This guide explains how to use the advanced pure-JavaScript hex editor in exhaustive detail. It covers file handling, navigation, editing, searching, analysis, binary structure parsing, file format explorers, steganography, comparison tools, timeline, and extensible plugins. Each section contains clear explanations, real-world scenarios, and example workflows. All functionality is implemented in vanilla JavaScript with no build process—what you see is what runs.
Opening Files:
Saving Files:
Scenario Example: You open a firmware image for analysis, edit a few configuration bytes, and save it back with the same filename for flashing onto hardware.
Display:
. in the
ASCII view.
Interacting:
Scenario Example: While reverse-engineering a save
file, you notice your character's health value in decimal is 100. In
hex, that is 64. You double-click the byte, change it
to FF, and save. When you reopen the game, your
character has maximum health.
Keyboard:
Virtualisation: Only the visible portion of the file is rendered. This allows smooth navigation even in multi-gigabyte files.
Overview Ruler: A slim bar on the right shows markers for bookmarks, ranges, search hits, and carved objects. Click to jump.
Scenario Example: You scroll through a 1 GB log file quickly using PageDown, with no lag, and click a red marker in the ruler to jump to an identified error string.
The inspector shows the current byte (or multi-byte selection) in multiple interpretations:
Scenario Example: Selecting four bytes in a binary
shows that they represent the floating-point number
3.14159 in little-endian. You confirm that this section
stores mathematical constants.
The entropy panel shows randomness (Shannon entropy) across the file:
Scenario Example: While inspecting a suspected malware binary, you see one section is high-entropy compared to the rest. This indicates packed or encrypted payloads.
Hex Search: Enter sequences like
DE AD BE EF.
ASCII Search: Enter plain text, e.g.,
password.
Matches are highlighted in the hex view and marked in the overview ruler.
Scenario Example: You search for PK in
a suspicious file, which reveals embedded ZIP archives at multiple
offsets.
Click Forensics on the toolbar to open a single modal containing a handful of “I just need answers” tools.
case.json,
evidence.json, and optional artefacts such as compare
buffer, diffs, IOCs, timeline results, rules hits, and struct diff
output.
Enter an offset and the tool will interpret the bytes using several common timestamp formats:
The Structures Wizard lets you define fields and apply templates for known formats:
If a file matches a known format, the editor auto-applies the template and populates a side panel with parsed values.
Scenario Example: Loading a PNG automatically parses its IHDR chunk and shows “Width: 1024, Height: 768, Bit depth: 8” in the structures panel.
Compare files to see changes:
Differences are colour-highlighted in hex and ASCII.
When a compare buffer is loaded, other tools can reuse it (for example the entropy change overlay and Struct Diff in the Forensics modal).
Scenario Example: You compare a clean EXE to a suspected infected EXE. The diff highlights injected shellcode at offset 0x401000.
Every edit is tracked:
Scenario Example: While patching a binary, you create a branch for each variant. One branch disables copy protection, another modifies level data. You can switch between them instantly.
Scans the file for embedded objects based on known signatures. Extracted objects are listed with thumbnails or previews.
Carved hits are also validated (where possible) to improve confidence and flag likely truncation or malformed headers.
Export: You can export individual hits, or use the
bulk export buttons. Export ZIP downloads
carved_objects.zip, a self-describing archive
containing:
png/, pdf/)
carve_results.json manifest describing all hits
(offset, length, type, confidence)
Scenario: In a memory dump, the carver finds hidden JPEGs. You preview them and discover screenshots of an exfiltrated desktop.
Displays live previews for recognised file types.
Scenario: You extract an embedded PDF from an email attachment. The preview shows its first page, revealing phishing instructions without opening it externally.
Parse and browse container formats such as ZIP, RIFF, MP4, and PDF.
Scenario: An APK file (ZIP) is loaded. The explorer
lists AndroidManifest.xml, icons, and resources. You
export the manifest for static analysis.
Extract metadata fields from common file types:
Scenario: A JPEG from a suspect's phone reveals GPS coordinates in its EXIF data, which you map to a location.
Extract human-readable strings, decode common encodings, and search with regex/YARA.
Scenario: A DLL reveals hardcoded domains and suspicious Base64-encoded payloads, pointing to malware command-and-control servers.
Steganography tools are accessed via the Steganography tab in the sidebar. This consolidates extraction and injection workflows in one place.
Specialised explorers for executables:
Scenario: A malicious Windows DLL shows imports of
VirtualAlloc and LoadLibrary, confirming
it injects shellcode.
You can add your own plugins. A plugin is simply a JavaScript file that registers a panel and analysis routine.
Scenario: You add a YARA plugin. When scanning a suspicious binary, the plugin automatically flags known malware signatures.