x64dbg VS ImHex

If you want to also do dynamic analysis (debugging) you can use https://x64dbg.com.

It's also useful to know for reverse engineering. Similar to how you can hit F12 in your browser and start poking around a sites JavaScript, you can attach a debugger like x64dbg to a native running process and make changes to the program while it's running

Requirements: MPRESS packed Autohotkey executable, Detect it easy (Also known as DIE), x64dbg, and HxD!

Perhaps you’re interested in my brain child: https://github.com/x64dbg/x64dbg it’s a mess code-wise, but it’s definitely used in the real world 🤷‍♂️

x64dbg - Open source x64/x32 debugger for windows.

You are welcome to contribute to x64dbg, a user mode debugger for Windows. The codebase isn’t the most modern, but there is a branch with a CMake port and modernization is very welcome! Feel free to hit me up if you’re interested and need some pointers :)

x64dbg: A 32 bit and 64 bit program debugger and disassmbler for Windows

[1] https://youtu.be/pzM4o6qxssk [2] https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools [3] https://x64dbg.com [4] Depending on what language the .exe was compiled in a good - free - choice of decompiler framework may be Ghidra https://ghidra-sre.org or https://github.com/dnSpy/dnSpy , native executable vs .Net (managed runtime) executable. Also look into Frida https://frida.re/docs/examples/windows/

ImHex

“A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.”

I actually used it not too long ago to inspect why a mp4 file wasn’t valid. The pattern language that they have is quite nice and having sections of the hex highlighted and being able to see what structures they represent and what data was on those structures was very useful!

https://github.com/WerWolv/ImHex

Just one note: Please use UI scaling; it's near impossible to read on a 150% 4k screen (much less on 100%). Unfortunately, young eyes don't last forever.

The UI looks very much like ImHex (https://imhex.werwolv.net/) is this a coincidence, or is it the standard ImGui look and feel?

I wish ImHex had a decompiler for Z80 as well, but this is much better.

I didn't use RemedyBG or Tracy, but I did try ImHex (https://github.com/WerWolv/ImHex) and it loaded 12% of the CPU because everything is being repainted 60 times per second. Heck, it even has an option to limit the FPS, which solves the CPU load a bit, but at the same time results in sluggish input because the event handling is tied to the drawing frequency.

So yes, the experience was not good, and I don't see what these tools would lose by using a proper GUI. I don't want every utility to drain my laptop battery like a decent video game.

ImGui is great if you already have a loop where everything is unconditionally redrawn every frame, but otherwise it's a really odd choice for an end-user application.

I now use ImHex after looking for years for a good one. It has a pattern language to provide highlighting.

https://imhex.werwolv.net/

ImGui is brilliant. I can highly recommend this hex editor built using it: https://github.com/WerWolv/ImHex

If you want a true Hex Editor (or better, Hex IDE), I strongly suggest you to take a look ad ImHex [1].

[1]: https://github.com/WerWolv/ImHex

I'd also like to throw https://github.com/WerWolv/ImHex in the mix here.

Documentation for AoE2 graphics formats have been enhanced and there is now a pattern file that you can use in imHex to explore the SLP file structure

I’ve heard really good things about https://github.com/WerWolv/ImHex but haven’t gotten enough experience to say for sure. Modern, made for reversing, and includes hooks for a disassembler.