↑↑ Home ↑ Hardware ↑ Updateware ↑ Ebuilds  

Advanced search in hexedit

There are many hexadecimal binary editors around, but for almost all the byte is the smallest element. When designing and debugging hardware, it is usually easier to set a few unused bits rather than inserting whole words into a data stream, so you want to be able to search data at the bit level for analysis. With that in mind, I wrote a patch for a widespread hexadecimal editor, Pascal Rigaux's hexedit, to allow searching for values of specific bits and at non-byte alignments.

Usage and features

The following is also described concisely in the manual page, which I have also patched. This page presents slightly more verbose documentation.

Search mask: When searching for a string of hexadecimal digits, you can append a colon ":" and a bit mask, which has to have the same length as the search pattern. The mask is AND combined with the pattern and the data, so that only bits set in the mask are compared. For example, the following search:

80:80

matches only bytes which have the most significant bit set. As a simple special case, it is now also possible to search for an odd number of hexadecimal digits, a task which was already on the author's to do list. This does not require an explicit mask. The trailing digit is required to match the high four bits of its byte.

Alignment: If you want to search not at every byte position, but at a different alignment, you can do so by appending the "@" character followed by an alignment after the pattern and optional mask. If the alignment is a plain number, it is interpreted as a multiple of bytes aligned relative to the start of a file. If it is prepended with a plus sign, it is taken relative to the current cursor position. If the alignment is ".4", ".2" or ".1", it is taken as a bit alignment. The pattern is shifted by multiples of the given number of bits when a match is attempted. Here are some examples:

3412@2
F80:FFC@.1
!000000:F00000@+3

The first expression searches for 0x1234 in a file containing little-endian 16-bit values. The second searches a bit stream for five set bits followed by five zero bits. The third can be used to search a WAV file with 24-bit big-endian samples for samples that exceed 1/16 the maximum value, after the header has been skipped manually. It already demonstrates negation of the match criterion:

Non-matches: If the search pattern is prepended by an exclamation point "!", values not matching the pattern are searched for.

Download the patch

If you are going to compile hexedit manually, you can download the patch here.

If you use the Gentoo Linux distribution, you can alternatively download an ebuild incorporating the patch. See here for brief instructions on how to create the necessary portage overlay.

If you use the Arch Linux distribution, you can download a tarball containing a PKGBUILD and the patch. This page on the Arch Linux Wiki describes how to build and install PKGBUILDS.