ImHex

Overview

ImHex is a modern, feature-rich hex editor designed for reverse engineering professionals. It combines traditional hex editing capabilities with advanced features like pattern language, analysis tools, and visual representations for understanding binary file structures.

Installation

Linux (Debian/Ubuntu)

sudo apt-get update
sudo apt-get install imhex

Linux (Arch)

sudo pacman -S imhex

macOS

brew install imhex

Windows

Download from ImHex releases or use Windows Package Manager:

winget install WerWolv.ImHex

Build from Source

git clone https://github.com/WerWolv/ImHex.git
cd ImHex
mkdir build && cd build
cmake ..
make -j$(nproc)
sudo make install

Basic Usage

Command	Description
imhex <file>	Open file in ImHex
imhex -r <provider> <file>	Open with specific provider
imhex --plugins <dir>	Load plugins from directory
imhex --verbose	Enable verbose logging

Interface Navigation

Main Windows

• Hex View: Traditional hex dump with ASCII representation
• Analysis View: Statistical analysis and pattern matching results
• Pattern Editor: Write and test ImHex pattern language
• Inspector: Detailed data structure inspection
• Search: Find hex sequences, strings, and patterns
• Bookmarks: Mark important file locations

Keyboard Shortcuts

Ctrl+O          Open file
Ctrl+S          Save file
Ctrl+F          Find hex/ASCII
Ctrl+H          Find and Replace
Ctrl+G          Go to offset
Ctrl+I          Inspect value
Ctrl+E          Edit file
Escape          Cancel operation

Pattern Language Basics

ImHex Pattern Language (IPL) allows you to define custom binary file structures with readable syntax.

Simple Structure Example

struct FileHeader {
    char magic[4];
    u32 version;
    u32 fileSize;
    u32 checksum;
};

FileHeader header @ 0x00;

Pattern Variable Types

u8  unsignedByte       // 1 byte
u16 unsignedWord       // 2 bytes (big-endian)
u32 unsignedDword      // 4 bytes
u64 unsignedQword      // 8 bytes
s8  signedByte         // signed 1 byte
s16 signedWord         // signed 2 bytes
s32 signedDword        // signed 4 bytes
float  floatValue      // 32-bit float
double doubleValue     // 64-bit double
char   character       // 1 byte character
wchar  wideCharacter   // 2 byte wide character

Advanced Pattern Constructs

// Arrays
u32 data[10];
char name[64];

// Conditional structures
struct OptionalData {
    u32 type;
    if (type == 1) {
        u32 extraData;
    }
};

// Loops
struct RepeatedSection {
    u32 count;
    struct Item {
        u32 id;
        char name[32];
    } items[count];
};

// Bit fields
struct Flags {
    u8 flagA : 1;
    u8 flagB : 1;
    u8 reserved : 6;
};

// Enums
enum<u8> FileType : u8 {
    TEXT = 0x01,
    BINARY = 0x02,
    EXECUTABLE = 0x03
};

Built-in Functions

// Offset and size functions
u64 offset = addressof(variable);
u64 size = sizeof(variable);

// String functions
str name = "value";
wstr wideName = "value";

// Color highlighting
dataOffset @ 0x100;  // Auto color

// Padding/Alignment
pad(4);  // Skip 4 bytes

Pattern Examples

PE Executable Header Analysis

// Simplified PE header pattern
struct MZ_Header {
    char magic[2];      // "MZ"
    u16 cblp;
    u16 cp;
    u16 crlc;
    u16 cparhdr;
    u16 minalloc;
    u16 maxalloc;
    u16 ss;
    u16 sp;
    u16 csum;
    u16 ip;
    u16 cs;
    u16 lfarlc;
    u16 ovno;
    char reserved[8];
    u16 oemid;
    u16 oeminfo;
    u32 lfanew;
};

MZ_Header header @ 0x00;

// Parse PE signature
struct PE_Header {
    char signature[4];  // "PE\0\0"
    u16 machine;
    u16 numberOfSections;
};

PE_Header peHeader @ header.lfanew;

ZIP File Analysis

struct ZipLocalFileHeader {
    u32 signature;           // 0x04034b50
    u16 versionNeeded;
    u16 generalPurpose;
    u16 compressionMethod;
    u16 fileModTime;
    u16 fileModDate;
    u32 crc32;
    u32 compressedSize;
    u32 uncompressedSize;
    u16 filenameLength;
    u16 extraFieldLength;
    char filename[filenameLength];
};

ZipLocalFileHeader zipFile @ 0x00;

PNG Image Header

struct PngSignature {
    u8 sig[8];  // Should be: 89 50 4e 47 0d 0a 1a 0a
};

struct PngChunk {
    u32 length;
    char type[4];
    u8 data[length];
    u32 crc32;
};

PngSignature png @ 0x00;
PngChunk chunk @ 0x08;

Analysis Features

Entropy Analysis

1. Open file in ImHex
2. Navigate to Tools → Entropy
3. View entropy graph to identify compressed/encrypted sections
4. High entropy (>7.5) indicates encryption or compression

Statistics

1. Go to Tools → Statistics
2. View byte frequency distribution
3. Identify patterns in data distribution
4. Export statistics for further analysis

String Search

Ctrl+F to open Find dialog
- Search Type: Strings, Hex, Regex
- Case Sensitive: Toggle as needed
- Match Whole String: Enable for exact matches
- Regular Expression: Use regex patterns

Hashing

ImHex can calculate multiple hash types of selected regions:

1. Select bytes in hex view
2. Go to Tools → Hashing
3. View MD5, SHA1, SHA256, CRC32 values
4. Copy hash for comparison or database lookup

Bookmarks and Annotations

Creating Bookmarks

1. Right-click in hex view
2. Select Add Bookmark
3. Name the location
4. Navigate bookmarks in left sidebar

Annotations

Double-click byte to add note
Add commentary for analysis
Color-code important regions

Provider Types

Built-in Providers

Provider	Use Case
File	Local file access
Memory	Process memory analysis
Network	Remote data streaming
Disk	Raw disk sector access
Invalid	Memory-mapped files

Using Memory Provider

# Requires elevated privileges
sudo imhex --provider memory <pid>

Export and Reporting

Export Hex Data

1. Select region in hex view
2. Edit → Copy → Hex String
3. Choose format: raw hex, C array, Python bytes, etc.

Export Pattern Results

1. Open Tools → Export
2. Select format (binary, hex, text)
3. Save analyzed structure

Advanced Workflows

Malware Analysis Workflow

1. Open suspicious binary
2. Analyze entropy for obfuscation
3. Search for known magic bytes
4. Create pattern for detected format
5. Parse structures with pattern language
6. Annotate suspicious sections
7. Export analysis results

Firmware Extraction

1. Identify firmware file format via entropy
2. Locate file system boundaries
3. Create extraction pattern
4. Extract individual sections
5. Analyze extracted components
6. Document findings with bookmarks

Protocol Reverse Engineering

1. Open captured traffic dump
2. Search for common protocol headers
3. Identify field boundaries
4. Create structure pattern
5. Validate against multiple samples
6. Generate documentation

Tips and Best Practices

Efficient Analysis

• Use entropy view first to understand data distribution
• Create bookmarks at logical boundaries
• Build patterns incrementally, testing each section
• Use multiple tabs for comparing similar files
• Leverage statistics for anomaly detection

Pattern Language Tips

• Start with simple structures, build complexity
• Use enums for readable value interpretation
• Add comments for documentation
• Test patterns on multiple samples
• Validate offset calculations carefully

Performance Optimization

• Use memory provider for large files
• Apply filters to reduce displayed data
• Close unused tabs and windows
• Disable real-time analysis for very large files
• Consider using 64-bit ImHex for memory analysis

Common Issues and Solutions

Pattern Won’t Parse

• Check for syntax errors in pattern
• Ensure all braces and semicolons present
• Verify variable names and types
• Use pattern validation feature
• Check ImHex version compatibility

Performance Problems

• Reduce displayed range in hex view
• Disable live pattern evaluation
• Close analysis windows not in use
• Use memory mapping for large files
• Switch to binary mode for raw data

Memory Analysis Issues

• Ensure elevated privileges (sudo)
• Verify process ID is correct
• Check memory region permissions
• Use appropriate memory provider
• Monitor system resources

Resources and Further Learning

• Official Documentation: https://imhex.werwolv.net/
• Pattern Library: https://github.com/WerWolv/ImHex-Patterns
• GitHub Repository: https://github.com/WerWolv/ImHex
• Community Patterns: Share and discover patterns online
• Official Wiki: Comprehensive guides and examples

Version Information

Current stable: ImHex 1.34+ Cross-platform: Linux, macOS, Windows Architecture: x86_64, ARM64 Language: C++20 with ImGui License: GPL-3.0