The Hex Editor provides several useful utilities to help navigate and work with files and RAM.
Bookmarks
Bookmarks indicate that certain bytes in a file or RAM are significant. Bookmarks can be interpreted as any standard type, and in the future they will also support interpretation as types defined by templates. Bookmarks are assigned colors and stand out from the normal display. Bookmarks can be browsed using the Bookmarks tab in the Helper.
To add a bookmark, press Ctrl-B or select the Search/Add/Edit Bookmark menu item. If a bookmark exists at the address where the caret is, the bookmark will be modified. Otherwise, a new bookmark will be created at the address of the caret.
Here you can specify the name, type, color, and array size of the bookmark, and determine if it follows the mouse or not.
The following chart explains each option.
Option
Meaning
Name
Name of the bookmark.
Type
Interpretation of the bookmark.
Array Size
If an array of the specified type is desired, supply the array size, or 1 for no array.
Move Bookmark With Cursor
If checked, the bookmark will move to each location where the mouse is clicked.
Color
Color of the bookmark.
To remove a bookmark, click the address of the bookmark or select the bookmark in the Helper, then either press Ctrl-Shift-B or select the Search/Remove Bookmark menu item.
To remove all bookmarks, press Ctrl-Shift-F2 or select the Search/Clear All Bookmarks menu item.
To go to the next bookmark after the cursor, press F2 or select the Search/Next Bookmark menu item.
To go to the previous bookmark, press Ctrl-F2 or select the Search/Previous Bookmark menu item.
Find
The Find utility allows you to find values of various types of data and supports wildcard (? and *) and regular-expression searches (see Wildcards and Regular Expressions).
Access the Find utility by pressing Ctrl-F or by selecting the Search/Find... menu item.
You can seach up and down, find all cases or the next/previous case, search the entire file/RAM or just the selection, and all with any type of data.
If Find All is checked, the primary button reads Find All. If Find All is not checked, the primary button reads Find Next if the search direction is Down and Find Previous if the search direction is Up.
The following chart explains each option.
Option
Meaning
Type
The type of data to find.
Value
The value to find. The format of the value depends on the selected Type.
Type
Format
ASCII String
Any text string.
Unicode String
Same as above.
Hex Bytes
A hex string where each hex value should be separated by a space.
Signed Byte
An integer value in the range of a char. See Data Types.
Unsigned Byte
An integer value in the range of a byte. See Data Types.
Signed Short
An integer value in the range of a short. See Data Types.
Unsigned Short
An integer value in the range of an unsigned short . See Data Types.
Signed Long
An integer value in the range of a long. See Data Types.
Unsigned Long
An integer value in the range of an unsigned long . See Data Types.
Signed 64-bit Int
An integer value in the range of a 64-bit integer . See Data Types.
Unsigned 64-bit Int
An integer value in the range of an unsigned 64-bit integer . See Data Types.
Float
A floating-point value.
Double
A floating-point value.
Hex Bytes
Shows the actual hex bytes that will be found in the file or RAM.
Match Case
If using an ASCII String or Unicode String search, this indicates that the string is case-sensitive. This is not used in regular-expression searches.
Match Whole Word Only
If using an ASCII String or Unicode String search, this indicates that only full words will be found. For example, a search for ro would find a match in [lo-ro.] but would not find a match in [L. Spiro], because the ro here is part of a longer word. This is not used in regular-expression searches.
Use Wildcards
Only used with ASCII String searches. This indicates that the string in the Value box is in wildcard fomat. See Wildcards and Regular Expressions.
Use Regular Expressions
Only used with ASCII String searches. This indicates that the string in the Value box is in regular-expression fomat. See Wildcards and Regular Expressions.
Regular expressions always scan from the top and go down.
Find All
This option will cause the search to cover the entire range specified and each item that is found will be bookmarked and highlighted. The bookmarks work the same as bookmarks set by the user except that they are not added to the Helperbookmark list.
Up
Specifies that the search should go upwards instead of downwards. Does not apply in Find All searches because they always scan the entire range, starting from the top down.
Down
Specifies that the search should go downwards. Does not apply in Find All searches because they always scan the entire range, starting from the top down.
Entire File
Specifies that the scan will cover the entire file or RAM.
Selection
Specifies that the scan will only cover the selected area.
To quickly find the next occurrence, press F3 or select the Search/Find Next menu item.
To quickly find the previous occurrence, press Ctrl-F3 or select the Search/Find Previous menu item.
Replace
Press Ctrl-R or select the Search/Replace menu item to load the Replace dialog. The options here are exactly the same as in the Find dialog, with a few exceptions.
The primary difference is that when matches are found, they are replaced with the value in the Replace With section. No bookmarks are set when replacing all occurrences.
If Replace All is checked, the primary button reads Replace All. If Replace All is not checked, the primary button read Replace Next if the search direction is Down and Replace Prev if the search direction is Up.
To perform the replacing action again, press F4 or select the Search/Replace Again menu item.
Find/Replace Timeout
If a scan takes longer than 30 seconds, a dialog will appear to give you some options.
You can halt the operation, wait and be prompted again later, or give the operation all the time it needs. If you give the operation its time, you have another option to be notified by a dialog when the operation is completed. This option also makes a beep to alert you that the operation is done.
Find/Replace Options
Pressing the Options button on the Find and Replace dialogs displays the options for the find/replace operation.
Specifies the color of the bookmarks added by the Find All operation.
Macro Name (Must Begin With '$')
When creating a regular-expression macro (see Wildcards and Regular Expressions), this is the name of the macro, including the prefixed $.
Macro Definition
This is the regular expression associated with the macro name in Macro Name (Must Begin With '$').
Add
Adds your custom regular-expression macro to the list. If the macro exists it is overwritten. System-defined regular -expression macros can not be overwritten.
Remove
Remove the selected macro from the list. System-defined regular-expression macros can not be removed.
Go to...
The Go to... utility allows you to go to a specific address in the file or RAM.
You can enter the address or offset in either hex or decimal.
To go directly to an address, select From Beginning of File and enter the address directly. Otherwise the address field is an offset, either from the current position or from the end of the file. From End of File is not available in RAM.
If From End of File is checked, the offset in the Address field implies the number of bytes before the end of the file where you would like to go. For example, entering 5 here would take you to the position 5 bytes before the end of the file.
To add a bookmark, press Ctrl-B or select the Search/Add/Edit Bookmark menu item. If a bookmark exists at the address where the caret is, the bookmark will be modified. Otherwise, a new bookmark will be created at the address of the caret.
Access the Find utility by pressing Ctrl-F or by selecting the Search/Find... menu item.
The primary difference is that when matches are found, they are replaced with the value in the Replace With section. No bookmarks are set when replacing all occurrences.
You can enter the address or offset in either hex or decimal.