hexedit – view and edit files in hexadecimal or in ASCII
在输出中显示颜色，并且每行仅显示 16 个字节：
# hexedit --color --linelength 16 /path/to/file
hexedit [-s | --sector] [-m | --maximize] [-l<n> | --linelength <n>] [-h | --help] [filename]
hexedit shows a file both in ASCII and in hexadecimal. The file can be a device as the file is read a piece at a time. You can modify the file and search through it.
-l<n>, –linelength <n>
明确指定每行显示 <n> 字节。
Right: next character
Left: previous character
Down: next line
Up: previous line
Home: beginning of line
End: end of line
PUp: page forward
PDown: page backward
F3: load file
Ctrl-X: save and exit
Ctrl-C: exit without saving
Return: go to
Backspace: undo previous character
Ctrl-U: undo all
Ctrl-S: search forward
Ctrl-R: search backward
Esc-Y: paste into a file
COMMANDS (full and detailed)
o Ctrl+F, Ctrl+B, Ctrl+N, Ctrl+P – move the cursor.
o Ctrl+Right-Arrow, Ctrl+Left-Arrow, Ctrl+Down-Arrow, Ctrl+Up-Arrow – move n times the cursor.
o Esc+Right-Arrow, Esc+Left-Arrow, Esc+Down-Arrow, Esc+Up-Arrow – move n times the cursor.
o Esc+F, Esc+B, Esc+N, Esc+P – move n times the cursor.
o Home, Ctrl+A – go the beginning of the line.
o End, Ctrl+E – go to the end of the line.
o Page up, Esc+V, F5 – go up in the file by one page.
o Page down, Ctrl+V, F6 – go down in the file by one page.
o <, Esc+<, Esc+Home – go to the beginning of the file.
o >, Esc+>, Esc+End – go to the end of the file (for regular files that have a size).
o Ctrl+Z – suspend hexedit.
o Ctrl+U, Ctrl+_, Ctrl+/ – undo all (forget the modifications).
o Ctrl+Q – read next input character and insert it (this is useful for inserting control characters and bound keys).
o Tab, Ctrl+T – toggle between ASCII and hexadecimal.
o /, Ctrl+S – search forward (in ASCII or in hexadecimal, use TAB to change).
o Ctrl+R – search backward.
o Ctrl+G, F4 – go to a position in the file.
o Return – go to a sector in the file if –sector is used, otherwise go to a position in the file.
o Esc+L – display the page starting at the current cursor position.
o F2, Ctrl+W – save the modifications.
o F1, Esc+H – help (show the man page).
o Ctrl+O, F3 – open another file
o Ctrl+L – redisplay (refresh) the display (useful when your terminal screws up).
o Backspace, Ctrl+H – undo the modifications made on the previous byte.
o Esc+Ctrl+H – undo the modifications made on the previous bytes.
o Ctrl+Space, F9 – set mark where cursor is.
o Esc+W, Delete, F7 – copy selected region.
o Ctrl+Y, Insert, F8 – paste (yank) previously copied region.
o Esc+Y, F11 – save previously copied region to a file.
o Esc+I, F12 – fill the selection with a string
o Esc+T – truncate the file at the current location
o Ctrl+C – unconditional quit (without saving).
o F10, Ctrl+X – quit.
While in –sector mode, it shows the sector the cursor is in.
The modifications are shown in bold until they are saved. The modeline indicates whether you have modified the file or not.
When editing in hexadecimal, only 0,1,…,9, a,b,…,f, A,B,…F are legal. Other keys are unbound. The first time you hit an unbound key, the help pops up. It won’t pop again unless you call the help directly (with F1).
When editing in ascii, you can find it difficult to enter characters like / which are bound to a function. The solution is to use the quoted insert function Ctrl+Q, the key after the quoted insert function is not processed by hexedit (like emacs’ quoted-insert, or like the \ character in C).
The search in hexadecimal is a bit confusing. You must give a hexadecimal string with an even number of characters. The search can then be done byte by byte. If you want to search a long number (eg: a 32 bit number), you must know the internal representation of that number (little/big endian problem) and give it the way it is in memory. For example, on an Intel processor (little endian), you must swap every bytes: 0x12345678 is written 0x78563412 in memory and that’s the string you must give to the search engine.
Before searching you are asked if you want to save the changes, if the file is edited.
Selecting, copying, pasting, filling
The code is not tuned for huge filling as it keeps the modifications in memory until you save them. That’s why hexedit will warn you if you try to fill in a big block.
Be aware that the copied area contains the modifications done at the time of the copy. But if you undo the modifications, it does not change the content of the copy buffer. It seems obvious but it’s worth saying.
od(1), hdump(1), hexdump(1), bpe(1), hexed(1), beav(1).
I have an example where the display is completely screwed up. It seems to be a bug in ncurses (or maybe in xterm and rxvt)?? Don’t know if it’s me using ncurses badly or not… It seems to happen when hexedit leaves only one space at the end of the lines… If anyone has a (or the) solution, please tell me!
If you have any problem with the program (even a small one), please do report it to me. Remarks of any kind are also welcome.
- man 1 hexedit, Version 1.4.2-5