# Table of Contents - [Binary Pattern | ImHex](#binary-pattern-imhex) - [Input Text Boxes | ImHex](#input-text-boxes-imhex) - [Fonts | ImHex](#fonts-imhex) - [Extending ImHex | ImHex](#extending-imhex-imhex) - [Providers | ImHex](#providers-imhex) - [Data Inspector | ImHex](#data-inspector-imhex) - [Hex Editor | ImHex](#hex-editor-imhex) - [Bookmarks | ImHex](#bookmarks-imhex) - [Data Processor | ImHex](#data-processor-imhex) - [Pattern Editor | ImHex](#pattern-editor-imhex) - [Hashes | ImHex](#hashes-imhex) - [Patches | ImHex](#patches-imhex) - [Yara | ImHex](#yara-imhex) - [Find | ImHex](#find-imhex) - [Pattern Data | ImHex](#pattern-data-imhex) - [Diffing | ImHex](#diffing-imhex) - [Data Information | ImHex](#data-information-imhex) - [Welcome Screen | ImHex](#welcome-screen-imhex) - [Content Store | ImHex](#content-store-imhex) - [Tools | ImHex](#tools-imhex) - [Settings | ImHex](#settings-imhex) - [Layouts and Workspaces | ImHex](#layouts-and-workspaces-imhex) - [Documentation | Documentation](#documentation-documentation) - [Pattern Language | Pattern Language](#pattern-language-pattern-language) --- # Binary Pattern | ImHex Binary Patterns are a sort of Regex search pattern for binary values. The following characters are allowed: * 0 - 9 / A - F: Fixed values that the current nibble needs to have * ?: Wildcard value to match any value As an example, let's take the Binary Pattern `AB ?? 5F ?A`. Searching for this pattern would look for any sequence of 4 bytes where the first byte has the value `0xAB`, the third byte the value `0x5F` and the fourth byte any value that has the lower nibble set to `0xA`. The second byte in the sequence can have any value as both nibbles are wildcarded. Last updated 2 years ago Was this helpful? --- # Input Text Boxes | ImHex Last updated 2 years ago Was this helpful? ImHex contains a number of different input text boxes that expect different input. This page describes their functionality. ### [](#sliders) Sliders Sliders can be modified by simply sliding around the drag bar or by CTRL-Clicking on it and using it as a regular input text box. ![Cover](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-d434d3eb4fc4cb1609caae0ca4cd5efa822b8fcd%252Fmsedge_gBEvVNUGXq.png%3Falt%3Dmedia&width=245&dpr=4&quality=100&sign=129f3723&sv=2) **Mathematical Input** This field expects some sort of mathematical expression such as `-1234.5` or `0xABCD` or `5 + 7` or `log(e) / 2`. Important to note is, when trying to enter a hexadecimal value into these fields, the value **must** be prefixed with `0x`. ![Cover](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-7b10a367dd55f52a47a7ea17891cb6455a9ce3cf%252Fmsedge_mCX6oq3HTn.png%3Falt%3Dmedia&width=245&dpr=4&quality=100&sign=890383f8&sv=2) **Numerical Input** This field expects a numerical value. This can either be a floating point number, a decimal number, or a hexadecimal number. ![Cover](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-cb99587e0929d4098f973599acc606f36ce6045e%252Fmsedge_sCuv0NsVqj.png%3Falt%3Dmedia&width=245&dpr=4&quality=100&sign=caaa06de&sv=2) **Binary Pattern Input** ![Cover](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-17570ee8bae70351fa6ee47e22174c986d5dd526%252Fmsedge_ttF0eogCRr.png%3Falt%3Dmedia&width=245&dpr=4&quality=100&sign=852cb6cb&sv=2) **Regex Input** ![Cover](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-a4e2f1dd9dc9ff4eee1fa2e94ed241021b979588%252Fmsedge_xBNeHHWsJv.png%3Falt%3Dmedia&width=245&dpr=4&quality=100&sign=f336491b&sv=2) **Text Input** This field expects any valid UTF-8 string and doesn't expect any special formatting. ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-91c0f58e7471665a6864f920544dd5e850f151ad%252Fimhex_YHVwjR4UC3.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=ec8481d0&sv=2) Input fields as seen in ImHex This field expects a binary pattern string in the form of `0F ?? A?`. The characters 0 to 9 and A to F specify the fixed value of that nibble while question marks specify a wildcard value. For more information on this, check the page. This field expects a regex-formatted input string. For more information on this, check the . [Binary Pattern](/imhex/common/binary-pattern) [Regex cheatsheet](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Cheatsheet) --- # Fonts | ImHex Last updated 2 years ago Was this helpful? By default ImHex uses the `Proggy Clean` font, the default one used by ImGui, however it's also possible to load custom fonts. Proggy Clean is a pixel perfect bitmap font which means scaling it only works well if it's done in integer increments. Any scaling factor inbetween will cause the font to look blurry. Because of that, setting the font size is disabled by default. ### [](#supported-fonts) Supported fonts Any `TTF` or `OTF` font is generally supported. However, things might look off when using a font that doesn't have monospaced glyphs. So called "Nerd Fonts" such as the fonts found on this GitHub repository, usually work great: [https://github.com/powerline/fonts](https://github.com/powerline/fonts) ### [](#changing-fonts) Changing fonts To change your font, first open the `Settings` interface through `Help -> Settings` and open the `Fonts` tab. After that, either enter the path to your font in the `Custom Font Path` text field or click on the folder icon next to it to use the file picker. The Font file is not copied, only the path is stored in ImHex's settings. Don't remove the font file after it has been selected or ImHex will revert back to the default font. After a custom font has been selected, the `Font Size` slider also becomes available and can be used to specify the font's scaling. ImHex needs to be restarted now for the changes to come into effect. A cutom font being selected in the Settings interface ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FREQPR2naRSFlfHHbJR77%252Fimhex_YOtnf3gA2O.png%3Falt%3Dmedia%26token%3Dfe59b341-5b51-421f-b99a-f53c4300b89b&width=768&dpr=4&quality=100&sign=a4340aa2&sv=2) --- # Extending ImHex | ImHex ImHex is highly customizable and extensible. This can be done in multiple ways. [](#plugins) Plugins ------------------------- Plugins are native code shared libraries that are loaded directly by ImHex at startup. Thanks to ImHex's structure, these can do exactly the same thing any built-in part of ImHex can do. Plugins are normally written in C++, however you may link in code from any other programming language as long as it can generate a static library. To get started, check out the Plugin Template: [https://github.com/WerWolv/ImHex-Plugin-Template](https://github.com/WerWolv/ImHex-Plugin-Template) There's currently no complete documentation of all API functions since it evolves so quickly right now. Here's some hints where to get started though: * Read through all the files in the ImHex-Plugin-Template repo. There's not many but they're packed with information on how things work. * Read through the API definitions in libimhex: [libimhex/include/hex/api](https://github.com/WerWolv/ImHex/tree/master/lib/libimhex/include/hex/api) * Join the ImHex Discord Server and ask for guidance there. Plugins are highly dependent on the version of ImHex they've been built for. Don't expect a 1.33.0 plugin to work on 1.34.0. After building a plugin, a `.hexplug` file is generated which can be placed in the `plugins` folder in the ImHex directory [](#scripts) Scripts ------------------------- Scripts are C# Assemblies that link to the ImHex dotnet library. These scripts have the ability to add or interface with certain often used functionalities but are much less powerful. The advantage of them compared to plugins however is that they are cross platform and don't depend on the version of ImHex. To get started with Scripts, download the [C# Template project](https://github.com/WerWolv/ImHex/tree/master/plugins/script_loader/templates) and load it in your favorite C# IDE such as Visual Studio or Jetbrains Rider. After building, simply put all generated `.dll` files in the `/scripts/custom/dotnet/` folder. `Main.dll` is the main script file, if it contains a `Main()` function, it will show up in `Extras -> Run Script...` menu where it can be executed. Last updated 1 year ago Was this helpful? Run Script Menu ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FooQD9VuRcehh2rIbQecq%252Fimage.png%3Falt%3Dmedia%26token%3D8dfbc378-45ac-49b9-be61-42dc79ca3e27&width=768&dpr=4&quality=100&sign=592d0fd0&sv=2) --- # Providers | ImHex Last updated 2 years ago Was this helpful? Providers in ImHex are how any data is being accessed. They expose a common interface to read or write any data to ImHex and handle everything else that's necessary for it to work in the background. Every file you open, every process you attach to, creates a new instance of a provider which handles data accesses to this source. ### [](#usage) Usage The most simple way to use Providers is by loading any file. Either through `File -> Open File...`, the `Open File` shortcut on the Welcome Screen or by dragging a file onto ImHex. This will open a FileProvider to access its data. Besides the FileProvider, there's also more complex ones accessed through `File -> Open Other...` or `Other Providers` on the Welcome Screen. Clicking on any of these buttons creates a new instance of this provider and opens a configuration popup to specify additional parameters. Some providers simply open a file picker here, others display custom windows. Clicking `Open` opens the provider with these settings. ### [](#implementation) Implementation In C++, Providers are implemented as a polymorphic Provider base class which, amongst others, has the following functions: Copy // Called when a new provider is created. Opens a connection // to its data source bool open(); // Called when the provider is closed. Handles cleanup void close(); // Called whenever ImHex wants to read any data from this provider void readRaw(u64 offset, void *buffer, size_t size); // Called whenever Imhex wants to write any data to this provider void writeRaw(u64 offset, const void *buffer, size_t size); // Called when ImHex wants to know the size of this data size_t getActualSize(); The standard File Provider for example uses standard C File IO functions to access a file. It calls `fopen()` in the `open()` function, `fclose()` in the `close()` function and `fread()`/`fwrite` in the `readRaw()`/`writeRaw()` function. This is the simplest example for a Provider and it's far from what a Provider can do. `readRaw` and `writeRaw` can make calls to other applications, a web service, the Kernel or any other data source one might want to analyze. This system allows ImHex to act as a universal data access frontend. If a new source is needed, simply implement a new Provider for it. Other providers Process Memory Provider configuration popup ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-b3ae0f3db286a557fc64e0e98d2eff983774151b%252Fimhex_4n15aaWOJU.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=60ca2c33&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-609b81415589b87478bc366077318c213d08b87a%252Fimhex_u0Ct6qFF8A.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=7320c02f&sv=2) --- # Data Inspector | ImHex Last updated 2 months ago Was this helpful? The Data Inspector aids identifying of encoded values in binary data without needing to write a full Pattern definition for it. It simply takes one or more bytes (depending on the type it decodes the bytes as) from the current cursor position in the data and decodes it as it. Not all rows necessarily display a useful value. The Inspector tries to identify invalid decodings and display `Invalid` in that row but that's not always possible. Just because the data inspector says these bytes mean a specific thing, doesn't mean that that's the actual meaning of those bytes. Right click a row to open the context menu * `Jump to address`: Interpret the decoded value as an address and jump to it * `Copy Value` : Copies the decoded value * `Edit Value` : Enters editing mode so a new value can be input. This will write the raw bytes back to the opened data. Editing mode can also be entered by double clicking a row. ### [](#next-previous-value) Next/Previous value It's possible to click on an entry in the data inspector to select it. After that, the "Previous" and "Next" button above the inspector table become active and can be used to move to the previous or next instance of that type. The current selection will be moved according to the size of the selected row. This is helpful when analyzing formats that contain lists of the same data type and you'd like to see their decoded value one at the time. ### [](#hiding-rows) Hiding Rows It's possible to hide individual rows in the data inspector that aren't important for the current file. To do this, simply click on the `Edit` button and click on the Eye icon on the rows that should be hidden. Clicking on the `Edit` button again then, hides all the selected rows. ### [](#modifying-values) Modifying values Some rows can also be modified for the data inspector to write the encoded byte value of your input back to where it read the previous value. This is not possible for all rows. To do this, simply double click the row you want to edit and a input text field will appear where the new value can be entered. ### [](#settings) Settings At the bottom of the Inspector there are multiple sliders to customize how values are being displayed in the Value column. * `Endian`: This setting specifies the endianess of read data. Switching it from `Little` to `Big` will invert the order of bytes before trying to decode it * `Format`: This setting changes the numeric base the values are displayed in such as Decimal, Hexadecimal or Octal. This only makes sense for numeric values so it only applies to these. * `Invert`: This setting bitwise inverts the value of every read byte before decoding it. As such the byte `0xFA (0b1111'1010)` will become `0x05 (0b0000'0101)`. ### [](#adding-new-rows) Adding new Rows Adding new rows to the inspector can either be done through a custom Plugin, when needing custom display widgets or extra speed, or it can be done through the Pattern Language by adding a new `.hexpat` file to the `%IMHEX_PATH%/scripts/inspectors` folder. Simple custom inspector Copy import std.io; // Type definition for the custom type we want to decode struct MyCustomInspector { u32 value; } [[format_read("custom_inspector_formatter")]]; // Formatter function which formats the displayed value fn custom_inspector_formatter(MyCustomInspector customInspector) { return std::format("Hello World: {:02X}", customInspector.value); }; // Placements. Each individual placement becomes a new line in the inspector // All values need to be placed at the current cursor position ($) to respect // the cursor position set in the editor // The [[name]] attribute changes the value in the Name column, otherwise // 'customInspector' would be used. MyCustomInspector customInspector @ $ [[name("Custom Inspector Name")]]; The next time the cursor position is changed now, the new row will show up and decode the selected bytes. The Data Inspector View Context Menu Next/Previous buttons Hiding / Unhiding rows Settings Custom Data Inspector Row ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FtZkAt7syIM4NN8QIiPCq%252Fimage.png%3Falt%3Dmedia%26token%3D4eda0ceb-d38a-4380-99e3-7d7f162c5c90&width=768&dpr=4&quality=100&sign=b966e7f2&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FBaVjOnFrOeuHXC2XJ8f2%252Fimage.png%3Falt%3Dmedia%26token%3D3d2e14a1-ceb6-4a84-a401-6cd7085bca03&width=768&dpr=4&quality=100&sign=3f3f25b0&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FHhvzBz7PPY8Jg3iA4Vbc%252Fimage.png%3Falt%3Dmedia%26token%3D29497215-e815-40be-afce-5aa3de4acbd7&width=768&dpr=4&quality=100&sign=6e44e82b&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fg0ZkZ0EfY3ygQhzH8f5X%252Fimage.png%3Falt%3Dmedia%26token%3D6ae49fc7-40d9-455f-98b3-5e98bdd315dc&width=768&dpr=4&quality=100&sign=db06d7de&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FY1GzAd7IdZqeB18EYNtr%252Fimage.png%3Falt%3Dmedia%26token%3D0d176242-be86-4f32-b13e-ed1ae75d5721&width=768&dpr=4&quality=100&sign=52defe7&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-cd0cb665b9f3d28a0fadd17d49fcf142cb8a9126%252Fimhex_7WgNns20ZE.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=bf5d0283&sv=2) --- # Hex Editor | ImHex Last updated 2 months ago Was this helpful? The Hex Editor View is the most important View in ImHex. It displays the currently loaded data as a range of hexadecimal values and ASCII and lets you modify it. The Hex Editor footer is the portion at the bottom of the hex editor window that contains basic information on the current selection and the loaded data. By default only the most important parts are visible, the rest is hidden and can be shown by clicking on the up arrow button in the middle. #### [](#visualization-options) Visualization options Use the toggles to change various visualization options. Below are explanations for each of the options in order. **Upper case hex characters** This option determines if ImHex uses upper- or lowercase letters to display hex values **Gray out zeros** This option enables or disables if ImHex should gray out all zero bytes in the editor. **Display ASCII column** This option shows or hides the ASCII column to the right of the bytes column **Display advanced decoding column** Enabling this option will show the advanced decoding column. By default this option is grayed out and only enabled when when a custom encoding has been loaded through `File -> Import -> Custom Encoding`. **Mini Map** Enabling this option shows or hides the Mini Map next to the scroll bar. The Mini Map shows information about hex editor lines in the current vicinity. Each colored line represents one row in the hex editor. By default the color corresponds to to the entropy of that line, the bluer the color, the higher the entropy. Other options can be specified through by right clicking the Mini Map icon and choosing a different visualizer in the popup. #### [](#data-visualizers) Data visualizers Another option to customize the look of the Hex Editor is through cell visualizers. By default a 8 bit hex visualizer is used but many different ones are available such as decimals, floats or colors. The first dropdown selects the visualizer to be used and the slider below determines if the (potentially multi-byte value) should be interpreted in big or little endian format. The columns slider selects the number of columns that should be shown on screen. Moving it all the way to the left will cause the hex view to auto resize itself to show as many columns as fit on the screen. The Segment Separator option allows inserting separator lines after every N bytes. The Format option decides the radix in which the addresses should be displayed. It can be set to Hexadecimal, Decimal and Octal. #### [](#display-information) Display Information In the second row of the footer (shown when expanding the footer using the chevron button), information about the currently displayed data is shown * The left side shows the currently visible data page and its region. By default the entire data is shown on one page but the size can be changed through `Edit -> Set page size`. * If a custom page size is set, the currently displayed page can be switched by moving the slider left or right * The right side shows the base address of the data as well as the total size in hexadecimal and in human readable bytes. ### [](#selections) Selections To interact with the bytes in any way, they first need to be selected. To do that, click on one and optionally drag your mouse cursor to select bigger ranges of bytes. This can be done either on the main hexadecimal column or on the ASCII column. Once a selection has been made, the current cursor can also be moved around using the arrow keys. Holding down SHIFT lets you select a range of bytes. ### [](#base-address) Base Address Through the use of the Edit -> Set base address option, ImHex can virtually load a file not at address 0x000000 but at any arbitrary address. This is mainly useful for analysing memory dumps that have been dumped from a specific address. Doing this will affect displayed addresses throughout all of ImHex. ### [](#selection-views) Selection Views Sometimes files consist of multiple different parts in which case it might be easier to analyse each of these parts on their own. For these cases, Edit -> Open selection view takes all currently selected bytes and breaks them out into a new tab. This new tab contains a transparent view of only the selected bytes now and making modifications to them in one tab will automatically apply the same modifications in the other tab. [](#editing) Editing ------------------------- To edit the value of a byte, simply double click it to enter editing mode. The value of the byte becomes highlighted and a new value can be entered. Once enough characters have been entered, the cursor automatically advances to the next cell so the next value can be entered. Notice how modified bytes are highlighted in red. #### [](#size-changing-operations) Size changing operations Size changing operations include byte insertions, byte removal and resizing. These operations are rarely needed when analysing or patching data since they can change the layout of the data and will most likely make it unreadable by other programs. All of these operations can be found in the `Edit` main menu or in the Hex Editor's right-click menu. A popup window will open asking for the start address of the operation and the number of bytes that will be affected. Clicking on `Set` executes it. In the case of the following image, `0x10` zero bytes will be inserted at address `0x1A0`. The Remove and Resize operation work similarly. As of v1.34.0, ImHex loads files that are smaller than 128MiB into memory and only writes back the modified data when saving. Files that are larger than that will apply operations on the file directly. Operations can still be undone until ImHex is closed but be aware to make backups before modifying these files. ### [](#copy-paste) Copy / Paste These operations let you copy bytes in various ways and paste them back into the data later on. All copy and paste operations only operate on the currently selected bytes. Using `Edit -> Copy` on the following selection will copy the string `1B D2 E6` into the clipboard. Selecting only two other bytes now and using `Edit -> Paste` will paste `1B D2` at that selection and discard `E6`. #### [](#copy-as) Copy as... The Copy as operation copies a formatted representation of the selected bytes into the clipboard. Possible representations are arrays in the syntax of various programming languages, as well as ASCII art, HTML and more. Some Examples: C++ Array Copy constexpr std::array data = { 0x1B, 0xD2, 0xE6 }; Hex View Copy Hex View 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 000000A0 1B D2 E6 ... #### [](#paste-all) Paste All Paste All always pastes all copied bytes, no matter of the number of currently selected bytes or if the file is big enough to hold all bytes. If there's not enough space left for all bytes after the current cursor position, the data will automatically be resized to fit it. ### [](#jump-to) Jump to The jump to operation interprets the currently selected bytes (up to a max of 8 bytes) as a little endian unsigned number and jumps to that address. For example, selecting the bytes `45 00 00` and clicking `Jump to` will interpreted these bytes as the number `0x000045` and then jump to this address in the editor. The Hex Editor View Hex Editor Footer Lower case hex characters Non-grayed out zeros Bytes, ASCII and custom encoding column Mini Map visualizing local entropy Mini Map settings popup Float visualizer Color visualizer Segment Separators Hex editor view with its base address changed to 0x1234 Modified bytes Operations in the edit menu Three selected bytes ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FsWUa36okRRtoC0SC3Oxf%252Fimage.png%3Falt%3Dmedia%26token%3D70cb946f-5199-4a0e-803a-15c927fb707b&width=768&dpr=4&quality=100&sign=efa438c5&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FMWAPpuEMQEKSqfxmLWFc%252Fimage.png%3Falt%3Dmedia%26token%3D7e90b029-5935-492a-9fa8-1e8bf705edb1&width=768&dpr=4&quality=100&sign=3fc522de&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FP6LiWZ7yo7o8ZZXbPt1o%252Fimage.png%3Falt%3Dmedia%26token%3D4df1a95f-0053-4eaf-8442-9c3e2110fd11&width=768&dpr=4&quality=100&sign=e3d0d2cf&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FLUKRgv9B9q0hsn9peHzI%252Fimage.png%3Falt%3Dmedia%26token%3Ddc327623-2bc8-43eb-b749-08e37da54d6d&width=768&dpr=4&quality=100&sign=4dbe3660&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F8QcPyljaY2G1u2Zmid4P%252Fimage.png%3Falt%3Dmedia%26token%3D545409d2-d306-4445-904f-d81ad1f28900&width=768&dpr=4&quality=100&sign=b9425bc&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FK4oJPlHU7ouUJ59Mjn8w%252Fimage.png%3Falt%3Dmedia%26token%3Df9be7cd6-7d8d-402e-ba92-c542901c7ef2&width=768&dpr=4&quality=100&sign=d9ef5580&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FHywjUQW5opKuqOmjR0ct%252Fimage.png%3Falt%3Dmedia%26token%3D69a69716-0199-4622-bbe1-0bd5ca87f454&width=768&dpr=4&quality=100&sign=f3adb88a&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FWvpWgDF6iupX34SsGOIq%252Fimage.png%3Falt%3Dmedia%26token%3D7a2b53ab-46eb-48c5-bcc6-581e4b15342b&width=768&dpr=4&quality=100&sign=5a0f6e02&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fa9iPBsgt3thiYWpZshnd%252Fimage.png%3Falt%3Dmedia%26token%3D7b5654cb-1ef9-4d0c-b4ad-7fb727d13419&width=768&dpr=4&quality=100&sign=76a6380&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FiLXhwLJ6Oid22MuswXY1%252Fimage.png%3Falt%3Dmedia%26token%3Ddc3dc4e4-f583-4a65-bab6-a39f2690484b&width=768&dpr=4&quality=100&sign=7cca83f9&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FCVrGP3HtuvMdFMPPtEWv%252Fimage.png%3Falt%3Dmedia%26token%3Dc115637e-663f-4e5e-9e5e-be5b9e95247f&width=768&dpr=4&quality=100&sign=27e3a634&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-730b762fa2f6aa890ade9735d147ea705e94cd0b%252Fimhex_uuGD2v1ASw.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=79996deb&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-0d3b878b2cb15825e5f0f3350498b6000c1fa7c6%252Fimhex_L0V0YrFdWT.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=7a5d610b&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FdX6a0fN8LSrEdwPymPPn%252Fimage.png%3Falt%3Dmedia%26token%3D6a68a8a0-6ce0-456b-b145-e66f79f9d355&width=768&dpr=4&quality=100&sign=bc1e8fd9&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-255bd3ac11641d6153b03234eba27f55b2d122da%252Fimhex_4ONHkkK3j7.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=28b6fb0c&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-29f8711266bdbddfcec5521d3e0cd2fe637ff500%252Fimhex_c19kCFawA2.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=b73d3049&sv=2) --- # Bookmarks | ImHex Last updated 2 months ago Was this helpful? ### [](#creating-a-bookmark) Creating a bookmark Bookmarks are an easy way to quickly remember regions of data and add a name and comment to it. To create a bookmark, simply select a region of bytes and either click on the Bookmark icon in the Toolbar or use the `Edit -> Create bookmark` option. A new bookmark will appear in the list which can be opened by clicking on it and then be modified. ### [](#interacting-with-bookmarks) Interacting with bookmarks Once a bookmark has been created, it can be selected in the bookmark list. Clicking on its entry reveals all its properties that can be modified. To delete a bookmark, first make sure it's unlocked and then click on the `X` button in the header of the relevant bookmark. Bookmarks can also be moved around when they're closed by simply dragging them around the list. In the `Name` row, a new name can be entered that will show up in the header as well. Also the color can be modified by clicking on the color button to the left of it. A popup with a color picker and various template colors will open and can be used to change the color. Bookmarks can also be locked by pressing on the Lock icon in the `Name` column. This will prevent any modifications of this bookmark and disallow deleting it. To unlock the bookmark, simply click on the button again. Besides the name, a comment can be entered to document additional information that are relevant for this data. All information entered here will also show up when hovering over the bookmark in the Hex Editor View and holding down the `SHIFT` key. ### [](#bookmark-actions) Bookmark actions * Jump to Bookmark : Clicking this jumps to the bookmark in the Hex Editor view * Open View Provider: Clicking this opens the content of this bookmark in a new tab * Show/Hide: Clicking this will toggle the visibility of the bookmark's highlighting The Bookmarks View Bookmark color picker Hover popup Available options ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FBaHRXVek8ojs8DfwX77P%252Fimage.png%3Falt%3Dmedia%26token%3Dcec7ac6b-442f-4b18-9627-b2eafe24f67c&width=768&dpr=4&quality=100&sign=eab8fad8&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-6495ee0dbdd1bf12adb3183dd8e10846124f15fa%252Fimhex_ZV6OStMrQd.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=1ac7457c&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-3fb35f6f93dd0c32599e7b724483d5dd58b8fb1b%252Fimhex_IZihhibts8.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=b20159ed&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FHRilCauJq8YVgwFbXUBg%252Fimage.png%3Falt%3Dmedia%26token%3D01078880-71ce-4e79-ad6e-d270c9f57651&width=768&dpr=4&quality=100&sign=216e6e96&sv=2) --- # Data Processor | ImHex Last updated 2 years ago Was this helpful? The Data Processor is a node-based visual scripting engine that has the ability to pre-process bytes before they are being displayed or read by the rest of ImHex. The program in the image above for example XORs all bytes in the loaded data with the ASCII character `A` before displaying them in the Editor. ### [](#terminology) Terminology #### [](#nodes) Nodes Nodes are the rectangular boxes that are placed through the context menu. Each node has a certain number of Inputs on the left side and Output on the right side. When the program is executed, each node reads in data from the left, processes it in some way and then outputs it again on the right. Nodes that have no inputs are called "Start Nodes", Nodes that have no outputs are called "End Nodes". Each Node has a name which is being displayed at the top in the header. Below that, there's an area where each node can display its own widgets either for confguring various settings or to simply visualize the data it received. #### [](#attributes) Attributes Attributes are the Connections on the side of each Node. Attributes on the left are called "Input Attributes" since data is being fed into them, Attributes on the right are called "Output Attributes" since they output processed data. There are different types of Attributes, denoted using different symbols. If an Attribute is on the left side of a Node and not filled, it's an Input. If it's on the right side of a Node and filled out, it's a Output. Integer and Float input Attributes can also be initialized directly by writing their value into the field next to its name. As soon as a different Node is being connected to this Attribute, it will take precedence over the value entered in the Node. #### [](#links) Links Links are the connection that is made between two Attributes. It represents the flow of information from one Ouput Attribute to another Input Attribute. Links can only ever be made between two Attributes of the same type. So it's not possible to connect a Buffer Attribute to an Integer Attribute or an Integer Attribute to a Float Attribute. To form a new Link between two Attributes, click on the Attribute of one Node and drag the created Link over to the Attribute of a different node. This is only possible if one of the Attributes is an Output and the other one is an Input. To delete a Link again, simply click on it or use `Right click -> Remove Link`. ### [](#navigation) Navigation Navigation in the Node workspace is very simple. Pressing and dragging using the `Left Mouse Button` creates a selection that can be used to select Nodes and Links. The `Middle Mouse Button` is used to pan the view around in the workspace. Clicking the `Right Mouse Button` opens a context menu that contains options depending on what has been right clicked. When right clicking the workspace, a menu pops up with a list of all Nodes that can be placed. ### [](#execution) Execution After a data processor script has been made, it can be executed by clicking on the `Play` button, similar to the Pattern Editor. Enabling the `Continuous evaluation` checkbox will cause the script to be executed every frame. This is helpful for scripts that only modify a small number of bytes but either the data or the parameters used in the script are continuously changing. ### [](#important-nodes) Important Nodes #### [](#constants) Constants Constant Nodes are the simplest kinds of Start Nodes. They all have an input text box to specify their value and output that value directly on their output Attribute. These Nodes can be treated as Variables that can be set once before the program starts and then be reused again later on. #### [](#data-access) Data Access Data Access nodes are the one type of node that can directly interact with the loaded data. The `Read` Node reads a certain number of bytes from an address of the currently loaded data into a buffer and outputs it on its Output Attribute. The `Write` Node can write a buffer back into the loaded data at a certain address. Doing so will overlay the written data over the existing data. **It does not modify the underlying data directly, it's purely visual.** These two nodes in combination are the heart of the data processor and are most likely required in every data processor script you make. `Data Size` simply returns the size of the loaded data and `Selected Region` returns the address and size of the current selection. This is useful in Continuous Mode so selections can be used as a sort of magnifying glass where only the bytes inside of them are being processed. ### [](#custom-nodes) Custom Nodes An important feature of the data processor is the ability to create your own custom nodes using the existing ones and sharing them with others. To do this, select `Custom -> New Node` in the right click menu. A new, empty Node will appear. To modify it, hold down shift and give it a name by entering it in the Text box. This is the name that will appear in the Node's header as well as in the Context menu once the Node has been saved. Clicking on `Edit` will open a new empty workspace. This is the content of this Custom Node. It can be closed again through the `X` button at the top right. A Node needs to be able to receive data from the outside world and return it back out again after it has been processed. This is done through Input and Output Nodes found in the `Custom` section under `Custom Node Input` and `Custom Node Output`. Placing them will let you chose the Attribute Type as well as the name that will be displayed on the Node later on. Let's use these Input and Output Nodes to create a custom Node that takes in an Integer called `Value`, adds the number `5` to it and outputs it again on an Attribute called `Result`. Exiting the Custom Node again now through the `X` button reveales that the Custom Node has changed. It now has a `Value` input and a `Result` output. Feeding a number into the node now correctly adds the number `5` to it and returns the result back to us. Circular Attributes are Integer Attributes Triangular Attributes are Float Attributes Rectangular Attributes are Buffer Attributes The Data Processor A Node Connecting two Nodes to each other Link between two Nodes Execution widgets Constant Nodes list Data access Nodes list Custom mode regulary Custom node when holding shift Simple Add 5 Custom Node Add 5 Node in action ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FMo5eHhhF0nyhFiqYovGb%252Fimhex_en11BC4ACp.png%3Falt%3Dmedia%26token%3Dc0b65c40-06d3-434e-a924-01ead2622ac1&width=300&dpr=4&quality=100&sign=d026945d&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FDGGpVqEvMYPoRHpCSpKY%252Fimhex_oi7H5zLaT6.png%3Falt%3Dmedia%26token%3D2b8c84ce-8a88-4627-b08d-9ab731bf5e92&width=300&dpr=4&quality=100&sign=adee240e&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FiHCN3Wvx0gYwbB7ioFXc%252Fimhex_Z7rc3HH3yV.png%3Falt%3Dmedia%26token%3D339dc2df-1eb6-47c6-89ad-b34e32dde3eb&width=300&dpr=4&quality=100&sign=243e78e1&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fg7zE8a6q0gsLTHBfcPpF%252Fimhex_Sp6EdaFrcH.png%3Falt%3Dmedia%26token%3Dd00067e1-e929-4b40-9504-2573fe063567&width=768&dpr=4&quality=100&sign=ac91c1ee&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F2VPNV19MqmokVm3UMCBx%252Fimhex_LRIlWVyI8w.png%3Falt%3Dmedia%26token%3D48fb861b-b368-4ba1-b49e-2885def193b9&width=768&dpr=4&quality=100&sign=fd0cb6c8&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F4qadH8vheIvUwsffRxah%252Fimhex_njbmKbvNin.gif%3Falt%3Dmedia%26token%3D9a4e7239-d7f7-4713-b672-eae9471c8678&width=768&dpr=4&quality=100&sign=b91f3a95&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FiBLvf90wkf7B8ZHg8Xzq%252Fimhex_0PnMK3MC0A.png%3Falt%3Dmedia%26token%3D4f4b7545-9785-4946-ac3d-f0a3f43587f4&width=768&dpr=4&quality=100&sign=dccdf71b&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FcSclI2aT3s8ncraIPLNW%252Fimhex_u7zax8XPa5.png%3Falt%3Dmedia%26token%3D9a444de7-7094-45a2-9f4f-0362238095df&width=768&dpr=4&quality=100&sign=e3492dd6&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FECWoM7e6TCzSYWMUv0Bh%252Fimhex_f2E3mrsjrm.png%3Falt%3Dmedia%26token%3Df1f561e1-d7c6-4bdf-bc7f-93134a2edde4&width=768&dpr=4&quality=100&sign=3676e813&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FienKyYMt4IV5i23o81Jc%252Fimhex_f8Grwrwb8b.png%3Falt%3Dmedia%26token%3Dee8fddb3-5c71-4f32-9087-6b3be05341ac&width=768&dpr=4&quality=100&sign=8f383b94&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FxSjsnmG0scK2QjifXnGW%252Fimhex_SMYtRvFkMp.png%3Falt%3Dmedia%26token%3D3a2f32d3-13ae-432b-9755-fe703f5abefa&width=768&dpr=4&quality=100&sign=8cde42c3&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F2G86MRfyumt9jhWvjld1%252Fimhex_lL8w8M1Z8B.png%3Falt%3Dmedia%26token%3Dd004862b-092d-4b2b-8796-b303a45a12de&width=768&dpr=4&quality=100&sign=c70b51c&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FJmbrit9AVrlsHIF6PdKW%252Fimhex_RaB9KzfHH2.png%3Falt%3Dmedia%26token%3D7f0a011b-6dc5-46cc-b7c9-42ed28a21846&width=768&dpr=4&quality=100&sign=23abacb8&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F0VYuHB3gvnnKWFraIGAm%252Fimhex_OETmA1p30e.png%3Falt%3Dmedia%26token%3D0205553a-48cd-4539-9f9a-cccbd17c8ee5&width=768&dpr=4&quality=100&sign=262811f0&sv=2) --- # Pattern Editor | ImHex Last updated 3 months ago Was this helpful? The Pattern Editor view is the main way to interact with the Pattern Language in ImHex. It consists of a text editor at the top followed by a information and configuration section. ### [](#the-pattern-language) The Pattern Language The Pattern Language is a custom C++ and Rust inspired scripting language that can be used to analyse binary data. In ImHex it's tightly integrated with the Hex Editor View to provide highlighting of byte regions and the Pattern Data View to display all generated patterns. For more information on the Pattern Language, consult the [Pattern Language Documentation](https://docs.werwolv.net/pattern-language/) . ### [](#writing-pattern-language-code) Writing Pattern Language code The main part of the Pattern Editor View is a text editor. It provides simple editing capabilities as well as syntax highlighting for the Pattern Language. All source code entered here will be parsed and executed when requested. ### [](#running-a-pattern) Running a Pattern To execute a Pattern after writing it, simply press the `Play` button at the bottom of the view. A spinner will show up and the `Play` button will turn into a `Abort` button which aborts the current execution when clicked. When the `Auto evaluate` checkbox is activated, the source code is automatically executed every time it is modified. Using the `Auto evaluate` option is only recommended for small patterns as bigger ones may take several seconds to execute which will lead to performance issues while typing. The two numbers next to the checkbox represent the number of patterns that have been created and the maximum number of allowed patterns. ### [](#information-and-configuration-section) Information and Configuration Section Below the text editor are multiple tabs that provide further information about the executed pattern and allow configuring certain parameters. #### [](#console) Console The Console displays textual information generated by the Pattern Language runtime. Either information printed there by the User or errors generated by the runtime. The following colors are used: * `Green`: Debug information generated by the evaluator * `White`: Regular print output * `Yellow`: Warnings generated by the user or the runtime * `Red`: Critical errors that prevent further execution of the code Individual lines can also be copied by clicking on them. #### [](#environment-variables) Environment Variables The Environment Variables tab allows you to specify environment variables that can be read by Pattern Language source code through the use of the `std::env(str name)` function. Each line represents a single environment variable. Clicking on the `+` button inserts a new variable, clicking on the `-` button removes it. The Combo box on the left side specifies the type of variable. * `I`: Integer * `F`: Floating Point * `S`: String * `B`: Boolean The field next to it specifies the name of the variable. This is the name that will be used in the source code to query value of this variable again. The field to the right of the name field represents the value of this variable. Depending on the specified type, this will be an integer, float, string or a checkbox. #### [](#settings) Settings The Settings tab contains all variables that have been declared using the `in` or `out` keyword. A `in` Variable will generate a new line with an input widget that can be used to pass config information to the current pattern. When the pattern reads from the `in` Variable, it will read the value specified in this tab. `out` Variables work the same way just in the other direction. The Pattern Language code can assign a value to this variable for it to be displayed in the settings tab. #### [](#sections) Sections The Sections tab contains all custom sections that have been created using the `std::mem::create_section(str name)` function. For more info on using sections, see [Sections](https://github.com/WerWolv/Documentation/blob/master/pattern-language/core-language/sections.md) page. The Pattern Language code can write data into this custom section and place patterns into it. This data can then be accessed by pressing on the `View` button in the right most column. A new window will open with a Hex Editor view containing the data of the section as well as a table containing all the patterns that have been placed in this section. They work the same way as their individual view counterparts. The Pattern Editor View Run button Console tab Environment Variables tab Settings tab Sections tab Custom section popup window ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FAUrIA05CIyEtXgOGV9nr%252Fimhex_Za4PuTiuny.png%3Falt%3Dmedia%26token%3D93fee8bb-33a6-4d28-8243-919fb9e89f2c&width=768&dpr=4&quality=100&sign=7f42ec2a&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FOP4pjndg10iO7rXUCOMc%252Fimhex_43O8AUj1QA.png%3Falt%3Dmedia%26token%3D64efa9ef-8e92-4077-8fb5-5ec039a70322&width=768&dpr=4&quality=100&sign=1a1713a0&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FDLEYwXj4ONLtwbSJuD85%252Fimhex_bIMY8WMvYk.png%3Falt%3Dmedia%26token%3Df901470b-f1b5-4542-8980-77e75590cdda&width=768&dpr=4&quality=100&sign=f6ef37d6&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F2Qjni3mt9PQEJ6bu4ibv%252Fimhex_8rDNGOdT6V.png%3Falt%3Dmedia%26token%3D48c189e4-63bf-4bcb-9fd0-a22cea541325&width=768&dpr=4&quality=100&sign=5f89d3e5&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F8BDGVqZu6x9ZRJ2N7i4K%252Fimhex_frybJR80zl.png%3Falt%3Dmedia%26token%3D4b61fbcb-c4e1-4309-93fd-d2ecf92a7462&width=768&dpr=4&quality=100&sign=5e3d5d35&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FpaveUQKGWngUbhbesfNK%252Fimhex_cqowB8XMS6.png%3Falt%3Dmedia%26token%3D895249e5-ffbf-4360-8087-9e4638b9302f&width=768&dpr=4&quality=100&sign=ec2985d&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FUzU6PeG27w2Kr4u7TMPx%252Fimhex_JI3pGGd7x8.png%3Falt%3Dmedia%26token%3Defbe02f5-eb49-4c1c-9b9e-ea56ca950ffb&width=768&dpr=4&quality=100&sign=eed218d2&sv=2) --- # Hashes | ImHex Last updated 2 years ago Was this helpful? The Hash view allows you to instantiate multiple different hashing algorithms all with their own custom settings and automatically hash selected regions of bytes with them. ### [](#creating-a-hash-function) Creating a hash function To get started, simply select the Hash Function you're interested in from the `Hash function` combo box at the very top. If this function has any customizable settings, they will appear in the configuration box below. In the case of the CRC algorithms, it's possible to customize the polynomial, initial value and more. Once you're happy with your settings, give your hash function a descriptive name using the input text box below the configuration box and press the `+` button to add this new instance to the list of hashes. To remove a hash again, right click it in the table and select `Remove hash`. ### [](#using-the-hashes) Using the hashes In order to hash a specific region of bytes, simply select them in the Hex Editor View. The Hash of these bytes will automatically get updated and displayed in the `Result` column in the hash view. Hovering over a selected region in the Hex Editor View and holding down the `SHIFT` key will also open a tooltip popup with all the hash results in it. The Hash View Hash tooltip ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-ab4e9cc2ca0e2610fc61f9181fc111fa0fc37ece%252Fimhex_NcRQW1rOx5.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=85fbff9d&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-f50d23b1a728409ba69d0bd25fd7a80db523dcdd%252Fimhex_l878qdnQS0.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=44001268&sv=2) --- # Patches | ImHex Last updated 2 years ago Was this helpful? The patches view contains a simple list of all changes that have been made to the data but weren't yet written back. Whenever changes are being made to buffered data, they aren't directly written back but instead end up in the patches list where they can be reviewed and reverted if necessary. The list consists of three columns: The address where the change has been made, the original value at that address and the patched value. In order to revert back a change, simply right click it in the list and select `Remove patch`. ### [](#saving-patches) Saving Patches Patches can also be written back to the original data. To do this, use the `File -> Save` or `File -> Save as...` option or `CTRL + S`. ### [](#exporting-patches) Exporting Patches Instead of writing the patches back to the data directly, it's also possible to export them through `File -> Export...`. The options found there are able to create patch files in various different popular formats. Currently supported formats are: * IPS * IPS32 The Patches View ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-78f36e8e9f0c93a6b2c17af4d7633039549a7f69%252Fimhex_8PCsBsQy0Z.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=f683416c&sv=2) --- # Yara | ImHex Last updated 2 years ago Was this helpful? The Yara View provides access to the Yara Rule support that's built into ImHex. It lets you choose one or more rule files and matches the entire data against them. For more information about how to use and write Yara rules, check out their [Documentation](https://virustotal.github.io/yara/) . ### [](#file-chooser) File Chooser Before any matching can be done, first select one or more Yara Rule files. This is done by pressing the `+` button which opens the Choose file dialog. Either select a file from the provided list there or click on `Browse...` to open a regular file picker. To remove a file from the list again, click the `-` button. ### [](#matching) Matching To now match against the selected set of Rules, click the `Match Rules` button. This will execute all the Rules in order and at the end displays the results in the `Matches` table below. Clicking on a row jumps to this Match in the Hex Editor View. If any Rule uses Yara's `console` module, its output will be displayed in the console below the matchs table. The Yara View ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FibkusBEao8EjjIi8d0hD%252Fimhex_hM3v2omMdv.png%3Falt%3Dmedia%26token%3D0b72e14a-4778-4ae4-82cd-836ed2061649&width=768&dpr=4&quality=100&sign=6745d3d7&sv=2) --- # Find | ImHex Last updated 2 years ago Was this helpful? The Find View allows you to search the entire data or just parts of it for sequences of bytes that match certain constraints. #### [](#selecting-the-data-to-search) Selecting the data to search Using the range combo box at the very top, you can can change the region of bytes that is being searched. By default, `Entire Data` is selected which will cause all bytes in the data to be traversed. If only a small section of the data should be processed, select `Selection` and then select the region of bytes you want to be searched in the Hex Editor View. #### [](#search-strategies) Search strategies Depending on the kind of data you're looking for, a different strategy needs to be chosen. This can be done by selecting the relevant strategy using the Tab bar. Doing so will also change the available options to the ones relevant for this operation. **Strings** The Strings search strategy can extract ASCII, UTF-16LE and UTF-16BE strings or a combination of ASCII and UTF-16 strings. The string types that will be looked for can be chosen through the `Type` combo box. Using the `Minimum length` input field, the minimum number of characters in the string can be specified. Lowering this number will allow shorter strings to show up in the results list which can drastically increase the likelyhood of false-positives. In the advanced match settings, additional requirements for the strings can be set. Enabling these options will cause all strings that don't match their criterias to be discarded. * `Require Null Termination` requires all strings to end with a `0x00` NULL character. * The `Characters` option limit the categories of characters that are allowed to be present in the string. Disabling all options except the `Upper case letters` option for example will cause only strings to be matched that contain only upper case characters. **Sequences** The Sequences search strategy simply searches all occurrences of a specific string. For example searching for the value `Test` will list all occurrences of this sequence of four characters in the data. **Regex** The Regex search strategy works the same as the Strings strategy. It first extracts all strings of a given size and type from the data and then filters them using the Regex Pattern that was specified in the `Regex` field. If the `Require full match` option is enabled, a string is only included if the entirety of it matches the specified pattern. If it's disabled, only a part of the string needs to match for it to be included. **Binary Pattern** The Binary Pattern search strategy lists all byte occurrences in the data that match a given Binary Pattern. More information about the format can be found on the relevant documentation page. **Numeric Value** The Numeric Value search strategy searches the data for occurrences of numeric values whose values are within a certain range. It will interpret the bytes at every address in the data as the specified Type and compare it to the range of allowed values. The `Minimum Value` and `Maximum Value` fields are used to specify the range of values that are allowed. The `Type` combo box is used to specify the type of number that you're looking for. Such as Signed or Unsigned integers of various sizes or floating point numbers. The `Endian` setting specifies the endianess of the value you're looking for. Big endian values will have their byte order reversed before being compared to the allowed range. #### [](#executing-the-search) Executing the search After configuring the search parameters, clicking on the `Search` button will start the search operation. Depending on the type of search and the size of the data to be searched, this can take a while. Once it's done, all the found values will be listed in the table at the bottom. The bytes will also be highlighted in the Hex Editor View. To reset the search and delete all highlightings from the data, click the `Reset` button. #### [](#results-table) Results Table The results table contains all the occurrences that have been found in the data. The `Offset` and `Size` column show the region where this occurrence has been found and the `Value` column shows the decoded value that was found. Clicking on one of the rows will cause the Hex Editor to jump to this location. The Find View Strings search options Sequences search options Regex search options Binary Pattern search options Numeric Value search options ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FrZHex5D3OvAhCRepWlfS%252Fimhex_BnPWV7Tk3I.png%3Falt%3Dmedia%26token%3D67567624-2d31-4f88-b025-927d462464d3&width=768&dpr=4&quality=100&sign=9c5cecfc&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FUzfXByc1AgOTDFNvdEXx%252Fimhex_vlFdee9FWt.png%3Falt%3Dmedia%26token%3D5c74342f-5323-45d9-a2c0-da4b556c141c&width=768&dpr=4&quality=100&sign=fb878a95&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fwu4Nm8EbHaiLaFchI7Zy%252Fimhex_nq5cyOmJEM.png%3Falt%3Dmedia%26token%3D96e07d29-5dff-4cb8-8479-95bb6e320ffe&width=768&dpr=4&quality=100&sign=af7697e7&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FPIpEUvGQ2zJmBt9Mlovt%252Fimhex_V51XAlOakD.png%3Falt%3Dmedia%26token%3Dc38d9260-813e-47b0-b38d-24e9d38bfce9&width=768&dpr=4&quality=100&sign=ebf1ae80&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FGIOieYkS1adX1DynAROB%252Fimhex_60o600A079.png%3Falt%3Dmedia%26token%3D328c8a8c-6e85-412b-bd4c-dec83abaaab7&width=768&dpr=4&quality=100&sign=916970f7&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FW6yvcPXzwSkUBmZYfWcL%252Fimhex_KLWhyKoqWh.png%3Falt%3Dmedia%26token%3D16e88d7d-685c-4a00-ae8e-9eb70c502e4c&width=768&dpr=4&quality=100&sign=9b4c2203&sv=2) --- # Pattern Data | ImHex Last updated 1 month ago Was this helpful? The Pattern Data View is a simple tree representation of the Patterns generated by the Pattern Language source code that has been executed in the Pattern Editor View. These two views work hand in hand. By default, the table in this view will be completely empty until any Pattern Language source code is executed and that code places any type into the loaded data throught the placement syntax. ### [](#structure-of-the-patterns) Structure of the patterns The table in the Pattern Data view consists of six columns: * `Name`: This column simply displays the name of this pattern. The name is either the name of the variable or a customized string set through the `[[name("value")]]` attribute. * `Color`: This column shows the color of this pattern as it's highlighted in the Hex Editor View. This color is usually selected from a repeating color pallette but can also be manually assigned using the `[[color("RRGGBB")]]` attribute. * `Offset`: This colum shows the start and end address of the pattern where it has been placed into the data. * `Size`: This column shows the size of the pattern. * `Type`: This column displays a formatted version of this pattern's Type name. * `Value`: This column is the most important one as it displays the value that this pattern has decoded from the data it was placed on. ### [](#interacting-with-the-patterns) Interacting with the patterns Each line in the table corresponds to one pattern that was generated. Simple patterns such as a `u32` will stand on their own and simply display their decoded value. Other more complicated patterns such as custom struct types might have children that can be displayed. If a pattern has any children, an arrow icon appears to the left of their name. Clicking on the name will expand the tree view of that pattern and display its children. Clicking anywhere else on the pattern will cause the Hex Editor View to jump to the address of this pattern and select it. When bytes are being selected in the Hex Editor View, some of the names of the patterns might turn blue. This color indicates that the current selection in the Hex Editor View overlaps with this pattern or one of its children. ### [](#modifying-pattern-values) Modifying pattern values Most built-in pattern types as well as custom types that have been attributed with the `[[format_write]]` attribute can be modifed by double clicking their `Value` field. Doing so will turn the `Value` field into a text box where the new value can be entered. Pressing the `Enter` key will cause the pattern to format the entered value and write the bytes back into the data where the pattern has been placed at. ### [](#visualizers) Visualizers Visualizers are a ImHex-specific extension to the Pattern Language. They allow you to visualize data in more advanced ways than by just using text and colors. To use a visualizer, simply apply the `[[hex::visualize("visualizer_name", params...)]]` attribute to the type or variable you want to visualize. Copy struct Coordinates { float latitude; float longitude; } [[hex::visualize("coordinates", latitude, longitude)]]; #### [](#available-visualizers) Available Visualizers `[[hex::visualize("line_plot", float_array)]]` This visualizer expects an array of 4 Byte `float` values and will visualize it using a Line Plot `[[hex::visualize("scatter_plot", x_float_array, y_float_array)]]` This visualizer expects two arrays of 4 Byte `float` values and will visualize it as a Scatter Plot using the first array for the X Coordinates and the second array for the Y Coordinates. These two arrays need to have the same size. `[[hex::visualize("image", pattern)]]` This visualizer expects any pattern that contains the bytes of an image (such as a struct, a byte array and so on) and will decode the data into the actual image data. Supported formats are: JPG, PNG, TGA, BMP, PSD, GIF, HDR and PIC `[[hex::visualize("bitmap", pattern, width, height)]]` This visualizer expects any pattern that contains raw RGBA8 values in the form of `RR GG BB AA`, one byte per color channel as well as the width and height in pixels of the resulting image. It will draw these bytes as is. `[[hex::visualize("sound", pattern, num_channels, sample_rate)]]` This visualizer expects any pattern that contains all the bytes of a raw signed 16-bit PCM audio stream, the number of channels that are being used and the sample rate. It allows you to convert this data to sound to listen to. `[[hex::visualize("3d", vertices, indices)]]` This visualizer expects an array of structures containing three 4-Byte `float` values, representing X, Y and Z coordinates of each vertex in a model and an optional `u32` array containing indices into the vertices array. `null` can be used for the indicies array if it shouldn't be used. Each group of 3 vertices makes a triangle and there are two ways to represent these triangles: * If indices array is `null`, then vertices array should contain N\*3 vertices, to represent N triangles of a model. * Otherwise, the indices array should contain N\*3 indices, each group representing a triangle by indexing into the vertices array. For example: * Vertices array containing 12 elements will represent 4 triangles, array elements with indices 0,1,2 representing the first triangle, indices 3,4,5 representing the second triangle and so on. * Vertices array containing 5 elements can also represent 4 triangles by using a 12-element `indices` array - every group of 3 elements in that array representing a triangle, so indices array elements with indices 0,1,2 is the first triangle, indices 3,4,5 are the second triangle and so on. With the above example of four triangles these two representations are equivalent: * with `vertices` array only Copy vertices = [\ // 1st triangle\ { -1.0, -1.0, 0.0 }, // vertex (0)\ { 1.0, -1.0, 0.0 }, // vertex (1)\ { 0.0, 0.0, 0.0 }, // vertex (2)\ // 2nd triangle\ { 1.0, -1.0, 0.0 }, // vertex (1)\ { 0.0, 0.0, 0.0 }, // vertex (2)\ { 1.0, 1.0, 0.0 }, // vertex (3)\ // 3rd triangle\ { 1.0, 1.0, 0.0 }, // vertex (3)\ { 0.0, 0.0, 0.0 }, // vertex (2)\ { -1.0, 1.0, 0.0 }, // vertex (4)\ // 4th triangle\ { -1.0, 1.0, 0.0 }, // vertex (4)\ { 0.0, 0.0, 0.0 }, // vertex (2)\ { -1.0, -1.0, 0.0 }, // vertex (0)\ ] * or, with both `vertices` and `indices` arrays Copy vertices = [\ { -1.0, -1.0, 0.0 }, // vertex (0)\ { 1.0, -1.0, 0.0 }, // vertex (1)\ { 0.0, 0.0, 0.0 }, // vertex (2)\ { 1.0, 1.0, 0.0 }, // vertex (3)\ { -1.0, 1.0, 0.0 }, // vertex (4)\ ] indices = [\ // 1st triangle\ 0, 1, 2,\ // 2nd triangle\ 1, 2, 3,\ // 3rd triangle\ 2, 3, 4,\ // 4th triangle\ 4, 2, 0\ ] `[[hex::visualize("chunk_entropy", pattern, chunk_size)]]` This visualizer expects any pattern whose bytes will be split into chunks of the size specified by the `chunk_size` parameter. It will then display an entropy graph of these bytes `[[hex::visualize("hex_viewer", pattern)]]` This visualizer expects any pattern whose bytes will be displayed in a hex viewer similar to the one in the hex editor view. This is mainly useful for splitting out large chunks of bytes and looking at them individually or for debugging when getting patterns into the right format for other visualizers to work with. `[[hex::visualize("coordinates", latitude, longitude)]]` This visualizer expects a latitude and longitude value in form of a floating point number and visualizes this coordinate on a map of our planet. It also allows for checking the internet for the approximate name / address of this location. ### [](#inline-visualizers) Inline Visualizers Inline visualizers work the same as the normal visualizers but instead of displaying in a separate popup window, they replace the value drawn in the Value column. `[[hex::inline_visualize("color", r, g, b, a)]]` This visualizer expects separate r, g, b and a color values, each ranging from 0 to 255. It displays this color then in the value column. `[[hex::inline_visualize("gauge", progress)]]` This visualizer expects a progress value ranging from 0 to 100. It displays this value as a progress bar where 0 means the progress bar is entirely empty and 100 means it's completely filled. `[[hex::inline_visualize("button", function_name)]]` This visualizer replaces the value column with a button that executes the specified function when clicked. It expects the name of the function as a string. The entry in the Value column will then turn into a Button that will open the visualizer popup with the specific visualization inside. The Pattern Data View Line Plot Visualizer Scatter Plot Visualizer Image Visualizer Bitmap visualizer Sound Visualizer 3D Visualizer 3D mesh example Enropy Visualizer Hex Viewer Visualizer Coordinates Visualizer Color Inline Visualizer Gauge Inline Visualizer Button Inline Visualizer ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F60EEckH3kON2uKPHNFfc%252Fimage.png%3Falt%3Dmedia%26token%3D118a7621-1311-4102-9ba1-d2a253338737&width=333&dpr=4&quality=100&sign=2471594f&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F9UJIIOvf8ikY5tPYfnsi%252Fimhex_h4gXrsglWd.png%3Falt%3Dmedia%26token%3D4452dace-2d4f-45b2-8c18-5e48040d2e13&width=768&dpr=4&quality=100&sign=8b26d2e3&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FAe7VuUzl5B6oUBEKKCUP%252Fimage.png%3Falt%3Dmedia%26token%3D53303db9-ceb4-49d8-b8e8-52bc0146e1b9&width=768&dpr=4&quality=100&sign=2b6cebba&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FBNHJRmCFFhOB6YDmlsl0%252Fimage.png%3Falt%3Dmedia%26token%3Def2fe366-763b-4266-a8c0-0d47c0014e27&width=768&dpr=4&quality=100&sign=f80c94e0&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F5zofNJqvDtvGfHZuczJy%252Fimage.png%3Falt%3Dmedia%26token%3D98209f6c-5b9c-4815-83ba-068d5cf8fde2&width=768&dpr=4&quality=100&sign=c3b21cbe&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F92vLNu6UDVF8hRA3b3j0%252Fimage.png%3Falt%3Dmedia%26token%3Da1527b10-9fbd-42c3-974f-7b33340d5061&width=768&dpr=4&quality=100&sign=38b5ab5e&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F3MgpZJJ0iDVU5LVuph4a%252Fimage.png%3Falt%3Dmedia%26token%3D94480aad-1a23-4b57-b5b9-f99ac5e16711&width=768&dpr=4&quality=100&sign=43f883d8&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FM2VpqEOdcIymUFR8Tpkc%252Fimage.png%3Falt%3Dmedia%26token%3D0d58515e-fccf-46a2-b8f8-1ecf7435ee6f&width=768&dpr=4&quality=100&sign=e69038bb&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-31d1e711f65a2cc73ba03ac34c8dd9c088123fca%252F3d_mesh.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=64caeda6&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FtHiewg6B21hhaRe91l4q%252Fimage.png%3Falt%3Dmedia%26token%3Dfe308d27-a6b1-4ba2-be9a-f5e19a88cb41&width=768&dpr=4&quality=100&sign=c5eb759a&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FMMV41S9OGzZoS5D3xkdE%252Fimage.png%3Falt%3Dmedia%26token%3D6852456a-01ae-4a76-a952-d454d19c3d19&width=768&dpr=4&quality=100&sign=c5661089&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F8GtNoKMpd9FHuBhnLOPm%252Fimage.png%3Falt%3Dmedia%26token%3Dbd236ef1-315f-4e77-9fdd-874090c3a9db&width=768&dpr=4&quality=100&sign=5bbd2bbc&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FFPtt6R95VHFTOFPLibql%252Fimage.png%3Falt%3Dmedia%26token%3D1d54ef80-1447-4492-b15b-4f8cfe10f1e3&width=768&dpr=4&quality=100&sign=9372cc7d&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fo1fdws6n2g6VOZ66nmRa%252Fimage.png%3Falt%3Dmedia%26token%3D00e56d8b-67ed-4072-b24e-81dffd3c2a78&width=768&dpr=4&quality=100&sign=d39030d9&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FNA8mJkY7tDfMkZKysLjF%252Fimage.png%3Falt%3Dmedia%26token%3Ddee768d1-a6cb-4ae1-8a4c-6837f02e6a31&width=768&dpr=4&quality=100&sign=5651f61b&sv=2) --- # Diffing | ImHex Last updated 1 year ago Was this helpful? The Diffing View can find differences between two files, highlight them and create a list containing all differences. ### [](#diffing) Diffing First of all, to diff the content of two providers, two providers must be opened. To compare these two providers with each other now, select the providers in the combo box at the top under `Provider A` and `Provider B`. This will open both files next to each other in two new hex editor views. All bytes that differ from each other between the two providers will now be highlighted. * `Yellow` marked bytes differ from each other in their value. * `Green` marked bytes exist in Provider A but not in Provider B. * `Red` marked bytes exist in Provider B but not in Provider A. ### [](#diffing-options) Diffing Options There's multiple diffing algorithms available in ImHex that can be chosen and configured by clicking on the Gear icon next to the provider selector. * `Simple byte-by-byte algorithm` does a primitive byte-by-byte comparison. If the two bytes at the same address in the two providers differ from each other, they're highlighted in yellow * `Myers's bit-vector algorithm` does a more advanced comparison trying to find inserted and removed byte regions besides just changes in the file. The Window size parameter specifies how many bytes to look ahead for possible insertions. This algorithm is significantly slower than the primitive one, however it can also be much more useful. ### [](#differences-list) Differences list The table below the two diffing hex views contains all differences between the two providers listed individually. Clicking on a row will jump to that location and select the region in both hex views. The Diffing View Diffing options ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FrwYunzHGqxypINErXxWa%252Fimage.png%3Falt%3Dmedia%26token%3D6b99e528-6661-4368-80a5-cd0920080042&width=768&dpr=4&quality=100&sign=dd79a9e4&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FZrdkKYXZLjYY624K11Eh%252Fimage.png%3Falt%3Dmedia%26token%3D5020c222-5097-4b2f-b3ba-6e8f1d377d85&width=768&dpr=4&quality=100&sign=1d7fb4f2&sv=2) --- # Data Information | ImHex Last updated 1 year ago Was this helpful? The Data Information View gives visual insight into various aspects of the file's binary composition through analysis information, diagrams and tables. ### [](#starting-the-analysis) Starting the analysis To start the analysis, first select the start and end address that will be analyzed. Afterwards simply click on `Analyze page` to start the analysis. Further analysis options can be specified on a per-analysis basis by clicking on the gear icon of the individual blocks and changing their settings there. It's also possible to disable certain analysis blocks by unchecking their checkbox next to their name. ### [](#provider-information) Provider Information This section contains additional information that has been provided by the data provider. The information found here will differ depending on the type of provider that's being used. For a simple file provider, the table will display the file path, size, creation, access and modification as well as the region that has been analyzed by this view. ### [](#magic-information) Magic Information This section displays some helpful information about the file format itself and it's MIME type. It uses `libmagic` for this which is the same library that's being used by the popular `file` command on Linux. If this section is missing, make sure you installed the relevant Magic database from the Content Store. ### [](#information-analysis) Information analysis #### [](#byte-distribution) Byte distribution The Byte distribution graph is a Histogram which displays the number of occurrences of each byte using a logarithmic scale. In the graph above you can see that most bytes are equally likely to occurr but bytes close to `0x00` and around `100` (the ASCII range) are more abundant. #### [](#byte-types) Byte Types The byte types graph displays a stacked relative frequency graph which contains information about how often a certain type of byte occurres within a block of data. The X-Axis of this graph represents the block's address and the Y-Axis the percentage of bytes in this block that are of the relevant type. The byte type is determined using the [``](https://en.cppreference.com/w/c/string/byte) functions listed in the legend below. To hide certain types, simply click on their legend entry. There's also a drag bar on the graph that can be moved around to jump to the offset of that block in the Hex Editor View.image Besides just byte types, the graph also highlights regions that have a lot of bytes of the same value in green and regions that most likely contain English plain text in purple. #### [](#entropy) Entropy The entropy graph displays the [Shannon Entropy](https://en.wikipedia.org/wiki/Entropy_(information_theory)) of each block using the following formula: H(X)\=−∑i\=1np(xi)∗log⁡2(p(xi))\\displaystyle H(X)=-\\sum\_{i=1}^{n}p(x\_i)\*\\log\_{2}(p(x\_i))H(X)\=−i\=1∑n​p(xi​)∗log2​(p(xi​)) A higher entropy value corresponds to "more random" data. So big regions of the same value have a low entropy, big regions of completely random values have a high entropy. The graph also has a drag bar again that can be moved to jump to that block's address. #### [](#composition-information) Composition information This table displays information about the entire composition of the data. * `Block Size` refers to the number of blocks that have been created and their individual size. * `Overall entropy` displays the entropy value of the entire data. * `Highest block entropy` and `Lowest block entropy` shows the value and address of the block with the highest or lowest entropy value. * `Plain text percentage` shows the percentage of the file that consists of plain text ASCII characters. The block size heavily depends on the kind of data you're interested in. Lowering it will show finer details but also increases the noise level. Increasing it will average out small details but also remove most of the noise. #### [](#inferred-properties) Inferred properties ImHex tries to figure out potential properties of data based on the parameters it calculated before. These are displayed in Red below the composition information. ### [](#byte-relationship) Byte Relationship #### [](#digram) Digram The Digram visualizer takes random pairs of two bytes from the data and calculates their relative frequency. The value of the first byte is then used as the Y-Value, the value of the second byte as the X-Value starting from the top left. Pairs of bytes that are less abundant are then displayed in a faint Orange while pairs that appear more frequently are displayed in Blue or White. #### [](#layered-distribution) Layered Distribution The Layered Distribution or Layered Digram plot works the same way as the regular Digram visualizer but takes the position in the file into account as well. To do this, the file is split into a number of equally sized chunks and a byte value density map is generated for each of them. Each chunk then represents a single horizontal line in the diagram. The value 0x00 is all the way at the left, 0xFF all the way at the right of each row. The lighter the color, the more abundant that value is. The first row represents the byte density at the very start of the data, the last row represents the one at the very end. For more information about both the Digram and Layered Distribution plots, check out this [Blog Post by Codisec](https://codisec.com/binary-visualization-explained/) . ### [](#advanced-data-information) Advanced Data Information This analysis runs a set of Yara rules on the data to determine things like the Programming language a binary was written in or what kind of compiler was used. More rules can be downloaded from the content store or added manually to the `/yara/advanced_analysis` folder. Example: Copy rule CompilerMSVC { meta: category = "Compiler" name = "MSVC" strings: $iostreams_mangled_name = "$basic_iostream@DU" ascii $std_namespace = "@@std@@" ascii condition: any of them } The Data Information View Settings field Byte Distribution graph Byte types graph Table representing which bytes are captured by which byte type Highlighted plain text Entropy graph Composition information Compressed or encrypted data with a high entropy was analyzed Data with a very high number of ASCII characters was analyzed Digram Layered Distribution Advanced Data Information analysis ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FJWvLjzfGlftmnh3z4FX7%252Fimage.png%3Falt%3Dmedia%26token%3D49b20871-9aa3-4b33-958c-168e9197deb8&width=768&dpr=4&quality=100&sign=ecb91dfe&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F1vr4M6XYWed1LXBhOLW5%252Fimage.png%3Falt%3Dmedia%26token%3D7f894146-ba3e-4a1d-a42c-50c2074bc22d&width=768&dpr=4&quality=100&sign=37c92959&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FFEOCy4Py78O3KkcnwLap%252Fimhex_zBnXiZkM48.png%3Falt%3Dmedia%26token%3D0448309c-d9ba-41e8-8812-bde1d54c1617&width=768&dpr=4&quality=100&sign=9bd8f4a8&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F2sjcbBzkiop5GJzzL7zD%252Fimage.png%3Falt%3Dmedia%26token%3D2ac77db3-c6a2-4232-ada3-502f09d1072e&width=768&dpr=4&quality=100&sign=35490626&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FFB89e1pHTIEJdtEXFZRA%252Fmsedge_obci52Dx8p.png%3Falt%3Dmedia%26token%3Df217e8b8-f198-46cb-9d34-243a0dc422b9&width=768&dpr=4&quality=100&sign=995be66e&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fmlxpes3x7KlzKt6hcUkx%252Fimage.png%3Falt%3Dmedia%26token%3D4303e2d8-d8d1-40c6-984d-a41e2c0ea8ab&width=768&dpr=4&quality=100&sign=6f1e081d&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F1MnGC3adRmnjdoUQnjPX%252Fimhex_7OmHKE33J2.png%3Falt%3Dmedia%26token%3Dbf35b3b7-11d2-45ce-a7a8-04340b824316&width=768&dpr=4&quality=100&sign=55984b23&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F1yYt9ZAnw5eCGOgQrW3R%252Fimhex_HaXI1JEIY9.png%3Falt%3Dmedia%26token%3Dafa40c8a-e75c-488c-938c-77c0737ee174&width=768&dpr=4&quality=100&sign=18e485f7&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FMpIAsKRJ5KKb3JfPW4aJ%252Fimhex_ul2qJfJ8kr.png%3Falt%3Dmedia%26token%3Dea2862ee-5c4b-44d0-90ec-6ac3a24cd90c&width=768&dpr=4&quality=100&sign=2d9bd53&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FaepjW6uUECBUCZw1vFw7%252Fimhex_hOK0Y9k4qq.png%3Falt%3Dmedia%26token%3D5b27ce7a-1685-4bcc-8475-b81d87bed166&width=768&dpr=4&quality=100&sign=afc9b2f3&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FCiqIblnADsmFKVNuuke3%252Fimhex_1DenTf29JC.png%3Falt%3Dmedia%26token%3D3403ff07-ee6b-4717-b772-541839dbbac0&width=768&dpr=4&quality=100&sign=2fc7da5a&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F5xWUUp9s1PHKWKMc0sPL%252Fimhex_mI86MX1SFm.png%3Falt%3Dmedia%26token%3D2f4fceb5-a025-474c-8ec1-41f76ee6e7c7&width=768&dpr=4&quality=100&sign=63c5cf2c&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F0hGNyG3s4HoPLwHSreCW%252Fimage.png%3Falt%3Dmedia%26token%3Dfba12171-8dbd-4eba-a07b-20bdf66c3ee7&width=768&dpr=4&quality=100&sign=5611e121&sv=2) --- # Welcome Screen | ImHex Last updated 2 months ago Was this helpful? The Welcome Screen is what shows up at the start when ImHex is loaded. It contains a bunch of frequently used options and information. Pressing the `X` button at the top right will close the Welcome Screen without loading any file. Useful when you want to interact with features of ImHex that don't require any data to be loaded. ### [](#quick-settings) Quick Settings ImHex has a simplified mode which drastically reduces the visual load when using ImHex. Enabling it will turn ImHex into a pure hex viewer editor without any extra analysis tools. To enable it, turn on the `Simplified` Toggle at the bottom of the Welcome Screen. Welcome Screen Editing Screen ### [](#start) Start The Start section contains buttons to quickly get into editing mode with either a new set of data or opening existing data. * `Create New File`: Creates a new, unsaved file that is stored in memory. Saving it will create a new file. * `Open File`: Opens a file picker popup to choose a new file to open in the editor * `Open Project`: Opens a file picker popup to open a previously saved Project file. This will restore all providers that were open and all their settings. * `Other Providers`: Shows a list of available special providers. Clicking on any of the providers in the list will open a special load interface that depends on the provider being loaded. ### [](#recent-files) Recent Files The Recent Files section provides links to last 5 Providers that were opened. Clicking on the links will restore them. ### [](#help) Help Links to the GitHub Repository, Discussions Page and the Discord Server ### [](#plugins) Plugins The Plugins section contains a table containing all the currently loaded Plugins. By default on all Platforms there's the `Built-In` plugin which contains all the base functionality of ImHex. Windows users also have a `Windows` plugin for Windows-only features. If custom plugins are being loaded, they will also show up in this list. ### [](#customize) Customize Links to customization options within ImHex such as the Settings. ### [](#learn) Learn Learning resources about ImHex including a link to this documentation page, a link to the latest release and the Plugin API Documentation. Right below, there's buttons that take you to ImHex's interactive tutorials as well as the achievement page. Both are meant to teach the user the basics of how to use ImHex quickly. The Welcome Screen ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F204WUEdJhEeu9Td4dcZX%252Fimage.png%3Falt%3Dmedia%26token%3D4e4b575e-b9a1-49ab-864a-bd7e36d251f1&width=300&dpr=4&quality=100&sign=37ea3437&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fs0ISTsk9OWLL7tnhWOaS%252Fimage.png%3Falt%3Dmedia%26token%3D558bc22e-f307-43bb-9491-9d2bec60a7c7&width=300&dpr=4&quality=100&sign=a1c75a66&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FEpX2vyt2pETvEuNsCzlq%252Fimage.png%3Falt%3Dmedia%26token%3Da3f6ed5c-a91d-4e60-8c5a-54e64dd38f59&width=768&dpr=4&quality=100&sign=a17c5b91&sv=2) --- # Content Store | ImHex Last updated 1 year ago Was this helpful? The Content Store is a simple store front that can be used to download extra features made by the community. If you'd like to add your own items to the store, please submit a PR to the [https://github.com/WerWolv/ImHex-Patterns](https://github.com/WerWolv/ImHex-Patterns) GitHub repository. Once your PR has been merged, the new files will automatically show up for everbody. To access the Content Store, simply click on `Extras` in the Menu Bar and select `Content Store`. ### [](#content) Content The tabs at the top of the Store represent all the different available categories. * `Patterns`: Pattern Language Pattern files for various popular formats and data layouts * `Libraries`: Pattern Language Libraries such as the Standard Library. * `Magic Files`: Files used to determine the type of the data you loaded. These files also enable automatic loading of patterns. * `Nodes`: Custom Nodes for the Data Processor * `Encodings`: Custom encodings to decode bytes and display them in the Hex Editor's advanced decoding column. * `Constants`: Constant declaration files used in the Constants view. * `Themes`: Custom ImHex themes generated through the `Theme Manager`. * `Yara Rules`: Custom Yara rules that can be matched against in the Yara View. ### [](#downloading-content) Downloading content To download any file, simply click on the `Download` button next to it. Once it's installed, it's immediately available in ImHex. To remove the file again, click on the `Remove` button that showed up in its place. Files that have been modified upstream but have already been downloaded to your machine can be updated using the `Update` button next to them. If the upstream repository has been modified since you opened the content store, the list can be updated using the `Reload` button. If you want to update all files at the same time, click on the download all button at the top right The Content Store ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F9arvloFba0v6vlwIkwVy%252Fimage.png%3Falt%3Dmedia%26token%3D6dc0be22-0102-4e7c-b2fd-097a48ef425d&width=768&dpr=4&quality=100&sign=e2bd647a&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FDUT1OglIdKVYXcG8kyUa%252Fimage.png%3Falt%3Dmedia%26token%3D82b5ef1d-1604-4fab-8708-b9af065c37ec&width=768&dpr=4&quality=100&sign=1717023f&sv=2) --- # Tools | ImHex Last updated 2 years ago Was this helpful? The Tools View simply contains various different tools and niche helpers that didn't fit anywhere else in the Editor. All tools can be detacted and used as their own windows by simply closing them first and then dragging its header off of the tools window. The tool will automatically return to the tools window when it's being closed. LLVM DemanglerASCII TableRegex replacerColor picker This view takes a mangled type name from one of the following encoding standards and turns it back into the actual type name used in the respective programming language. * Itanium (Mangling used by GCC and Clang in C++) * MSVC * Rust * D-Lang To decmangle a string, simply enter it in the text field at the top and the demangled version of it will be displayed in the text field below. The ASCII Table is a simple list of all standard ASCII characters and their corresponding Decimal, Hexadecimal and optionally Octal value. The octal columns can be turned on and off using the checkmark setting at the bottom. The regex replacer tool takes a input regex pattern and applies a regex replace operation on it. The regex pattern field can contain any standard compliant regex pattern. For more information in this, consult the [Regex cheatsheet](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Cheatsheet) . The following replace pattern syntax is permitted: Characters Replacement $**n** **n**\-th backreference (i.e., a copy of the _**n**_\-th matched group specified with parentheses in the regex pattern). _**n**_ must be an integer value designating a valid backreference, greater than 0, and of two digits at most. $& A copy of the entire match $\` The _**prefix**_\*\* \*\* (i.e., the part of the target sequence that precedes the match). $´ The _**suffix**_\*\* \*\* (i.e., the part of the target sequence that follows the match). $$ A single $ character. This tool contains a simple color picker to quickly turn hexadecimal values into colors or vice versa or convert between different color format standards such as RGB or HSV. Right clicking the color picker allows switching from a color plane to a color wheel. CalculatorBase converterByte SwapperPermission Calculator The Calculator is a complete, stack-based postfix expression calculator. It works the same as many scientific calculators used in higher education. The keypad on the right can be used to as shortcuts to enter various functions into the input field, however the input field at the bottom can also be modified directly. Pressing enter or clicking on the `=` button will evaluate the expression and add the new value to the history. The most recent result is highlighted in red and also stored in the `ans` variable to use it in further calculations. **Assigning Variables** To assign values to custom variables, the following syntax can be used `x=100*3`. This will create a new variable called `x` and assign the result of `100 * 3` to it **Display Modes** The following display modes are available: * `Standard`: Displays the floating point results directly with 3 decimal points precision. * `Scientific`: Displays the entire floating point result up to 5 decimal points precision and switches to exponent notation for bigger numbers. * `Engineering`: Same as Scientific but displays numbers using their metric postfixes * `Programmer`: Displays all values as hexadecimal and decimal integers rounded down. Also replaces some of the buttons with bitwise operations. The base converter simply takes a number in one base and converts it into all other available bases. These are currently Decimal (DEC), Hexadecimal (HEX), Octal (OCT) and Binary (BIN) The Byte swapper tool does exactly what it says. It treats the Input value as a hexadecimal number and byte swaps it. If not enough characters have been entered to fill out the next power of two bytes, the input gets padded with zeros. This tool generates the absolute octal notation for UNIX permissions based on what permissions bits have been set in the table above. The absolute notation is value used in commands such as `chmod`. File UploaderWikipedia definitionsFile Tools The file uploader simply lets you choose any file on your system by clicking on the `Upload` button and uploads it to [https://anonfiles.com](https://anonfiles.com) so it can be shared with other people. Clicking on the link will copy it to the clipboard, CTRL + Click will open it in your browser. All uploaded files are publicly accessible using this link and will only stay on the site for a few days. The service is meant for quickly sharing files with others, not for long term storage. The Wikipedia term definitions tool simply asks Wikipedia for a short summary of the provided term. The language that's being used can be changed in the settings. **Shredder** The file shredder tool securely destroys a selected file and erases it from the hard drive. It does this by overwriting the data with various different byte patterns so no information of the data should be recoverable anymore, even when directly analysing the disk's hardware. For use on modern hardware such as SSDs or other NAND storage, enabling `Fast Mode` is usually enough. This will only overwrite the file with a single byte pattern before deleting it. For other storage medias such as HDDs, CDs or Floppies, `Fast Mode` is **NOT** enough to erase the data completely. This will irrecoverably destroy a file. Make sure you're absolutely certain that that's what you want to do! **Splitter** The file splitter can split a input file into multiple output files of a given size. This is useful when trying to transport a big file using multiple smaller storage medias such as CDs, when copying files bigger than 4GB onto a FAT32 drive or when uploading them to an online service that only supports a certain maximum file size. Select a file in the `File to split` input field and a destination folder for the output files in the `Output path` field. Then select the size the files should be split into using the combo box below. Selecting `Custom` will allow you to specify a custom number of bytes in the input box below. **Combiner** The file combiner tool is the inverse operation of the file splitter. It Can take a list of multiple smaller files and concatinate them into one bigger file. The order they show up in the list above is the order they are concatinated in. Add new files using the `Add...` button, remove a single file again using the `Delete` button or clear the entire list using the `Clear` button. Files in the list can also be moved around by first selecting them and then pressing on the arrow buttons on the right hand side to move them up or down in the list. To create the file, select a new path for it in the `Output file` field and press `Combine`. This operation might take a long time depending on how big the files are and how many of them there are. IEEE 754 DecoderDivision by invariant Multiplication The IEEE754 floating point decoder tool allows decoding of custom IEEE754 floating point numbers and visualizes their internal representation as well as the calculation that are being done. Clicking on the individual bits of the floating point number will toggle them. This can be used to enter the floating point number. Using the sliders, a custom exponent and mantissa size can be specified. This does not need to be any standard size but can be any up to a total maximum of 128 bits. The buttons `Half Precision`, `Single Precision` and `Double Precision` are shortcuts to set the sliders above to the values of these standard representations. The table below visualizes the formulas and calculations that are being used to calculate the different parts of the floating point number and how they will be combined to the final result at the end. `Floating Point Result` contains the actual numerical value of this calculation, `Hexadecimal Result` contains the Hexadecimal representation of it in memory. Division by invariant Multiplication is a optimization technique used by compilers to turn divisions by a constant number into a much more efficient multiplication followed by a shift. This tool can turn these divisions into the multiplication constant or vice versa based on the number of bits in the output. Modifying one value will automatically update the other one so the calculation is possible to do in both directions. `a`: Atto ->10−1810^{-18}10−18 `f`: Femto ->10−1510^{-15}10−15 `p`: Pico ->10−1210^{-12}10−12 `n`: Nano ->10−910^{-9}10−9 `u`: Micro ->10−610^{-6}10−6 `m`: Mili ->10−310^{-3}10−3 `k`: Kilo -> 10310^3103 `M`: Mega -> 10610^6106 `G`: Giga -> 10910^9109 `T`: Tera -> 101210^{12}1012 `P`: Peta -> 101510^{15}1015 `E`: Exa -> 101810^{18}1018 LLVM Demangler ASCII Table with Octal option turned on Regex replacing all vowels in the Input text with asterisks Color picker tool Color plane to color wheel popup Calculator tool Base converter converting the number 69 to different bases Hexadecimal value 0xAABBCCDD being byte swapped Unix permissions calculator File uploader with a link to single file Term "WAV" being searched on Wikipedia File shredder sub-tool File splitter sub-tool File combiner sub-tool IEEE754 floating point decoder tool Division of a value by the constant 1234 being turned into a more efficient multiplication followed by a shift operation ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-196f43386de707e7f41980277be568ac09ddb755%252Fimhex_6ACrfPXhyO.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=66aa918b&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-9a1434ca688c78bbd7660b9e51e68a7caeabc3a5%252Fimhex_HCUyiTsboW.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=7847d42d&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-7bd527672648147ec49b145a00ee012054dfdb71%252Fimhex_aCE9vlWVhS.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=7cbae782&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-ccc1768496a54db64b82c0ea31fe0005b7954d7b%252Fimhex_cWnI6WRIuo.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=73d114f2&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-80b5683c24d276f1bf48511674eefa1f190749e6%252Fimhex_wYrNPSPasu.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=e77a61e&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-3db70a88c04bd83e0065ba932ac6be13faf2ab4a%252Fimhex_DFeOT0VJh0.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=7a9856b4&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-35f45302ba7d59772cb346496db5d0f2e819b29a%252Fimhex_A8jUOMkUj6.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=649d2e67&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252F103mT6Nvht8AJ95cxmJT%252Fimhex_NboWdV294u.png%3Falt%3Dmedia%26token%3D2f3d215c-6d10-42bd-82f7-bbf6b83311cc&width=768&dpr=4&quality=100&sign=489aef2b&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-f731143785dbdf6c4cb0c748bbf0664164936595%252Fimhex_3pGwSRYkUw.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=e2627217&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-4b5183a443ba3f20bbda2e10e1603410eaff68b2%252Fimhex_h38IEUeOyE.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=7633003c&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-e0cf7182313360bd172d94adc99b45dd36bf92da%252Fimhex_DtScs6DByi.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=25d374ee&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-9e1b78b37c09c3323b0266fa1ff5a595ff1e7bba%252Fimhex_18MTLOWTwK.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=dc9d47bb&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-67ae3a0a5f88a7eb977fafa4dbe9f384b70ebb57%252Fimhex_RgiGcfo9YV.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=7db6cc37&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-3437584233bfda0b26a316418210cf24bff5ba81%252Fimhex_CoxqMjvjzj.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=8b41d26c&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-6dd69dbb70fa222c06a890567ac685faae2d3e4c%252Fimhex_MaPlaZ78mo.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=a74a1f3&sv=2) ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fgit-blob-4c464aff4237a269e6e1487940ee022ade22e731%252Fimhex_m506pixgMg.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=dcf74d15&sv=2) --- # Settings | ImHex Last updated 2 months ago Was this helpful? The Settings page can be accessed through the Main Menu by choosing `Extras -> Settings`. It contains multiple tabs with settings for various parts of ImHex. ### [](#categories) Categories * `General` : Various settings that didn't fit anywhere else * `Interface`: Settings that adjust how ImHex looks including Themes, Language settings and more * `Hex Editor`: Settings that mainly effect the hex editor window * `Font`: Option to load a System Font or a font from a ttf file. * `Folders`: Specify new folders from where ImHex loads its resources such as patterns, libraries, themes and more * `Proxy`: Option to use SOCK5 and HTTP proxies * `Toolbar`: Option to change and reorder the toolbar icons and add more menu options to it * `Shortcuts`: All the shortcuts ImHex has with the ability to override them The Settings Window ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252FWKeKWSKLZZwEmHU7l7mZ%252Fimage.png%3Falt%3Dmedia%26token%3Dbcd97d4a-206e-4a2c-b19c-91151907c4a9&width=768&dpr=4&quality=100&sign=5bc54a88&sv=2) --- # Layouts and Workspaces | ImHex Last updated 1 year ago Was this helpful? [](#introduction) Introduction ----------------------------------- Workspaces and Layouts are ImHex's way of saving, restoring and managing window layouts. All their functionality can be accessed through the `Workspace` menu. ### [](#layouts) Layouts Layouts let you save the state and position of all open views in ImHex so they can be restored again later on. By default the Default and the Minimal layout are available, however new ones can be saved by using the `Save Layout` option. Clicking on the saved layouts below will discard the current window positions and overwrite them with the previously saved ones. To remove a layout again, hold down the SHIFT key and click on the layout that should be removed. It's also possible to Lock the current layout by clicking on the `Lock Layout` option. This will prevent making any modifications to the current window positions or their size. Clicking on the option again unlocks the layout again. ### [](#workspaces) Workspaces Workspaces are a system built on top of Layouts. The difference is that Layouts are snapshots of the current window layout that can be saved and restored at any point and overwrite the current layout. Workspaces on the other hand let you create multiple work areas that can be switched back and fourth. This allows having multiple layouts for different tasks that can be used simultaneously. Any changes made to the layout is immediately saved to the workspace and will be there again when switching back. Workspace menu ![](https://docs.werwolv.net/~gitbook/image?url=https%3A%2F%2F1845190112-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fxj7sbzGbHH260vbpZOu1%252Fuploads%252Fd1TbFtuRoHxgKXhZUYLT%252Fimage.png%3Falt%3Dmedia%26token%3Dfadde858-4b00-4af1-a1e9-5b7b2e89585a&width=768&dpr=4&quality=100&sign=d854097d&sv=2) --- # Documentation | Documentation Last updated 2 years ago [ImHex](https://docs.werwolv.net/imhex/) [Pattern Language](https://docs.werwolv.net/pattern-language/) --- # Pattern Language | Pattern Language Last updated 7 months ago Was this helpful? The Pattern Language is a C++ and Rust inspired DSL that was developed for the to easily define and decode binary structures found in files or memory. If you want to contribute towards improving this documentation, the source documents are available at [https://github.com/WerWolv/Documentation](https://github.com/WerWolv/Documentation) under `pattern_language`. [ImHex Hex Editor](https://docs.werwolv.net/imhex/) ---