ImHex – A Hex Editor for Reverse Engineers And Programmers
Features
- Featureful hex view
- Byte patching
- Patch management
- Copy bytes as feature
- Bytes
- Hex string
- C, C++, C#, Rust, Python, Java & JavaScript array
- ASCII-Art hex view
- HTML self contained div
- String and hex search
- Colorful highlighting
- Goto from start, end and current cursor position
- Custom C++-like pattern language for parsing highlighting a file’s content
- Automatic loading based on MIME type
- arrays, pointers, structs, unions, enums, bitfields, using declarations, little and big endian support, conditionals and much more!
- Useful error messages, syntax highlighting and error marking
- Data importing
- Base64 files
- IPS and IPS32 patches
- Data exporting
- IPS and IPS32 patches
- Data inspector allowing interpretation of data as many different types (little and big endian)
- Huge file support with fast and efficient loading
- String search
- Copying of strings
- Copying of demangled strings
- File hashing support
- CRC16 and CRC32 with custom initial values and polynomials
- MD4, MD5
- SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
Disassembler supporting many different architectures
- ARM32 (ARM, Thumb, Cortex-M, AArch32)
- ARM64
- MIPS (MIPS32, MIPS64, MIPS32R6, Micro)
- x86 (16-bit, 32-bit, 64-bit)
- PowerPC (32-bit, 64-bit)
- SPARC
- IBM SystemZ
- xCORE
- M68K
- TMS320C64X
- M680X
- Ethereum
- RISC-V
- WebAssembly
- MOS65XX
- Berkeley Packet Filter
Bookmarks
- Region highlighting
- Comments
Data Analyzer
- File magic-based file parser and MIME type database
- Byte distribution graph
- Entropy graph
- Highest and avarage entropy
- Encrypted / Compressed file detection
Built-in Content Store
- Download all files found in the database directly from within ImHex
Yara Rules support
- Quickly scan a file for vulnerabilities with official yara rules
Helpful tools
- Itanium and MSVC demangler
- ASCII table
- Regex replacer
- Mathematical expression evaluator (Calculator)
- Hexadecimal Color picker
- Base converter
- UNIX Permissions calculator
- Anonfiles File upload tool
- Wikipedia term definition finder
- File utilities
- File splitter
- File combiner
- File shredder
Screenshots
Pattern Language
The custom C-like Pattern Language developed and used by ImHex Hex editor is easy to read, understand and learn. A guide with all features of the langauge can be found in the wiki or a simpler version in ImHex under Help -> Pattern Language Cheat Sheet.
Requirements
To use ImHex, the following minimal system requirements need to be met:
- OS: Windows 7 or higher, macOS 10.15 (Catalina) or higher, “Modern” Linux (Ubuntu 22.04, Fedora 36/37, RHEL/AlmaLinux 9, and Arch Linux have official packages, other and older distributions can use the AppImage)
- CPU: x86_64 (64 Bit)
- GPU: OpenGL 3.0 or higher
Intel HD drivers are really buggy and often cause graphic artifacts
In case you don’t have a GPU available, there are software rendered releases available for Windows and macOS - RAM: 256MB, more may be required for more complicated analysis
Storage: 100MB
Additional Files
For format patterns, includable libraries and magic files, check out the ImHex-Patterns repository. Feel free to PR your own files there as well!
Nightly builds
Nightlies are available via GitHub Actions here.
- Windows
Installer
Simply run the installer to install ImHex on your system
Portable
Extract the zip file to any location on your system.
- macOS
Simply use the drag-n-drop dmg package to install ImHex on your system. It’s possible that you need to allow the app to run in the security settings.
- Linux
AppImage
To run the AppImage, make sure it’s executable. Then simply run it.
chmod +x imhex-*.AppImage ./imhex-*.AppImage
Compiling
To compile ImHex on any platform, GCC (or Clang) is required with a version that supports C++23 or higher. On macOS, Clang is also required to compile some ObjC code. All releases are being built using latest available GCC.
Many dependencies are bundled into the repository using submodules so make sure to clone it using the –recurse-submodules option. All dependencies that aren’t bundled, can be installed using the dependency installer scripts found in the /dist folder.
Windows and Linux
On Windows, ImHex is built through msys2 / mingw. To install all dependencies, open a mys2 window and run the PKGCONFIG script in the (dist/msys2)[dist/msys2] folder. After all the dependencies are installed, run the following commands to build ImHex:
mkdir build cd build cmake -DCMAKE_BUILD_TYPE=Release .. make -j
To create a standalone zipfile on Windows, get the Python standard library (e.g. from https://github.com/python/cpython/tree/master/Lib) and place the files and folders in lib/python3.8 next to your built executable. Don’t forget to also copy the libpython3.8.dll and libwinpthread-1.dll from your mingw setup next to the executable.
On both Windows and Linux:
- Copy the files from python_libs in the lib folder next to your built executable.
- Place your magic databases in the magic folder next to your built executable
- Place your patterns in the pattern folder next to your built executable
- Place your include pattern files in the include folder next to your built executable
macOS
To build ImHex on macOS, run the following commands:
brew bundle --no-lock --file dist/Brewfile mkdir build cd build CC=$(brew --prefix llvm)/bin/clang CXX=$(brew --prefix llvm)/bin/clang++ PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig":"$(brew --prefix)/lib/pkgconfig" cmake -DCMAKE_BUILD_TYPE=Release .. make -j
Install the ImHex executable as well as libimhex.dylib to wherever ImHex should be installed.
All other files belong in ~/Library/Application Support/imhex:
Patterns: ~/Library/Application Support/imhex/patterns Pattern Includes: ~/Library/Application Support/imhex/includes Magic files: ~/Library/Application Support/imhex/magic Python: ~/Library/Application Support/imhex/lib/pythonX.X Plugins: ~/Library/Application Support/imhex/plugins Configuration: ~/Library/Application Support/imhex/config Resources: ~/Library/Application Support/imhex/resources
Linux
Dependency installation scripts are available for many common Linux distributions in the (/dist)[dist] folder. After all the dependencies are installed, run the following commands to build ImHex:
mkdir build cd build cmake -DCMAKE_BUILD_TYPE=Release .. make -j
Put the ImHex executable into the /usr/bin folder. Put libimhex.so into the /usr/lib folder. Configuration files go to /etc/xdg/imhex or ~/.config/imhex. All other files belong in /usr/share/imhex or ~/.local/share/imhex:
Patterns: /usr/share/imhex/patterns Pattern Includes: /usr/share/imhex/includes Magic files: /usr/share/imhex/magic Python: /usr/share/imhex/lib/pythonX.X Plugins: /usr/share/imhex/plugins Configuration: /etc/xdg/imhex/config Resources: /usr/share/imhex/resources
All paths follow the XDG Base Directories standard, and can thus be modified with the environment variables XDG_CONFIG_HOME, XDG_CONFIG_DIRS, XDG_DATA_HOME and XDG_DATA_DIRS.
Also See: GDA- Android Reverse Engineering Suite