The Hex Editor provides several useful utilities to help navigate and work with files and RAM.
Bookmarks indicate that certain bytes in a file or RAM are significant. Bookmarks can be interpreted as any standard type, and in the future they will also support interpretation as types defined by templates. Bookmarks are assigned colors and stand out from the normal display. Bookmarks can be browsed using the Bookmarks tab in the Helper.
To add a bookmark, press Ctrl-B or select the Search/Add/Edit Bookmark menu item. If a bookmark exists at the address where the caret is, the bookmark will be modified. Otherwise, a new bookmark will be created at the address of the caret.
Here you can specify the name, type, color, and array size of the bookmark, and determine if it follows the mouse or not.
The following chart explains each option.
Name of the bookmark.
Interpretation of the bookmark.
If an array of the specified type is desired, supply the array size, or 1 for no array.
Move Bookmark With Cursor
If checked, the bookmark will move to each location where the mouse is clicked.
Color of the bookmark.
To remove a bookmark, click the address of the bookmark or select the bookmark in the Helper, then either press Ctrl-Shift-B or select the Search/Remove Bookmark menu item.
To remove all bookmarks, press Ctrl-Shift-F2 or select the Search/Clear All Bookmarks menu item.
To go to the next bookmark after the cursor, press F2 or select the Search/Next Bookmark menu item.
To go to the previous bookmark, press Ctrl-F2 or select the Search/Previous Bookmark menu item.
The Find utility allows you to find values of various types of data and supports wildcard (? and *) and regular-expression searches (see Wildcards and Regular Expressions).
Access the Find utility by pressing Ctrl-F or by selecting the Search/Find... menu item.
You can seach up and down, find all cases or the next/previous case, search the entire file/RAM or just the selection, and all with any type of data.
If Find All is checked, the primary button reads Find All. If Find All is not checked, the primary button reads Find Next if the search direction is Down and Find Previous if the search direction is Up.
The following chart explains each option.
The type of data to find.
The value to find. The format of the value depends on the selected Type.
Any text string.
Same as above.
A hex string where each hex value should be separated by a space.
An integer value in the range of a char. See Data Types.
An integer value in the range of a byte. See Data Types.
An integer value in the range of a short. See Data Types.
An integer value in the range of an unsigned short . See Data Types.
An integer value in the range of a long. See Data Types.
An integer value in the range of an unsigned long . See Data Types.
Signed 64-bit Int
An integer value in the range of a 64-bit integer . See Data Types.
Unsigned 64-bit Int
An integer value in the range of an unsigned 64-bit integer . See Data Types.
A floating-point value.
A floating-point value.
Shows the actual hex bytes that will be found in the file or RAM.
If using an ASCII String or Unicode String search, this indicates that the string is case-sensitive. This is not used in regular-expression searches.
Match Whole Word Only
If using an ASCII String or Unicode String search, this indicates that only full words will be found. For example, a search for ro would find a match in [lo-ro.] but would not find a match in [L. Spiro], because the ro here is part of a longer word. This is not used in regular-expression searches.
Regular expressions always scan from the top and go down.
This option will cause the search to cover the entire range specified and each item that is found will be bookmarked and highlighted. The bookmarks work the same as bookmarks set by the user except that they are not added to the Helperbookmark list.
Specifies that the search should go upwards instead of downwards. Does not apply in Find All searches because they always scan the entire range, starting from the top down.
Specifies that the search should go downwards. Does not apply in Find All searches because they always scan the entire range, starting from the top down.
Specifies that the scan will cover the entire file or RAM.
Specifies that the scan will only cover the selected area.
To quickly find the next occurrence, press F3 or select the Search/Find Next menu item.
To quickly find the previous occurrence, press Ctrl-F3 or select the Search/Find Previous menu item.
Press Ctrl-R or select the Search/Replace menu item to load the Replace dialog. The options here are exactly the same as in the Find dialog, with a few exceptions.
The primary difference is that when matches are found, they are replaced with the value in the Replace With section. No bookmarks are set when replacing all occurrences.
If Replace All is checked, the primary button reads Replace All. If Replace All is not checked, the primary button read Replace Next if the search direction is Down and Replace Prev if the search direction is Up.
To perform the replacing action again, press F4 or select the Search/Replace Again menu item.
If a scan takes longer than 30 seconds, a dialog will appear to give you some options.
You can halt the operation, wait and be prompted again later, or give the operation all the time it needs. If you give the operation its time, you have another option to be notified by a dialog when the operation is completed. This option also makes a beep to alert you that the operation is done.
Pressing the Options button on the Find and Replace dialogs displays the options for the find/replace operation.
This is the regular expression associated with the macro name in Macro Name (Must Begin With '$').
Adds your custom regular-expression macro to the list. If the macro exists it is overwritten. System-defined regular -expression macros can not be overwritten.
Remove the selected macro from the list. System-defined regular-expression macros can not be removed.
The Go to... utility allows you to go to a specific address in the file or RAM.
You can enter the address or offset in either hex or decimal.
To go directly to an address, select From Beginning of File and enter the address directly. Otherwise the address field is an offset, either from the current position or from the end of the file. From End of File is not available in RAM.
If From End of File is checked, the offset in the Address field implies the number of bytes before the end of the file where you would like to go. For example, entering 5 here would take you to the position 5 bytes before the end of the file.