Your hex editor should color-code bytes • Hacker News Board

Re: Your hex editor should color-code bytes

#91

Post by Crestwave » Thu, Apr 23, 2026, 2:47 PM UTC

bwiggs wrote: post #63

DEFCON30, Mayhem CTF. We were given a file full of random bytes. The flag was in there somewhere. It was too random to be encrypted, there wasn't any structure. `file` didn't return anything, truly just a bag of bytes. I had decided to install `hexyl` as an alternative option to some of the other hex editors installed o my linux machine. All the bytes were colored grey. I scrolled the file and noticed a blip of yello…

Wouldn't strings(1) have worked for this?

Re: Your hex editor should color-code bytes

#92

Post by 0xfalafel » Thu, Apr 23, 2026, 2:47 PM UTC

Shameless plug: I have written an hexadecmial editor (in Rust) that colors bytes. It looks similar to hexyl.

https://github.com/0xfalafel/hextazy

Some nice features are:

- robust undo

- insertions (not just overwriting)

- inspect the value of selected bytes

- search

I have also recently discover this other project that is pretty cool: https://github.com/mentebinaria/dz6

Re: Your hex editor should color-code bytes

#93

Post by masfuerte » Thu, Apr 23, 2026, 2:48 PM UTC

bwiggs wrote: post #63

DEFCON30, Mayhem CTF. We were given a file full of random bytes. The flag was in there somewhere. It was too random to be encrypted, there wasn't any structure. `file` didn't return anything, truly just a bag of bytes. I had decided to install `hexyl` as an alternative option to some of the other hex editors installed o my linux machine. All the bytes were colored grey. I scrolled the file and noticed a blip of yello…

I don't get it. If you were looking at random data, why did hexyl apply colour to only the brace, C, T and F?

Re: Your hex editor should color-code bytes

#94

Post by throwawaysoxjje » Thu, Apr 23, 2026, 2:49 PM UTC

bwiggs wrote: post #67

abcd_f wrote: post #65

Earlier quoted context omitted.

> It was too random to be encrypted That's a rather odd remark.

You would still expect some amount of file structure, ex byte headers or something at the beginning/end of file. no?

I’d expect the greater length of the encrypted data (which should look random) vs the structured header/footer to rapidly push the Shannon entropy to the maximum

Re: Your hex editor should color-code bytes

#95

Post by kleiba2 » Thu, Apr 23, 2026, 2:50 PM UTC

TeMPOraL wrote: post #52

bandrami wrote: post #2

Emacs's hexl-mode does this, incidentally, though annoyingly by default it makes all faces the same color. I never understood why it defines the faces but then doesn't customize them.

What exactly does it do? I'm looking at hexl-mode sources in my Emacs, and I see it defining only two faces - hexl-address-region and hexl-ascii-region.

That's correct, as far as I can tell: the first one is used for all hex values in the "main" are of the buffer, and the second one for the character representation of each byte in the right-hand side column.

Re: Your hex editor should color-code bytes

#96

Post by wang_li » Thu, Apr 23, 2026, 2:56 PM UTC

bwiggs wrote: post #67

abcd_f wrote: post #65

Earlier quoted context omitted.

> It was too random to be encrypted That's a rather odd remark.

You would still expect some amount of file structure, ex byte headers or something at the beginning/end of file. no?

No. Why would you? Encrypted data should look no different than random. The app figures out if it is the app's data after it attempts to decode it.

Re: Your hex editor should color-code bytes

#97

Post by wang_li » Thu, Apr 23, 2026, 3:00 PM UTC

Color coding is a simplistic, half-assed way of doing semantic analysis. Go full assed and make an /etc/magic aware file decoder that decodes and highlights anomalies.

Re: Your hex editor should color-code bytes

#98

Post by criddell » Thu, Apr 23, 2026, 3:03 PM UTC

seritools wrote: post #78

criddell wrote: post #74

Earlier quoted context omitted.

Yes. https://docs.werwolv.net/imhex#screenshots

as far as i can tell, no it does not. it only desaturates 00 in particular. the other colors you see in the screenshots come from matched formats/patterns. it does not do direct coloring based on byte value.

Under the Edit menu select "Highlighting Rules..." and you can define or load any set of rules you can imagine.

Re: Your hex editor should color-code bytes

#99

Post by p0w3n3d » Thu, Apr 23, 2026, 3:05 PM UTC

cuechan wrote: post #23

For anyone who regularly has to look at/analyze binary files, i highly recommend ImHex [1]. Its a hex editor built with imgui and has a lot of built in tools. Imo the best feature is the data structure editor. You can write a data type definition similar to C and it overlays it on the hexdump and parses it in a structured way while you type. It also has a node based editor. 1: https://github.com/WerWolv/ImHex

WOW!!!! if I had this when I had been working on Omnet connector to the HKEX, I would have win my life. I mean financial life, but still...

Re: Your hex editor should color-code bytes

#100

Post by ksherlock » Thu, Apr 23, 2026, 3:10 PM UTC

Crestwave wrote: post #91

bwiggs wrote: post #63

DEFCON30, Mayhem CTF. We were given a file full of random bytes. The flag was in there somewhere. It was too random to be encrypted, there wasn't any structure. `file` didn't return anything, truly just a bag of bytes. I had decided to install `hexyl` as an alternative option to some of the other hex editors installed o my linux machine. All the bytes were colored grey. I scrolled the file and noticed a blip of yello…

Wouldn't strings(1) have worked for this?

By default, strings needs a run of 4+ (printable|ascii) characters. This sounds like it was 1 ascii character at a time in a sea of random data (with other alpha chars removed).