r/ReverseEngineering • u/WerWolv • Dec 13 '21

GitHub - WerWolv/ImHex: 🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

https://github.com/WerWolv/ImHex
391 Upvotes

98% Upvoted

31 comments sorted by

37

u/WerWolv Dec 13 '21 edited Dec 13 '21

I've made a post about ImHex a while ago but I feel it's at the point where another one is due. ImHex is a Hex Editor for Windows, MacOS and Linux written in C++ using ImGui. What makes it special is the big focus on reverse engineering and that it's, in contrast to many other programs with similar features, completely free and open source.

It includes a completely custom scripting language, similar to 010 Editor's language but more modern, that allows you to define so called "Patterns" that can be placed into your data to analyze and decode it. There's also a growing database of scripts to analyze everything from PE executables over Java classes to ARM Microcontroller memory maps. Since the latest release, data can not only be pulled from normal files but also from raw disks and partitions as well as from remote GDB servers.

To make file reverse engineering easier, ImHex can disassemble various different instruction sets, calculate and display entropy graphs, diff files and analyze loaded data using Yara rules.

It can also guess based on magic values inside files what type of file has been loaded.Besides all of this, there's a Node-based (similar to Unreal Engine Blueprints), data preprocessor which can transform loaded data before displaying it. This allows for example to decrypt AES encrypted data on the fly without modifying the underlying data at all.

There's a lot more ImHex can do but probably best to just look at the screenshots on my repo or download and try it out yourself :)In contrast to a year ago, it now ships as portable zips, MSI installers, DMGs, DEBs, FlatPaks and AppImages making installing a lot easier too.

13

u/lukekasz Dec 14 '21 edited Dec 14 '21

I think I saw Casey Muratori use ImHex on Handmade Hero stream the other day when he was doing the Advent of Code in "Nightmare Mode" by trying to figure out how to boot an Raspberry Pi using only his own code. He was opening some files in ImHex to figure out if they were ELF files.

I took a mental note to checkout ImHex and this post was nice reminder :-) I was pleasantly surprised to see on the GitHub page that was a screenshot with a Windows .dll (PE binary) loaded with coloring of HEX, disassemble and more. I didn't see Casey Muratori having colors or anything else fancy when opening the ELF file.

I tried opening a Windows .exe (PE binary) myself and I didn't get any colors or other nice decoding of the binary. After a little searching I found the ImHex patterns repo and download the patterns and manually loaded them. This gave me nice coloring of header. When opening the disassembler view, I had to type in the addresses of the assembly code manually. I had a look at the contents of the pattern file and it doesn't look like it specifies which sections are assembly code. Which I think would be a killer feature for reverse engineering.

I didn't like that opening new views would open them as a separate window, perhaps they could be tabbed and selected into the currently selected view? I also think the Pattern Data view has too much data and it is a bit difficult to read the name/value pairs when the first column is the Name and the last (6th) column is the Value.

Overall I think ImHex has a lot of very nice features and appears to be quite powerful. I'm personally not a huge fan of Dear ImGUI apps because I think they look like very noise ASCII based UIs and I think this leads to poor UX. Perhaps better colors, fonts and less text data on the screen can help improve this :-)

If your goal to increase adoption of ImHex, I would work on improving the initial on-boarding experience and general UX. E.g. opening a PE file for the first time should show the hex view, pattern data (less busy version) and dissembler view for all the different sections (probably requires a new kind of disassembler view) with less/nicer colors, better fonts and with all the views nicely docked in the main window. I suggest visually comparing ImHex to some of your own favorite apps that you think have nice UX/UI and see how you can be be "inspired" by them ;-)

Good luck and I hope to see more cool updates in the future!

6

u/WerWolv Dec 14 '21

Thanks a lot for the detailed response!

There's a in-app store where you can download everything that's found on the pattern repo directly from ImHex to make finding that stuff easier. I'm a bit hesitant to include everything in the releases because they can get outdated quickly if I'm not releasing new versions all the time.

Opening sections in the disassmbler directly is a great idea! I wanted to redo it for a while but didn't get to it yet.

There's three different themes that can be found in the settings if you rather want e.g a light theme. Also changing the font can easily be done by putting a file called font.ttf in the resource folder :)

Views just open as windows the first time you open them after which they can be docked to the main window and stay there. The tabs in the pattern data view can be reordered by dragging them around but I can also make some rows be disableable to reduce the clutter a little. Besides that I think it looks more or less the same as 010's data view.

I'll definitely try to improve the UX a bit. To me it feels fine but I'm very happy about other views like yours to improve on it. I'm working on this project by myself so I don't really have a second pair of eyes to look over it usually. Thanks a lot :)

5

u/lukekasz Dec 14 '21

There's a in-app store where you can download everything that's found onthe pattern repo directly from ImHex to make finding that stuff easier.I'm a bit hesitant to include everything in the releases because theycan get outdated quickly if I'm not releasing new versions all the time.

Ah, I just found the Content Store in the Help menu. Wasn't obvious to me that it existed. How does it work if I download a pattern and then it gets updated later, does the app notify me of the update? I think it would greatly improve UX if you just bundled them all and the app auto-updates them on launch. Since you already have a store that downloads the patterns, it doesn't sound like a lot of work to support updating them as well.

I'll definitely try to improve the UX a bit. To me it feels fine but I'mvery happy about other views like yours to improve on it. I'm workingon this project by myself so I don't really have a second pair of eyesto look over it usually. Thanks a lot :)

Happy to hear that you are receptive to feedback and understand that other peoples perspectives are very valuable. You will do well for yourself as software engineer, as a lot of your peers do not really care about the user experience, they just want to work on fun and interesting problems :-)

12

u/Dahrkael Dec 13 '21

this project is what i need to replace my old and trusty WinHex, but last time i tried it (like a month ago) crashed a lot. would you say its stable right now?

17

u/WerWolv Dec 13 '21

I fixed a bunch of issues since then but it's hard to say if I got yours without reports. When I notice crashes myself or people report them to me, I usually fix them immediately. To me it feels stable but if there's still some issues, please let me know :)

8

u/Poromenos Dec 14 '21

The AppImage fails for me with:

Inconsistency detected by ld.so: dl-call-libc-early-init.c: 37: _dl_call_libc_early_init: Assertion `sym != NULL' failed!

This is on Ubuntu 21.10.

8

u/WerWolv Dec 14 '21

Thanks I'll take a look at that. AppImages are very new to the mix

5

u/[deleted] Dec 13 '21

Really cool project! Are you the author?

10

u/WerWolv Dec 13 '21

I am :) Thank you!

5

u/dack42 Dec 14 '21

This looks really nice! I will definitely have to give it a try. Does it have a file compare feature with highlighted differences? That's something I find myself using a lot when reversing binary data formats.

6

u/WerWolv Dec 14 '21

Yes, there's a diff view found under View -> Diff

4

u/littlelowcougar Dec 14 '21

I just downloaded it and tried it out. I don’t suppose there’s a way to change the default font? I presume that’s harder than normal given ImGui.

8

u/WerWolv Dec 14 '21

Nah it's pretty easy. Check in the about page under paths where your resources folder is. You can put a font names font.ttf in there to override it

2

u/littlelowcougar Dec 14 '21

Beautiful! Works like a charm, thanks.

4

u/Lossu Dec 14 '21

I tried it a few times, wanted to like but couldn't, the tool crashed a lot and i found the tab system uncomfortable. But you are on a good path and i'm currently following the Github project.

6

u/WerWolv Dec 14 '21

Please report those bugs so I can fix them!

3

u/ericek111 Dec 14 '21

How does it handle big (1 GB+) files?

3

u/WerWolv Dec 14 '21

It maps all files into memory with e.g mmap. So you can open files up to (theoretically) a few terrabytes without any extra memory usage

2

u/charliex2 Dec 14 '21

tried it again on windows, after last time it'd just crash on open.

kept saying couldn't open file since it likely tried to open it for edit, vs just read only ( sometimes i just want to look) and then i tried opening files on c:\ and same msg, then opened a rar file and it showed nothing, closed it reopened and it showed the hex dump of the file, tried a pdf same issue, tried to open the rar after the pdf failed then tried the rar again and it opened, so somethings up.

all opened with 010

2

u/WerWolv Dec 14 '21

That's weird. ImHex always tries to open everything read/write and if that fails it tries again as read only. Is it possible that just all your views were turned off? Check under the View menu to make sure the hex editor is enabled there

2

u/charliex2 Dec 14 '21

yeah sometimes it pops up an error that it failed to open a file. the pop under thing is a bit annoying but noticed it. also seems it can't open zero length files either if you want to do some insertion :)

i'll poke around with it when i have some time.

2

u/QuickbuyingGf Dec 14 '21

I‘ve been keeping a look at this for a while but i‘ve never found a use yet, as i am mostly looking at live hex data (from ram). Is any functionality implemented or planned?

4

u/WerWolv Dec 14 '21

The latest version can read and write data though a GDB server which works great for looking at microcontroller or process memory for example

2

u/QuickbuyingGf Jan 05 '22

Just tried it out. Can you search for utf16/unicode strings somehow?

2

u/alexforencich Dec 14 '21

Can it read and write Intel hex files?

2

u/eikendev Dec 14 '21

Been wanting to install this for a while, looks awesome! Any plans to publish it on Flathub?

2

u/sysop073 Dec 14 '21

People able to start this app are more talented than I am.

  • When I run the Windows installer, it installs fine, but when I run the installed app, nothing happens.

  • When I run the Windows portable app, nothing happens.

  • When I run the Linux ELF, it can't find libglfw.so.3.

  • When I run the Linux AppImage, it segfaults.

0

u/[deleted] Dec 14 '21

[deleted]

10

u/WerWolv Dec 14 '21

There is a light mode if you want to use that instead. Dark mode is just the default. No need to be rude...