Ever try to open a binary file in a text editor and see a word/punctuation salad? Since the binary is already compiled, traditional text editors are not made for that. You can add extensions to VSCode to view these files, but let’s see what hex editors you can install straight from your terminal on Ubuntu that is meant for the job. We will explore 4 different hex editors that will give you insight into the level of hexadecimal. You can gain more information about an application by looking into the hexadecimal. Many security researchers will look into malicious binaries this way. Sometimes giving them the piece of the puzzle that is needed.
For this read, the packages will all be available in the Ubuntu repositories, so there will be no worries about any source installations today. Today we will go over Hexedit, Ghex, Okteta, and Hexcurse. We will then look at some binary files in each editor, so you can see the look-and-feel, as well as some basic commands to get you started. We will also cover installation, to make sure you have no disconnects. Now let’s get out our computer science hoodies and nerd glasses with tape in the middle to blow the hex out of the water.
Hexedit
First up, we have Hexedit. The oldest commit we could find on GitHub was way back in November 2005. Making this application one of the oldest on this list. Meaning that Hexedit has some real maturity. The best place to obtain the source code is GitHub, which can be found here. All you need to do is install it in command line.
sudo apt install hexedit
Like many applications, but not all on this list, you can run the -h help option to see all the options.
hexedit -h
Nice and short and to the point. Making simplicity a virtue in the case. You can choose a project binary file of your own, or just pick something you have installed. Copy it and put it in a test location, that way you don’t break your favorite application. Going further still, you may want to clearly see important code patterns. To see that in color, all you need to do is run the color option before specifying the file.
hexedit --color your-binary-file
As you can see, all non-desirable information or zeros are colored red. You will really be able to see the raw code in a way you may never have before. So enjoy yourself, look at all kinds of files you never knew you could look at.
Ghex
Ghex the oldest commit we can find on GitLab was way back in August 2011. You can see the source code for yourself on GitHub here. As you can see, Ghex is written primarily in C. Made for the Gnome desktop environment, it will be right at home on the mainline Ubuntu flavor. In order to do this, we will use the apt package manager for Ubuntu/Debian as before.
sudo apt install ghex
As you can see, Ghex is a bit more of a graphical application than Hexedit. So you can start it in terminal with a file name to open it if you want, but you can easily just use the menu to find the file you wish to display in the editor. Similar to this, you can also look for help in the menu to find out anything you need to. That way, your experience using the software may be more pleasant.
You can open any file you like that has hexadecimal or binary to display. That way you can get an idea of what you can do with it. It is always a fun way to see a program you may have just built, in a way that you never have before. Once you decide what to select, you will see something like the following.
So here you can see the hexadecimal encoding and the binary on the bottom right, where ever the cursor is focused. You can literally look at it bit-by-bit if you like. You would love the default dark mode. Who wants to be blinded when looking at a screen for hours?
Okteta
Now we are coming to the brightest themed hex editor on this list. The oldest commit we could find for Okteta on GitLab is from November 2011. Okteta has a similar age to Ghex, both coming out in 2011. You can find the source code on GitHub here. As you can see, Okteta is written primarily in C++. Made for the KDE desktop environment, you may find it look most at home on Kubuntu. It is surprising that the application does not start with a “K” like everything else in the KDE ecosystem. To install Okteta is just a keyboard click or two away.
sudo apt install okteta
Much like Ghex you can open file with the GUI (Graphic User Interface). So you can just click on the application and it will open without a loaded page. Then you can click on File and then open your file. You will be able to choose it from your system. You can use a file you have for testing or a personal project. The default theme is rather blinding, but the layout allows for a different experience than Ghex. With a more rich menu and some other cool defaults. Okteta is a solid offering.
One good default feature is that there is no need to run a color option when starting Okteta. The zeros are all colored blue to help you identify the code that is actually doing something. Making Okteta great for usability is you are not a command line junky.
The panel offers a few different features to the right. You can set substitute bytes or set a script for the console. You can see there are a few other nice touches at the bottom, featuring the hex type and more.
Hexcurse
Last but not least, we bring you Hexcurse. Back to the terminal, as it is a semi-graphical environment. The oldest commit we can find on Hexcurse is from June 2013. You can find the source code on GitHub here. As you can see, Hexcurse is written primarily in C, with a touch of Shell. Meant to be used in a terminal environment. Hexcurse is simple and lightweight, making it very simple to use. Best of all, we can install it with ease, like everything else on this list.
sudo apt install hexcurse
As many times before, let’s call the help flag. However, you have to spell it out for this one. They really did keep the options simple, making Hexcurse easy to use.
hexcurse -help
To look at a file, the process is similar to Hexedit. All you have to do is run Hexcurse and supply the file you wish to look at.
hexcurse your-binary-file
Likewise, you can choose a project file you have going on or a system binary file. Just change “your-binary-file” to whatever the real filename is. You can also add the path to wherever you might want to edit the file. You don’t have to edit a file in your current working directory.
Bonus
We will go ahead and help you get your VSCode setup to work with hex files. This is about an extension not a full on editor. While it did not make the list, it is still worth mentioning. As you never know if you will need this Swiss Army knife of a trick. As many of us like to use VSCode, since it is widely used on most Linux distributions. You can find the source code on GitHub here. It’s great that you have the option of adding an extension to help you do the very same job as the previous hexadecimal editors. Just open your terminal and use the following command to install the Hex Editor extension like so.
code --install-extension ms-vscode.hexeditor
Now, when you click on a binary file you will be warned about opening it, but you will have nothing to fear. No word/punctuation salad is coming. Just click to open.
Next, you will be asked to choose what editor to use when opening the file. You will have your built-in editor to choose from and the Hex Editor to choose from at the least. You may have other useful tools like a database viewer as me. You can just go ahead and select the Hex Editor.
Once you select the Hex Editor, then you will be greeted with a similar sight to all the other editors. Binary to the left, hexadecimal front and center, and the decoded text to the right.
VSCode is not for everyone, nor is it a perfect choice for everyone. Like other jacks of all trades, VSCode may be a master of none. You cannot help but love the versatility of the editor. Leaving you with that, we hope that we really helped you find the Hex Editor for you. As you never know when you will need to look under the hood. Thanks for reading.
