need to be in order to be merged into a single block. The default value is 1, which means that all the changes that are separated by a single unchanged cell will be merged into a single block. If you set the Merge Proximity to 0, no merging will be done, and any unchanged cell will break the block.

This is how the same dump looks with the changes merged into blocks with Merge Proximity set to 1 and 2:

If Chess Jumps is checked, the Diff Navigator will jump between the changes in a chess-like manner, i.e., it will jump from a changed block to an unchanged block, and vice versa.

if Chess Jumps is NOT checked, the Diff Navigator will jump between the changes, skipping the unchanged regions.