Hexter

A minimal terminal hex viewer supporting reading, writing and searching in files and processes.

Compiles and runs under

• Linux
• Windows (x86/x64).
• OsX may work too, but only the -file functionality.
• Android in Termux

1.11.2
Last changed: 07.08.2026

• Linux
  • Gcc
• Windows
  • msbuild

$ ./linuxBuild.sh -t app [-d|r] [-c] [-h]

$ mkdir build
$ gcc -o build/hexter -Wl,-z,relro,-z,now -D_FILE_OFFSET_BITS=64 -Ofast src/hexter.c src/Finder.c src/Printer.c src/ProcessHandlerLinux.c src/Writer.c src/utils/*.c

Use clang instead of gcc in Termux on Android.

$ winBuild.bat [/exe] [/m Release|Debug] [/b 32|64] [/rt] [/pdb] [/pts <toolset>] [/bt <path>] [/h]

This will run in a normal cmd.

The correct path to your build tools may be passed with the /bt parameter or just changed in the script winBuild.bat itself.

The PlatformToolset may be changed with the /pts option.

In a developer cmd you can also type:

$devcmd> msbuild Hexter.vcxproj /p:Configuration=<Release|Debug> /p:Platform=<x64|x86> [/p:PlatformToolset=<v142|v143|WindowsApplicationForDrivers10.0>]

Library currently is not thread due to some global state variables.

$ winBuild.bat /lib [/b 64] [/m Release] [/rt] [/pdb] [/pts <toolset>] [/bt a\path] [/?]

$ ./linuxBuild.sh -sh [-d|r] [-c] [-h]

If a "VCRUNTIMExxx.dll not found Error" occurs on the target system, statically including runtime libs is a solution.
This is done by using the /p:RunTimeLib=Debug|Release (msbuild) or [/rtl] (winBuild) flags.

It may be convenient to add Hexter to the context menu to be able to right-click a file and hexter it. In this scenario, you may use addBinShellCtxtMenuEntry.bat

$ addBinShellCtxtMenuEntry.bat /p "c:\Hexter.exe" /l "Open in Hexter"

$ ./hexter [options] -file a/file/name [options]
$ ./hexter [options] -pid xx [options] 

Optional Parameters:

• -file string A path to file.
• -pid uint32_t A process id.
• -s size_t Start offset in hex or dec. Default = 0.
• -e:size_t End offset. Default = file size. (File mode only.)
• -l size_t Length of the part to display in hex or dec. Default = 0x100.
• -b Force breaking, not continuous mode and print just one block.
• -pso Print start (real) offset.
• -hvs Size of the printed hex values/groups. Maybe 1, 2, 4, 8. Defaults to 1.
• -pp Print plain, not console styled output.
• -cs Size of a printed column. Only respected if -px, -pa are not combined with each other.
• Printing layouts:
  (Not all possible combinations are allowed!)
  • -po Print address column flag (1).
  • -px Print HEX column flag (2).
  • -pa Print ASCII column flag (4).
  • -pbs Print plain byte string flag (0x10).
  • -cm Set the desired column mask directly as the given number.
• File manipulation/examination.
  • -d Delete -l bytes from offset -s. (File mode only.) Pass -l 0 to delete from -s to file end.
  • -i* Insert hex byte sequence (destructive!). Where * is a format option. (File mode only.)
  • -o* Overwrite hex byte sequence (destructive!). Where * is a format option.
  • -f* Find hex byte sequence. Where * is a format option.
  • Format options:
    • h: plain bytes,
    • a: ascii/utf-8 text,
    • u: unicode (windows utf-16) text,
    • b: byte,
    • f: fill byte (will be inserted -l times),
    • w: word,
    • d: double word,
    • q: quad word.
      Except for the string types, all values have to be passed as hex values, omitting 0x.
  • Find options:
    • -ci: Case insensitive (for ascii search only).
    • -all: Find all occurrences.
    • -pfo: Print the exact found offset separately.
    • -mfc: Number of max findable occurrences from the start.
• -pid only:
  • -lpx List entire process memory layout.
  • -lpm List all process modules.
  • -lpt List all process threads.
  • -lph List all process heaps.
  • -lphb List all process heaps and its blocks.
  • -lrp List all running processes. Pass any pid or 0 to get it running.
• -h Print this.

Either use -file or -pid, not both. The program runs in continuous mode by default, expect for the -i, -o and -d option, or if the -b option is set.
Step through the file by pressing ENTER.
Quit with "q".
If searching something in continuous mode, type "n" to find next occurrence.
The length value will be padded to fit a block size in continuous mode.

files
Print 100 bytes from offset 20 in hex only style.

$ ./hexter -file a/file/name -s 20 -l 100 -x

Insert bytes at offset 0x20 with value dead0bea

$ ./hexter -file a/file/name -s 0x20 -ih dead0bea

Overwrite dword at offset 0x20 with 0xEA0BADDE

$ ./hexter -file a/file/name -s 0x20 -od EA0BADDE

Find ascii string "PE"

$ ./hexter -file a/file/name -fa PE

Delete 16 bytes from offset 16

$ ./hexter -file a/file/name -d -s 16 -l 16

Create file with 8 bytes

$ ./hexter -file a/file/name -ih 0102030405060708
$ ./hexter -file a/file/name -ih "\x01 \x02 \x03 \x04-\x05 \x06 \x07 \x08"

processes
Print my process (0) and a list of its modules

$ ./hexter -pid 0 -lpm

Print a list of running processes.

$ ./hexter -pid 0 -lrp

Published under GNU GENERAL PUBLIC LICENSE.