Hiew is an Hex editor and assembler/disassembler with following features:
- view and edit files of any length in text, hex, and decode modes
- x86-64 disassembler & assembler (AVX instructions include)
- physical & logical drive view & edit
- support for NE, LE, LX, PE/PE32+ and little-endian ELF/ELF64 executable formats
- support for Netware Loadable Modules like NLM, DSK, LAN,...
- following direct call/jmp instructions in any executable file with one touch
- pattern search in disassembler
- built-in simple 64bit decrypt/crypt system
- built-in powerful 64bit calculator
- block operations: read, write, fill, copy, move, insert, delete, crypt
- multifile search and replace
- keyboard macros
- unicode support
- Hiew External Module (HEM) support
- ArmV6 disassembler
Configuration & Customization
You can customize Hiew from the hiew*.ini (e.g. hiew8.ini) configuration file. From this configuration file, you can for example change the default start mode to "Code" mode instead of the default "Text" mode as follows:
StartMode = Code ; Text | Hex | Code
Inside Hiew, you can resize columns by pressingor :
Open file and Quit
To open a file, either start hiew from CLI and navigate through the browser to locate the file:
... or drag a file to the hiew icon. This second option will make you save time.
To quit Hiew, press.
To view the help, press:
Switch mode (F4 or ENTER)
To switch between modes (Text -> Hex -> Code -> Text -> ...), pressor :
View Header (F8)
From the Hex and Code views, pressto view the header:
Print screen (Alt+P)
To make a screenshot, press+ . You can either save the screnshot to a file (name it in the field) or copy the picture to the clipboard directly (press ).
To jump to a given offset (e.g.), press and enter "dot" followed by the offset (e.g. ).
This feature display cross references. Place your cursor on a function and pressto display the cross references:
In IDA Pro, this corresponds to the key (xref):
To search for a string or HEX, press:
When you press ENTER, Hiew goes to the offset of the first occurence:
To find the next occurence, press+ .
To edit hex bytes, place the cursor to the location to patch:
... and pressto enter in edit mode.
The menu offers different options:
|Undo||restore original byte under cursor|
|Trunc||truncate file at cursor|
|+||NOPs||filling current command by NOP|
|+||Table||select translation table|
To apply changes, press.
To display the calculator, press.