hexpeek(1) General Commands Manual hexpeek(1) NAME hexpeek - edit, dump, pack, and diff binary files in hex and bits SYNOPSIS hexpeek [OPTIONS] INFILE0 [INFILE1] hexview [OPTIONS] INFILE0 [INFILE1] hexDump [OPTIONS] INFILE0 [INFILE1] hexpack [OPTIONS] INFILE0 [INFILE1] hexdiff [OPTIONS] INFILE0 [INFILE1] DESCRIPTION hexpeek (TM) is a binary editor designed for efficient operation on huge files, but works on any file. It is not plagued by size-related crashes, freezes, and glitches because it does not attempt to map files into its memory; instead, it operates on files directly to fulfill user commands. hexpeek has four main modes of operation: prompt, command, pack, and recov- ery. Prompt mode is entered by default, subject to OPTIONS. When invoked as hexview, hexDump, hexpack, or hexdiff, hexpeek runs as if given one of the flags -r, -dump, -pack, or -diff respectively. Except when specifically indicated otherwise, hexpeek input and output are in unprefixed hexadecimal. This allows the user to work in hexadecimal without needing to prefix every number with "0x". Thank you for trying hexpeek. Send your comments to hexpeek@hexpeek.com. OPTIONS Flags starting with "+" invert the respective flags with "-". -h Print usage text about commonly used options; then exit. -help Print more complete help text; then exit. -v Print short version string; then exit. -version Print long version string; then exit. -license Print license text; then exit. -d <FD> Treat <FD>, a _decimal_ integer, as an already-open file descriptor and use it as the next file. Functionality on non-seekable files is limited (see LIMITATIONS below). -r Open subsequent infiles read-only. -w Open subsequent infiles writeable. -W Like -w, but do not creat infiles that do not exist. +ik Disable insert and kill commands. -x <CMDS> Execute semicolon-delimited commands (see COMMANDS below). -dump Dump a whole single infile. Same as "-x 0:max". -pack Treat infile as a hexpeek dump and pack it back into the outfile as binary. For best results, run with the same op- tion flags with which the original dump was created. -diff Diff two files. Same as "-x '$0@0:max~$1@0:max'". -s <START> With -dump or -diff, start output at given file offset. -l <LEN> Like -s, but stop output after <LEN> octets are processed. -o <OUTFILE> Write output to the given file. [-|+]SET [ARG] Set the given setting (for all applicable display modes). SET may be one of: endian, hex, bits, rlen, slen, line, cols, group, margin, scalar, prefix, autoskip, diffskip, text, and ruler. These options accept the same arguments and have the same effect as the commands of the same names (see COMMANDS below). -b , -c , -g Synonyms of -bits , -cols , and -group respectively. -p Output data in plain mode, which is the equivalent of "-c 0 -g 0 -margin 0 +autoskip +diffskip +text +ruler". +lineterm Skip line breaks in output. -format <FMT> Specify group delimiters. This both controls print output and allows the delimiters to be silently ignored in data input. Default: "%_l? %_g", which prints a leading space before each group except the zeroth group (if margin > 0, a space will be printed as part of the margin separator). -unique Skip uniqueness check - assume all infiles are unique. See warning in LIMITATIONS. +tty Skip TTY check - assume standard streams are not TTYs. -pedantic Generate a user-level error if filezone information is un- specified or ambiguous (instead of auto-inferring what to do) or if a print or diff (except with ":max") attempts to read beyond end of file (instead of printing nothing). [-|+]strict Toggle strict failure mode, which, when enabled, causes hexpeek to fail for user-level errors (like a malformed command string). This mode is enabled by default when hex- peek is run non-interactively. -backup <DEPTH> Backup depth may be 0 (to disable), max (0x20), or any num- ber therebetween. The default depth is 8. -backup sync Aggressively sync backup to disk. -recover Prompt to revert operations recorded in backup files. -trace <FILE> Trace to the given file. -- Denote end of option flags. COMMANDS q[uit] Quit the program. stop Exit without unlinking backup files. h[elp] [TOPIC] Show general or specific helptext. files List open files with their paths (with C escapes for non-printable characters), writeability, lengths, and cur- rent offsets. reset [$FILE] Reset the current offset of FILE if specified, otherwise reset the current offsets of all open infiles. settings List the values of various settings. endian<b|l> Set big- (default) or little-endian mode. Little-endian mode is not compatible with zero group width. hex[l|u] Switch to hexadecimal display mode. The optional last char- acter may be used to set the case of hex numerals to lower (default) or upper. bits Switch to bits display mode. This affects file data only, not scalar (control) information. rlen <WIDTH> Set default read length for the current display mode. slen <WIDTH> Set search print length for the current display mode. If 0, print only address of search match. line <WIDTH> Set line width for the current display mode; 0 disables. cols <WIDTH> Set rlen, slen, and line. group <WIDTH> Set group width for the current display mode; 0 disables. This option controls how many octets are printed between spaces (or other delimiters specified by -format). margin <WIDTH> Set octet width of printed file offset; 0 disables; "full" sets to maximum available width (default). scalar <BASE> Interpret scalar input according to the given <BASE>. Valid arguments are 0x10 (default) and 0. If 0, scalar input are interpreted as decimal unless prefixed with "0x" (hex) or "0" (octal). This flag does not affect scalar output. [+]prefix Print scalars with a "0x" prefix (default off). [+]autoskip Toggle autoskip mode. If on (default when interactive), re- peated lines in dumps are replaced with "*". [+]diffskip Toggle diffskip mode. If on, identical lines in diffs are skipped. [+]text[=CODE] Toggle dump of text characters in a column to the right of print output. The optional argument controls the character encoding and should be ascii or ebcdic. Defaults on when interactive and line width is non-zero. [+]ruler Toggle octet ruler. Numeric [+][$FILE@][HEXOFF][,HEXLEN][+][SUBCOMMAND] [+][$FILE@][HEXOFF][:HEXLIM][+][SUBCOMMAND] ^--------filezone-------^ Execute a subcommand over a given filezone. If specified, FILE must be a numeric index; otherwise, file $0 will be used. HEXOFF may be used to specify an absolute file offset if positive, a relative offset from file end if negative, or the current offset if "@@" or not given. HEXLEN is an optional length argument to the subcommand. HEXLIM speci- fies a length of HEXLIM - HEXOFF, or may be "max". SUBCOMMAND may be one of: p, /, ~, r, i, k, their long forms, and off- set. If no subcommand is specified, an implicit print is done. If "+" precedes the filezone, file offset will be incremented before subcommand is run by the number of octets to be processed. If instead "+" follows, file offset will be incremented after subcommand is run by the number of octets processed. An empty line at the prompt is equivalent to "+", and may be used to page through a file. p[rint][v] , v Output data starting at file offset. If HEXLEN is specified, that many octets are read; otherwise, the default number of octets are read. The output includes a left margin with file offset information. When "p" is given explicitly, offset start is outputted before file data. Including "v" prints verbosely: each output line shows the file offset and data for just one octet with hexadecimal, decimal, octal, bits, high bit/low bit/bit count, and text formats shown side-by-side. If autoskip is enabled, repeated lines are replaced with a single "*". offset Seek to the filezone offset and print it. Useful in scripts. search <PATTERN> , /<PATTERN> Search for the argument data within the specified filezone (or to file end if unspecified). A valid PATTERN is either: (1) fully specified octets in hexadecimal or bits (depending on mode), any number of spaces between octets, and the "." character (which matches any value); or (2) a filezone of the form described above, in which case data from that zone is used as search input. If filezone length is unspecified, the default length of 1 is used. If the search succeeds, the file offset is set to the beginning of the first found match; unless "+" follows the filezone, in which case the file offset is set to immediately _after_ the first found match or to immediately _after_ the search area if there was no match. ~[ ][FILEZONE] Perform a diff of two filezones. If no argument is given and two files are open, the diff is done between the two files. If two octets at a given relative offset are the same, they are printed as underscores. If diffskip is enabled, identical lines are not printed. /~[ ][FILEZONE] Search for the next difference between two filezones. r[eplace ]<PATTERN> Replace octets in the filezone with the argument data. The argument is of the same form as for the search command, but the "." matching char- acter is not recognized. If HEXLEN is specified and is greater than the octet length of the input data, the data will be repeated to fill HEXLEN octets. i[nsert ]<PATTERN> Like replace, but expand file at file offset by number of octets to be written, thus preserving existing data. k[ill] , delete Remove the data in the specified filezone. If HEXLEN is unspecified, one octet will be removed. Note that a space is required between any numeric portion of the command and delete. ops Show operations available to be undone. For each operation the depth, operation number, and command string are printed. u[ndo] [DEPTH] Undo the number of operations specified by DEPTH (defaults to 1). EXAMPLES 0 From beginning of file, print default number of octets. 10,40 Print 40 octets starting at the 10th octet in the file. ,2p Print two octets starting at current file offset. 7:C/.1 Within domain starting at file offset 7 and ending at B in- clusively, search for the first octet the second nibble of which is 1. 0:100 r 00 Zero out the first 100 octets. 100 r 1122 Replace the 100th octet with value 11 and the 101st octet with value 22. -1r33 Replace the last octet in the file with the value 33. i 44 Insert one octet with value 44 before the current offset. -0i 5566 Append two octets to the end of file with values 55 and 66. k Remove one octet at the current file offset. 1:3k Remove the first and second octets of the file. 20:60 r @30,3 Replace the 40 octet chunk starting at 20 with the values located in 30:33 repeated. DEFAULTS Unless set on the command line, column width defaults to the greatest power of 2 number of octets that fit in an 80 character terminal. LIMITATIONS hexpeek requires (and attempts to enforce) that each infile refers to a unique file. Data corruption may result if the same file is opened as mul- tiple infiles during a hexpeek run. Functionality on non-seekable files is inherently limited because hexpeek operates on them with a one-way seek. Thus, you can not seek backwards and post-incrementation for reads is always in effect. Moreover, the current offset has no impact on write operations (a duplex connection is assumed). Finally, the backup function does not work with non-seekable files for ob- vious reasons. The insert and kill commands are inherently inefficient because they must move all the data after the point of insertion or deletion. Consider com- bining repeated insertions (or kills) into one large operation to limit the amount of time spent in file rearrangement. Maximum line, group, and search argument octet width are 0x10000. BACKUP AND RECOVERY When in write mode, unless backup depth is 0, hexpeek creates 2 hidden backup files with file extension hexpeek-backup. Before executing any writeable command, hexpeek writes information to a backup file which is sufficient to recover previous data file state in case of program crash or user error. When an error occurs, use the undo command to revert it; or use stop and then invoke 'hexpeek -recover'. Otherwise, on successful exit, hexpeek au- tomatically unlinks the backup files. A redo can be performed with the com- mand line history functionality (if built with support). VERSION hexpeek version 1.0.20200804 AUTHOR Copyright 2020 Michael Reilly. ALL WARRANTIES DISCLAIMED. hexpeek is a trademark of Michael Reilly. SEE ALSO https://www.hexpeek.com version 1.0.20200804 2020-08-04 hexpeek(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | COMMANDS | EXAMPLES | DEFAULTS | LIMITATIONS | BACKUP AND RECOVERY | VERSION | AUTHOR | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.FreeBSD.org/cgi/man.cgi?query=hexpeek&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>