- https://github.com/0xeb/pyhiew/tree/main/bin/pyhiew - https://github.com/0xeb/pyhiew/tree/main/bin/pyhiew - https://0xeb.wordpress.com/2010/08/21/introducing-pyhiew/
It worked! I thought I was a genius. Now I'm amazed how I almost randomly got it right.
It's packaged for many Linux distros, and is on Homebrew
brew install ht
To disassemble, you press F6 and pick any of the detected formats for that file.HN discussion: https://news.ycombinator.com/item?id=2072899
And if you don't mind paying, there's also "Synalyze It", which allows you to build the pattern language via the GUI:
I tried it a few years ago as a free alternative to 010editor and it was a bit unstable. But I see it is under active development, so maybe the issues have been fixed.
Hiew (Hacker's view) - https://news.ycombinator.com/item?id=18898214 - Jan 2019 (1 comment)
(I tend to start with a standalone Python script which gets gradually customized over time. I don't even use a hex editor myself, and I just used xxd if I did really need hexdump for initial explorations. Of course I would comment that xxd output heavily in my editor, and that seems the best moment to use Hiew and clones.)
I like that font for binary files, it's more distinct than having a bunch of ? symbols for bytes 0-31.
The resulting glyph is the letter from the matching CTRL or ^ notation for that byte, but in a single character cell, and still distinct from a byte containing that letter.
So for instance, a NUL is value 0, which is CTRL+@ or ^@
But displaying ^@ screws up formatting, and displaying @ collides with byte value 64. Inverse video @ solves both, and doesn't need any special font. I do the same for DEL which is 127 displayed as inverse ?, but the ? is meaningful and adheres to the same rule because it's literally ^? not a placeholder for "no glyph" or "non-printing control byte"
Doesn't help you with configuring an editor but just describing a way to display those undisplayable bytes in a way that is actually meaningful & unambiguous and without caring what the font or even terminal type is. (ei: works the same in BASIC on a TRS-80 Model 100 or in bash on a xterm, or in c on windows, etc).
Here is an example of the font: https://int10h.org/oldschool-pc-fonts/fontlist/font?ibm_vga_...
But simply switching to that font in something like Konsole doesn't seem to be enough.
P.S. I still use it from time to time - it has a nice built-in assembler for x86/x86-x64.
[1] https://rizin.re
- Ghidra SRE (https://ghidra-sre.org/) from NSA
- https://x64dbg.com/ (spiritual successor of OllyDbg for Windows)
- https://github.com/eteran/edb-debugger (spiritual successor of OllyDbg for Linux)
- https://github.com/ReFirmLabs/binwalk
- https://github.com/kentavv/binary_viewer (spiritual successor of Cantor Dust)
- https://dogbolt.org/ (decompiler explorer)
You can even explore various histograms with `p=?` and `p==?` commands (they will print help for these).
Thank you!