Frequently Asked Questions

Home Hex Edit Home Page

Features Complete Feature List

Button Testimonials

Screen Shots Screen Shots

Downloads Binary File Downloads

Discussion Forums


Bugs Known Bugs

 about  help  privacy   donate  

Answers to frequently asked questions about the Hex Edit binary file editor.

Q. What is a binary file?
Q. What is a binary file editor?
Q. How do I quickly jump forward in a file by 42 bytes?
Q. How do I quickly change the font size?
Q. I get the message "HexEdit has not been installed on this machine".
Q. When printing (in HexEdit 2.2 and earlier) the header and the first line of data get printed on top of each other.
Q. When printing (in HexEdit 2.5 and later) the header or footer is not printed.
Q. I get "The procedure entry point __lc_collate couldn't be located in MSVCRT.DLL".
Q. How is HexEdit like Developer Studio and MS Word?
Q. I don't trust using my credit card on the Internet.  Is there another way to pay?
Q. How do I perform a find and replace operation?
Q. Why can't I find the bytes I am looking for?
Q. Can you change or enter floating point values?
Q. How can I convert EBCDIC text to ASCII?
Q. Why does my macro slow down while it is running?
Q. I want to copy bytes from 2 different binary files alternately into a third binary file.
Q. Support for multiple monitors on Windows 98/2000/XP.
Q. How do I avoid the screen being cluttered with modeless dialogs?
Q. I don't know XML.  Is there an easier way to create templates?

Q. What is a binary file?

A. A binary file is a file the bytes of which may contain any of the 256 different possible binary values.  We usually distinguish a binary file as any file that is not a text file.  A text file is a file that contains only printable characters (usually in the form of words and numbers), plus certain control characters (carriage return, tab etc).

There are many types of binary files.  Executable files (.EXE, .DLL etc) are binary files.  Database files and even word processor documents are normally binary files.  To edit a binary file you need a binary file editor such as Hex Edit.  See the Hex Edit "Introduction to Binary Files" help topic for more information.

Q. What is a binary file editor?

A. To edit a text file you can use a "text editor" (or just "editor").  But most text editors normally do not allow you to edit binary files.   For this you need a binary file editor.

Q. How do I quickly jump forward in a file by 42 bytes?

A. The simple answer is press Ctrl+G, type "+42" and press Enter.  (This works for any value, 42 just being used as an example.)

This procedure invokes the Go To dialog (which is just the calculator in disguise).  The default value in the dialog is the current address, so by pressing "+" you invoke the add button and typing "42" you enter the 2nd operand to the addition.  Pressing Enter invokes the "GO" button which adds 42 to the current cursor location and then positions the cursor at the new location in the file.

You can perform subtraction, and even far more complicated address calculations this way too.  You can also record all calculator buttons in a keystroke macro if you need to perform the same calculations repeatedly.

Q. How do I quickly change the font size?

A. There are buttons to quickly increase and decrease the font size on the Standard Toolbar.  There is also a drop-down list for selecting the font size on the Format Toolbar.

If your mouse has a wheel you can also change the current font size by holding down the Ctrl key and moving the wheel.  This is similar Ctrl+Wheel behaviour (in MS Word and other programs) which changes the level of "zoom".  If you want to do this with the keyboard you can assign the "Font Increase" and "Font Decrease" commands to any keystroke you like using the Customize dialog.

Note that some fonts can only be displayed in certain sizes (or whole multiples of those sizes). This is true of the default HexEdit font (Courier).  However, vector fonts (including all TrueType fonts such as Courier New) can be adjusted to any possible size.

Q. When I try to run HexEdit I get the message "HexEdit has not been installed on this machine". 

A. If you copy hexedit.exe to a different computer and run it without running the setup program you will see this message.  To solve this problem simply install hexedit by running setup.exe from the distribution zip file.

This may also indicate that some hexedit files or registry entries have been corrupted.  In this case the solution is to uninstall HexEdit (using the "Add/Remove Programs" option in the Control Panel) and then reinstall.

It's possible, though very unlikely, that you may not be able to uninstall HexEdit if the uninstall information has been lost or corrupted.  In this case you have to uninstall manually.   (You will also have to do this if you just deleted all the hexedit files without uninstalling and you want to reinstall.)  To do this delete all the files in the directory where HexEdit was installed and delete all registry entries under HKEY_LOCAL_MACHINE\Software\ECSoftware using regedit.   If you are unfamiliar with regedit be very careful and follow the detailed instructions below:

1. From the Start menu choose Run and type "regedit" into the text box and hit Enter.

2. Expand "HKEY_LOCAL_MACHINE" in the tree view on the left by clicking the plus (+) sign.

3. Expand "Software" underneath that.

4. Click on "ECSoftware" underneath that so that it is selected - ie. has blue background (in default colour scheme).

5. Hit the Del key and click the "Yes" button to confirm deletion. (Make sure you only delete the "ECSoftware" entry.)

6. Close regedit.

You can now reinstall HexEdit.

Q. When printing (in HexEdit 2.2 and earlier), the header and the first line of data get printed on top of each other.

Q. When printing (in HexEdit 2.5 and later), the header or footer is not printed.

A. Like MSWord the header and footer are printed inside the margins.  If the top margin is too small or zero and you have a header then the top data line on the page will overlap it.  Similarly if the bottom margin is too small the bottom data line will overlap the footer.  In HexEdit 2.2 this resulted (with most printers) in the header or footer overwriting the data but has been addressed in 2.5.

In HexEdit 2.5 if the header (or footer) overlaps the data area then it is not printed at all.  This can be due to the top (or bottom) margin being too small.  But also note that in 2.5 you can position the header and footer vertically so it may be that the "From top:" (or "From bottom") value is too large.

To avoid this problem increases the size of the top (or bottom) margin, or in 2.5 reduce the "From top" (or "From bottom") value in the Printer page of the Options dialog.

Q. I have installed Hex Edit on NT 4 but when I run it I get an error message like "The procedure entry point __lc_collate couldn't be located in MSVCRT.DLL".

A  You don't have a recent enough version of MSVCRT.DLL (or whichever DLL is mentioned in the error message).  This may happen on NT even if you thought you installed the files but you don't have administrator rights.

To fix this problem install the required DLLs (see the Downloads page for how to obtain them) while logged in as administrator, or have your system administrator install them.  The following or later versions of the Microsoft DLLs are required:

MSVCP60.DLL   17 Jun 1998
MSVCRT.DLL   23 Apr 1999
MFC42.DLL   27 Apr 1999

Q. You say that HexEdit is like Developer Studio and MSWord but I cannot see the similarities.

A.. HexEdit is not especially like Visual Studio and Word but we have tried to keep it compatible when possible for several reasons.  We try to keep the behaviour the same unless there is an advantage in deviating it.  For example, most top-level menu names (File, Edit, View, Tools, Window, and Help) are present in these and many other Windows programs.  Further, menu items that have similarities are positioned in the same menu  (Edit/Find, Edit/Goto, Tools/Options, Tools/Customize etc).

For compatibility purposes HexEdit uses the same binary format on the clipboard that Visual Studio uses.  This means that you can cut and paste between HexEdit and the Visual Studio hex editor.

When the Visual Studio behaviour is not so good then we do not duplicate it.  For example, "undo" in the text editor was obviously designed as an "undo changes" with cursor movement etc later tacked on.  This has made it much more clumsy than HexEdit's undo -- for example, if you select some text and accidentally press a cursor key you cannot just undo to get back the selection.  It also means that there are bugs -- an example, that has been there for at least 5 years is easily demonstrated: open a file in the Visual Studio editor (make sure you start in Insert mode) then type a few characters, change to overtype mode and type a few more characters, now undo all your changes and note the incorrect result.

On the other hand HexEdit (starting in 2.5) now includes a bookmark facility modelled very closely on Visual Studio's bookmarks, since it works very well.  Bookmarks are attached to a file at a location; as the file is edited the bookmark location moves with the character it is attached to.  Actually HexEdit enhances this system in a few ways like keeping track of the bookmark modification and access time (ie. when a bookmark was last set or jumped to), adding persistent unnmaed bookmarks and allowing you to hide bookmarks.

Q. I don't trust using my credit card on the Internet.  Is there another way to pay?

A. There is an enormous amount of credit card fraud on the Internet, but oddly buying over the Internet using a credit card is usually very safe.  Most fraud comes from the use of credit card numbers obtained from a non-Internet source (such as restaurants etc) and used to buy products on the Internet.  Moreover, it is normally the vendor, not the customer (as long as they check their statement), and never the banks (despite how wonderful they make themselves sound), that loses out.

Note that all of our credit card transactions are handled by RegNow and Digital Candle.  They have a very high level of security in their credit card transactions including SSL.  They handle thousands of these transactions a day.

If you still don't want to pay by credit card you can send me a cheque or money order.  RegNow also has a pay by phone facility for a small fee (see their web site).

Q. How do I perform a find and replace operation?

A. In HexEdit 2.5 you can use the Replace page in the Find dialog.  This is invoked using the Edit/Replace menu item.

Versions prior to 2.5 (including the free version 2.0) have no find and replace command but it is easy to use a macro to do the same thing:
     - start macro recording by pressing F7 and search for the first occurrence of the hex bytes or characters you want to replace
     - type the new text to replace the search text and stop macro recording by pressing F7 again
     - run the macro repeatedly by pressing F8 or run it multiple times using the Multi-play option
Note: If you accidentally change something it's easy to fix it with the Undo command (Ctrl+Z).

Q. Why can't I find the bytes I am looking for?

A. There could be many reasons.  Here are some recommendations when searching:
     - double check the options used in the Find dialog (eg. you might have intended to do a hex search but instead searched for ASCII text)
     - try going to the top of the file (Ctrl+Home) and repeating the search (F3) - only the bytes from the cursor to the end of file are searched
     - rather than typing in values to find the next occurrence in the file, it is less error-prone to select the bytes and press Ctrl-F3
     - use case-insensitive text searches since it is easy to get the case of characters wrong (and it often turns up other useful info)
     - when searching for text make sure you haven't mistaken a lowercase-L for a 1, an O for a zero etc
     - if searching for a binary number check that you have the format and byte order correct (little- or big-endian)
     - if searching for text in a .DLL or .EXE file try a Unicode search as well as an ASCII search

Q. Can you change or enter floating point values?

A. You can enter a new floating point value in the fields of the Properties dialog.  Just type the new value into the "value" field and press Enter (or Esc to abort).  You can enter IEEE floating point values using the "IEEE" page or IBM floating point values using the "IBM FP" page.  You can also change the byte-order using the "Big-endian" check box and enter 32-bit or 64-bit values depending on the format selected.  You can also type the special value "Inf", "-Inf" and "NaN" when using IEEE floats (not supported by IBM floats).

The "Value" field may be disabled to prevent you from entering a value.  This will happen if the file is open in read-only mode or there are not enough bytes before the end of file to enter a floating point number.

Some of the other pages also support entering of values.  You can also enter a byte value in decimal, octal or binary (on the Character page), as well as 8, 16, 32 or 64 bit integers in decimal (on the Decimal page), and dates in several different formats (Date page).

Q. How can I convert EBCDIC text to ASCII?

A. There are several ways to do this depending on your exact requirements.  To convert a block of bytes in a file without changing the length of the file use the Convert EBCDIC -> ASCII menu item on the Operations menu.  Any invalid characters are converted to a zero byte.

To convert a block of text ensuring that all converted bytes are valid ASCII you can use the clipboard commands.  Select EBCDIC mode and cut or copy the text to the clipboard, then use the "Paste As ASCII" command on the Edit menu.   You can also just paste it into another program such as Word or NotePad.   Note that this will remove all bytes that are not valid EBCDIC display characters and any that do not have a corresponding or similar character in ASCII..

For a small amount of text you can use the Find Dialog or the Find Tool to convert between ASCII and EBCDIC.  Use the following procedure:
    - select hex mode and type the hex values of the EBCDIC text
    - select EBCDIC mode
    - select ASCI mode
    - select hex mode to display the corresponding ASCII values

Note that there are many different ways to convert between EBCDIC and ASCII.  If you are unhappy with how the conversion is done you may customize the conversion table.   The conversion table is read from a file called EBCDIC.TAB (if present) in the same directory as the HexEdit.exe.  This file should be exactly 256 bytes long and contain ASCII values or a zero byte for characters that cannot be converted.  This table is used for all EBCDIC to ASCII and ASCII to EBCDIC conversions, including all of the above.

Q. Why does my macro slow down while it is running?

A. Hex Edit macros typically run very fast, but due to the way Hex Edit stores information about the changes made to a file, as changes are made each subsequent change takes slightly longer.  This is not noticeable when editing manually but is evident to a small number of users who use a macro that modifies a large file and which is run a large number of times.  This is simply due to the fact that HexEdit was originally optimised for display speed, not speed of changes.

The technical reason is that whenever you add, delete or modify some bytes this is added to the stack of undo info, then a list is built of all the places that the current file comes from.  As the undo stack gets bigger this list takes longer and longer to rebuild after each change.  However, when you save the file to disk the undo info can be discarded (as the file you are editing is now the same as the file on disk) and file modifications are fast once more.

To avoid this effect the answer is to simply save the file to disk but this means you can then not undo any changes.  Note that macros that do not modify a file always run fast.

Q. I want to copy bytes from 2 different binary files alternately into a third binary file.   Is this possible?

A. Yes.  In fact it's fairly easy to do this and similar things with keystroke macros.

For example, to do what you want, open the 2 "source" binary files in HexEdit and create a new, empty "destination" file.  Move the cursor to the start of both source binary files and start macro recording using F7.  In the first file select the first byte using Shift+RightArrow and copy it to the clipboard (Ctrl+C) then move the cursor to the next byte with the Right Arrow key.  Now select the target binary file making sure that the cursor will be at the end (either click the title bar with the mouse so the current cursor position does not change or click anywhere in the window and press Ctrl+End to move to the end of the file).  Do the same using the second binary file.   Click on the title of the first binary file again and turn off macro recording (F7).

You can then replay this macro repeatedly using F8.  Use the multiplay feature with a very large number to do the whole file -- the macro will stop with an error when it reaches the end of one or both of the source files.

Q. I have 2 monitors on Windows 98/Windows 2000.  HexEdit does not seem to have any special support for them as you claim.

A. HexEdit does not take any unusual advantage of multiple monitors.  It simply behaves correctly in their presence, unlike most current Windows software, including most Microsoft products.  For example, Windows Explorer that ships with both Windows 98/ME and Windows 2000 does not refresh its "tree" folder view properly except on the primary monitor.

First HexEdit is aware of multiple monitors.  For example, if you have the main HexEdit window on one monitor and the Properties dialog, Find dialog and Calculator on another monitor then the next time you run HexEdit these positions will be restored correctly.  If HexEdit did not know about multiple monitors it would try to make sure that everything was visible in the primary monitor and mess up the positions you want.

A major problem that HexEdit handles is changed monitor positions and locations when it restores window positions.  Even version 1.0 of HexEdit handled this unlike even recently released software. (For example, it is quite easy to lose windows if you have removed, resized, or rearranged monitors since last running programs such as MS Word.)  HexEdit will detect if it is going to restore a window to a position outside the "virtual" display and move the window so it is at least half visible, and the title bar is made visible so you have the opportunity to drag the window.

Further, since monitors may not always be aligned in the virtual display or of the same resolution there may be invisible rectangular areas even within the virtual display area.  HexEdit does not restore windows into these invisible areas either.

There are some problems with HexEdit and multiple monitors due to problems with 3rd party libraries we use.  Sometimes dialog "tips" come up in the wrong place when a dialog is displayed on a non-primary monitor.  Also, bringing up a context menu then clicking outside it may cause HexEdit to crash it the monitor has negative screen coordinates.  For this reason it is strongly recommended that you do not have any monitors positioned above or to the left of the primary monitor.

To get technical: Before multiple monitor support was added to Windows the display was a simple rectangle with the origin at the top left corner.  Now there is a virtual display which is a rectangle that "contains" all the rectangles of the monitors in the system -- but the origin is still at the top left of the primary monitor (the one that everything happens on when you turn on your computer).   This means that negative coordinates can now represent a valid display location (a fact that causes problems for many programs).   It is also possible to have parts of the virtual display that do not map to any monitor if the monitors are not configured to align or are displaying at different resolutions.

Q. How do I stop the screen being cluttered with modeless dialogs?

A. There are several modeless dialogs which require screen space: the Properties dialog, the Calculator (or Go To dialog), the Find dialog and the Bookmarks dialog.  If you have a small screen with all these open then there is not much room for actually viewing the file.  This is made worse if you have a template "tree" view open for the file in a splitter window (although you can change this to use tabbed windows instead of a split one).

Note that these modeless dialogs are not "dockable" as in some other programs as this does not save any space and often wastes it.  Instead the dialogs remain on top of the main HexEdit window and try to get out of the way when the cursor is moved "underneath" them.  Also note that the Bookmarks dialog is resizeable so you can make it very narrow to just see the column with the names of the bookmarks.

The ideal solution for this problem is to have a 2nd monitor.  Then you can position all your modeless dialogs on the other monitor and avoid the problem.  HexEdit will remember the positions of the dialogs and restore them the next time you open it.  The positions will be restored correctly on any monitor.  Also, if your monitor setup (number of monitors, relative positions or resolutions) has changed HexEdit will not restore windows to inaccessible areas (unlike many other programs including MS ones).

Q. I don't know XML.  Is there an easier way to create templates?

A. HexEdit 2.5 contains a built-in template editing facility.  This facility should be regarded as "beta" as it has not been thoroughly tested and there are a few things to watch out for as mentioned below.  However, it is generally much easier than creating templates by writing the XML code directly.

You can turn the template editing on by double right clicking in the Display page of the Options dialog. Another way is to directly edit the registry entry that controls this using regedit by changing 
HKCU\Software\ECSoftware\HexEdit\DataFormat\Edit from 0 to 1.

Once editing is turned on you can right click any entry in the tree view which brings up options such as allowing to edit it as well as inserting, deleting etc.

You can also drag and drop items to move them around. This can be a big time-saver. Note that you can only drag into structs as they are the only items that can have multiple sub-items. You can also copy items instead of moving them using the Ctrl key while dragging. Also you can copy between templates (with 2 different types of files open) which is handy if 2 different formats share similar sub-elements.

One thing to watch out for when template editing is turned on is that it is very easy to drag a struct item into itself (if you select a struct then click it again and slightly move the mouse before you release the button). Many times I have inadvertently created a copy of a struct inside itself, which can be very confusing if you don't know what is happening.

The above problem will of course, be addressed in the next version when template editing is "released". I will also be adding a few other template editing features, such as the ability to parse C/C++ structs/classes. I welcome any ideas in this area.

---------- End of FAQ ----------
Back to Top