forked from rofl0r/hexedit0r
-
Notifications
You must be signed in to change notification settings - Fork 0
/
hexedit.1
248 lines (247 loc) · 9.3 KB
/
hexedit.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
.TH HEXEDIT 1 "12 July 1998"
.SH NAME
hexedit \- view and edit files in hexadecimal or in ASCII
.SH SYNOPSIS
.I hexedit
[\-s | \-\-sector] [\-m | \-\-maximize] [\-h | \-\-help] [filename]
.SH DESCRIPTION
.LP
.I hexedit
shows a file both in ASCII and in hexadecimal. The file can be a device
as the file is read a piece at a time. You can modify the file and search through it.
.SH OPTIONS
.TP
.I "\-s, \-\-sector"
Format the display to have entire sectors.
.TP
.I "\-m, \-\-maximize"
Try to maximize the display.
.TP
.I "\-h, \-\-help"
Show the usage.
.SH COMMANDS (quickly)
.SS Moving
.nf
<, > : go to start/end of the file
Right: next character
Left: previous character
Down: next line
Up: previous line
Home: beginning of line
End: end of line
PUp: page forward
PDown: page backward
.fi
.SS Miscellaneous
.nf
F2: save
F3: load file
F1: help
Ctrl-L: redraw
Ctrl-Z: suspend
Ctrl-X: save and exit
Ctrl-C: exit without saving
Tab: toggle hex/ascii
Return: go to
Backspace: undo previous character
Ctrl-U: undo all
Ctrl-S: search forward
Ctrl-R: search backward
.fi
.SS Cut&Paste
.nf
Ctrl-Space: set mark
Esc-W: copy
Ctrl-Y: paste
Esc-Y: paste into a file
Esc-I: fill
.fi
.SH COMMANDS (full and detailed)
o \fIRight-Arrow\fR, \fILeft-Arrow\fR, \fIDown-Arrow\fR, \fIUp-Arrow\fR \- move the cursor.
.br
o \fICtrl+F\fR, \fICtrl+B\fR, \fICtrl+N\fR, \fICtrl+P\fR \- move the cursor.
.br
o \fICtrl+Right-Arrow\fR, \fICtrl+Left-Arrow\fR, \fICtrl+Down-Arrow\fR, \fICtrl+Up-Arrow\fR \- move n times the cursor.
.br
o \fIEsc+Right-Arrow\fR, \fIEsc+Left-Arrow\fR, \fIEsc+Down-Arrow\fR, \fIEsc+Up-Arrow\fR \- move n times the cursor.
.br
o \fIEsc+F\fR, \fIEsc+B\fR, \fIEsc+N\fR, \fIEsc+P\fR \- move n times the cursor.
.br
o \fIHome\fR, \fICtrl+A\fR \- go the beginning of the line.
.br
o \fIEnd\fR, \fICtrl+E\fR \- go to the end of the line.
.br
o \fIPage up\fR, \fIEsc+V\fR, \fIF5\fR \- go up in the file by one page.
.br
o \fIPage down\fR, \fICtrl+V\fR, \fIF6\fR \- go down in the file by one page.
.br
o \fI<\fR, \fIEsc+<\fR, \fIEsc+Home\fR \- go to the beginning of the file.
.br
o \fI>\fR, \fIEsc+>\fR, \fIEsc+End\fR \- go to the end of the file (for regular files that have a size).
.br
o \fICtrl+Z\fR \- suspend hexedit.
.br
o \fICtrl+U\fR, \fICtrl+_\fR, \fICtrl+/\fR \- undo all (forget the modifications).
.br
o \fICtrl+Q\fR \- read next input character and insert it (this is useful for
inserting control characters and bound keys).
.br
o \fITab\fR, \fICtrl+T\fR \- toggle between ASCII and hexadecimal.
.br
o \fI/\fR, \fICtrl+S\fR \- search forward (in ASCII or in hexadecimal, use \fITAB\fR to change).
.br
o \fICtrl+R\fR \- search backward.
.br
o \fICtrl+G\fR, \fIF4\fR \- go to a position in the file.
.br
o \fIReturn\fR \- go to a sector in the file if \fI\-\-sector\fR is used, otherwise go
to a position in the file.
.br
o \fIEsc+L\fR \- display the page starting at the current cursor position.
.br
o \fIF2\fR, \fICtrl+W\fR \- save the modifications.
.br
o \fIF1\fR, \fIEsc+H\fR \- help (show the man page).
.br
o \fICtrl+O\fR, \fIF3\fR \- open another file
.br
o \fICtrl+L\fR \- redisplay (refresh) the display (usefull when your terminal screws up).
.br
o \fIBackspace\fR, \fICtrl+H\fR \- undo the modifications made on the previous byte.
.br
o \fIEsc+Ctrl+H\fR \- undo the modifications made on the previous bytes.
.br
o \fICtrl+Space\fR, \fIF9\fR \- set mark where cursor is.
.br
o \fIEsc+W\fR, \fIDelete\fR, \fIF7\fR \- copy selected region.
.br
o \fICtrl+Y\fR, \fIInsert\fR, \fIF8\fR \- paste (yank) previously copied region.
.br
o \fIEsc+Y\fR, \fIF11\fR \- save previously copied region to a file.
.br
o \fIEsc+I\fR, \fIF12\fR \- fill the selection with a string
.br
o \fIEsc+T\fR \- truncate the file at the current location
.br
o \fICtrl+C\fR \- unconditional quit (without saving).
.br
o \fIF10\fR, \fICtrl+X\fR \- quit.
.PP
For the \fIEsc\fR commands, it sometimes works to use \fIAlt\fR instead of
\fIEsc\fR. Funny things here (especially for froggies :) egrave = Alt+H ,
ccedilla = Alt+G, Alt+Y = ugrave.
.br
.SS Modeline
At the bottom of the display you have the modeline (copied from emacs). As in
emacs, you have the indications --, ** and %% meaning unmodified, modified and
read-only. Then you have the name of the file you're currently editing. Next to
it is the current position of the cursor in the file followed by the total file
size. The total file size isn't quite correct for devices.
.br
While in --sector mode, it shows the sector the cursor is in.
.SS Editing
You can edit in ASCII or in hexadecimal. You can switch between the two with
\fITab\fR. When the file is read-only, you can't edit it. When trying to edit a
read-only file, a message (``File is read-only'') tells you it is non-writable.
.br
The modifications are shown in bold until they are saved.
The modeline indicates whether you have modified the file or not.
.br
When editing in hexadecimal, only \fI0\fR,\fI1\fR,...,\fI9\fR,
\fIa\fR,\fIb\fR,...,\fIf\fR, \fIA\fR,\fIB\fR,...\fIF\fR are legal.
Other keys are unbound. The first time you hit an unbound key, the help pops up.
It won't pop again unless you call the help directly (with \fIF1\fR).
.br
When editing in ascii, you can find it difficult to enter characters like
\fI/\fR which are bound to a function. The solution is to use the quoted insert
function \fICtrl+Q\fR, the key after the quoted insert function is not processed
by \fIhexedit\fR (like emacs' quoted-insert, or like the \\ character in C).
.SS Searching
You can search for a string in ASCII or in hexadecimal. You can switch
between the two with \fITab\fR. If the string is found, the cursor is moved to
the beginning of the matching location. If the search failed, a message (``not
found'') tells you so. You can cancel the search by pressing a key.
.br
The search in hexadecimal is a bit confusing. You must give a hexadecimal string
with an even number of characters. The search can then be done byte by byte. If
you want to search a long number (eg: a 32 bit number), you must know the
internal representation of that number (little/big endian problem) and give it
the way it is in memory. For example, on an Intel processor (little endian), you
must swap every bytes: 0x12345678 is written 0x78563412 in memory and that's the
string you must give to the search engine.
.br
Before searching you are asked if you want to save the changes, if the file is
edited.
.SS Selecting, copying, pasting, filling
First, select the part of the buffer you want to copy: start setting the mark
where you want. Then go to the end of the area you want to copy (you can use the
go to function and the search functions). Then copy it. You can then paste the
copied area in the current file or in another file.
.PP
You can also fill the selected area with a string or a character: start choosing
the block you want to fill in (set mark then move to the end of the block), and
call the fill function (\fIF12\fR). \fIhexedit\fR ask you the string you want to
fill the block with.
.br
The code is not tuned for huge filling as it keeps the modifications in memory
until you save them. That's why \fIhexedit\fR will warn you if you try to fill
in a big block.
.PP
When the mark is set, the selection is shown in reverse mode.
.br
Be aware that the copied area contains the modifications done at the time of the
copy. But if you undo the modifications, it does not change the content of the
copy buffer. It seems obvious but it's worth saying.
.SS Scrolling
The scrolling is different whether you are in \fI\-\-sector\fR mode or not. In
normal mode, the scrolling is line by line. In sector mode, the scrolling is
sector by sector. In both modes, you can force the display to start at a given
position using \fIEsc+L\fR.
.SH SEE ALSO
od(1), hdump(1), hexdump(1), bpe(1), hexed(1), beav(1).
.SH AUTHOR
Pixel (Pascal Rigaux) <[email protected]>,
.br
Home page is <http://merd.net/pixel/>.
.SH UNRESTRICTIONS
.I hexedit
is Open Source; anyone may redistribute copies of
.I hexedit
to
anyone under the terms stated in the GNU General Public License.
.PP
You can find
.I hexedit
at
.br
<http://merd.net/pixel/hexedit-1.2.12.src.tgz> and
.br
<http://merd.net/pixel/hexedit-1.2.12.bin.i386.dynamic.tgz>.
.SH TODO
Anything you think could be nice...
.SH LIMITATIONS
There are problems with the curses library given with Redhat 5.0 that make
\fIhexedit\fR think the terminal is huge. The result is that hexedit is
not usable.
.PP
The shortcuts work on some machines, and not on others. That's why there are
many shortcuts for each function. The Ctrl+Arrows and the Alt+. do not work
work as they should most of the time. On SUNs, you must do Ctrl+V-Ctrl+V instead
of Ctrl+V (!); and the Alt key is the diamond one.
.PP
While searching, it could be interesting to know which position the search has
reached. It's always nice to see something moving to help waiting.
.PP
The hexadecimal search could be able to search modulo 4 bits instead of 8 bits.
Another feature could be to complete padd odd length hexadecimal searches with
zeros.
.SH BUGS
I have an example where the display is completly screwed up. It seems to be a
bug in ncurses (or maybe in xterm and rxvt)?? Don't know if it's me using
ncurses badly or not... It seems to happen when \fIhexedit\fR leaves only one
space at the end of the lines... If anyone has a (or the) solution, please tell
me!
.PP
If you have any problem with the program (even a small one), please do report it
to me. Remarks of any kind are also welcome.
.PP