Your hex editor should color-code bytes

(simonomi.dev)

193 points | by tobr 2 days ago

28 comments

  • dspillett 3 hours ago
    Everything should try do some basic syntax highlighting IMO. Not too much, or it just becomes a sea of formatting that doesn't help at all. It is surprising how much difference just a little splash of colour can make if it isn't overdone. If possible, always include configuration options for the user though, so those with colour-blindness issues can tweak things to their needs, those who are just fussy can make the output fit with their finely adjusted system-wide colour schemes¹, and even better, where you can, allow bold/italic/other as well as colours so that those who barely see colour at all can play too.

    Of course none of this helps those using screen-readers and other tech, so make sure that all your fancy colouring & such is additive so if it is all “lost” no meaning is absolutely lost with it.

    --------

    [1] Some people can be very vocal about this, more so than if highlighting isn't possible at all. If you give any output formatting they'll expect you to match, or be able to be made to match, their preferred style.

    • finaard 1 hour ago
      I'd recommend for every developer to get one or more colourblind friends. I have some, and regularly send them screenshots of what I'm working on to get feedback what they can see and what they can read/can't read.

      They've been absolutely invaluable for making sure their kind of people can't use my apps properly.

      • gortok 1 hour ago
        8% of the male population has some form of colorblindness (for women it’s around 0.5%). I have deuteranomaly colorblindness. If you search for images on the internet related to that type of colorblindness you’ll find representations of how we see color and how we see the world.

        It is not a fun condition to have, and leads to lots of problems in my everyday life. This blog post accidentally accentuated that issue, since the colors are (to what I can understand) very similar looking to me as a colorblind person.

        1 in 12 men and 1 in 200 women go through the same sorts of experiences, and it’s worth it, if you aren’t color deficient, to try out some of the colorblindness sites and see the world as we do.

        https://www.colourblindawareness.org/colour-blindness/colour...

        • gsich 50 minutes ago
          >1 in 12 men and 1 in 200 women go through the same sorts of experiences, and it’s worth it, if you aren’t color

          Not the same, it's a gradient.

      • aa-jv 11 minutes ago
        For sure, but if you don't have any friends, don't discount the value of using tools such as CoBlis:

        https://www.color-blindness.com/coblis-color-blindness-simul...

        .. to get an idea of the impact of your UI design on color-limited folks out there ..

        I used this a few times to great effect, it was very revealing to see that my carefully selected teals and ambers were incomprehensible to some folks I really wanted to use my apps .. didn't take much iteration to come to a happy palette though, just needed a bit of care.

    • PunchyHamster 1 hour ago
      As long as you just give people list of settings for colors, they can pick as much color or monochrome as they want.

      So by all means "color everything", people have different opinions on what they want colored so give them option

    • cubefox 36 minutes ago
      > Everything should try do some basic syntax highlighting IMO.

      Interesting idea. So even syntax–highlighting natural language. Grammar highlighting, as it were. Prepositions, verbs, question marks, etc. An LLM could do it. Would it actually improve readability though? Seems likely!

      • BigTTYGothGF 33 minutes ago
        I think that's a good idea, altho you can probably get away with good old NLP to do it.
        • diydsp 10 minutes ago
          Were in an era where virtually all sw could have an mcp intf to do anything...not even just color.
  • cuechan 2 hours ago
    For anyone who regularly has to look at/analyze binary files, i highly recommend ImHex [1].

    Its a hex editor built with imgui and has a lot of built in tools. Imo the best feature is the data structure editor. You can write a data type definition similar to C and it overlays it on the hexdump and parses it in a structured way while you type.

    It also has a node based editor.

    1: https://github.com/WerWolv/ImHex

    • altairprime 58 minutes ago
      Does it do color highlighting by value of hex bytes, though?
    • sandos 42 minutes ago
      But does it have colors!?!??!
  • NooneAtAll3 2 hours ago
    Why did author decide that best way to demonstrate his idea would be by cutting contrast in half?

    color-coding might be a great solution, but you don't really know beforehand which byte values are important. Manually selecting C0 to make it stand out it just ctrl+f with extra steps. (But I wouldn't mind something like "color 00 separate from ascii separate from the rest)

    • seszett 2 hours ago
      > Manually selecting C0 to make it stand out

      That's not what they did, actually. C0 is the only byte in there that's above 3F or so, and it's far from it. Hence the very different colour, and the lack of contrast between the colours of the other bytes.

  • whizzter 5 minutes ago
    Anyone tried using Kaitai descriptions? It seems like a fairly flexible system that would be an excellent starting point for a hex-editor that wants to add good higher level coloring (and perhaps even editing).
  • Someone 43 minutes ago
    The first example is “go ahead, try to find the single C0 in these bytes” and then argues one should highlight C0 bytes.

    If that’s true, how does the tool know I will be looking for C0 bytes and not for 03, D3, etc? The logical conclusion of that would be that the hex editor should uniquely color code every byte. And following the other examples even that’s not enough.

    The proposed solution is to create groups of byte values that each get their unique color. I think that helps, but we can do better: add a search feature. That tells your editor what you are looking for. Once you enter a search string, it can highlight all hits.

    Yes, “colorful output in a hexdump is useful for the same reason that syntax highlighting for code is useful”, but do you know what syntax highlighting needs? Knowledge of the expected content of a file. Without that, a hex editor at best can guess at how to color-code stuff.

    IMO, if you want to add syntax coloring to a hex editor, give it pluggable syntax coloring and heuristics for deciding which one to use when.

    While at it, also let those plugins control where to break lines, whether to show hex at all (why show it at all if a file has a few paragraphs of English text or an array of IEEE doubles?), etc.

    Those plug-ins will make errors and sometimes, users will want to see all byte values, so you’ll need a way for the user to override them.

    • Antibabelic 18 minutes ago
      I don't think that's quite the point that example was intended to illustrate. The idea is not the you're looking for C0 bytes or any other kinds of bytes in particular, but rather that it's easier to fish out unique and interesting information in a sea of noise when you have color-coded bytes: like the fact that there's a conspicuous lonely C0 or some other value or series of values that stand out.
      • bombcar 9 minutes ago
        Exactly - though the writing style buries the lede until the end; the recommendation is to have at least a different color for each of the first nibbles (e.g, 0x is one color, 1x another). As a minimum that makes some outliers pop out. He then has other recommendations like highlighting the ASCII range, etc.

        As a note, the some up there is load-bearing - color may lull you into complacency where the difference between 01 and 0F is major and important but not highlighted. More complicated regex built color tools designed to highlight "anomalies" could be developed but then you need to define what anomalies are (patters, places where a pattern changes, etc).

  • roelschroeven 1 hour ago
    When you're going to color-code bytes in a hex dump, I would expect each ASCII character in the right column to have the same color as the hex byte in the left column, making it easier to pair them. I wonder why that wasn't done here.
  • delta_p_delta_x 2 hours ago

      > Your hex editor should colour-code bytes so it is easier for users to distinguish patterns
      > Article is fully in lowercase, which makes it harder for readers to make out sentences and the flow of the article
      > mfw the irony
    • gblargg 1 hour ago
      The text smashed up to the left border doesn't help either.
  • fleebee 27 minutes ago
    > having more colors makes it possible to recognize more complex patterns

    The implicit cost here is that the simple patterns become harder to recognize when every byte is only subtly differently colored. Rather than give everything a different color, I'd rather have the important stuff highlighted.

    In the comparisons given, I think hexyl's highlighting scheme is significantly more useful.

  • orphea 1 hour ago
    I get the idea but those specific examples are awful - not enough contrast.
  • ChrisRR 1 hour ago
    What a bad way to illustrate your point by using such similar looking pastel colours
    • altairprime 55 minutes ago
      Ironically, my complaint about the article was that the author apparently only uses typical human vision ranges here, rather than mapping 00..FFh onto an OKlab gradient of hue 0..359° that rewards those few of us with impeccable color fidelity with even better highlighting than most can see :) No doubt there’s value in contentful highlighting but I’d rather just have a straight hue translation on the circle at a fixed luminosity. There’s only 256 hues to discern, after all! And what a pleasure it would be to learn to read hex code by hue alone :D
  • nticompass 1 hour ago
    I used to use wxHexEditor and that had a feature where I could select a section of the file and highlight it in a color. When I was working to decode a certain file format, I used that to color-code different sections of the file and it was super useful. Those color-codes were stored in a separate file so you could load them back in.
  • bandrami 4 hours ago
    Emacs's hexl-mode does this, incidentally, though annoyingly by default it makes all faces the same color. I never understood why it defines the faces but then doesn't customize them.
    • TeMPOraL 14 minutes ago
      What exactly does it do? I'm looking at hexl-mode sources in my Emacs, and I see it defining only two faces - hexl-address-region and hexl-ascii-region.
  • Archelaos 3 hours ago
    This article made me think how I could use similar techinques to colour code the data in database tables. Has anyone here tried that and has some recommendations where to start, etc.?
  • kokakiwi 2 hours ago
    ImHex (https://imhex.werwolv.net/) is also a really nice Hex editor with tons of plugins (patterns, file support, etc.) and even an embedded language for adding more patterns easily
  • psychoslave 3 hours ago
    That said, even colored these dumps still feels unappealing to me — so yes this is admittedly subjective gut jumping in the conversation. I get that occult form can also be an attractive force.

    The post put on the table an interesting point about how to improve the presentation layer to fit what’s human cognition is good at spotting (in general, or at least for the expected audience with some training). And it does start proposing something with these color schemes. But isn’t it kind of missing the forest for the tree? Actually why do we even have rendering with [012345678ABCDEF], when a specific set of (colored/imaged?) glyphs would be able to make more obvious what’s on the table? Or even beyond the hexadecimal grouping, wouldn’t be more relevant to render something "intuitively" far more easy to grap without several layer of internalized interpretation through acculturation?

    • GuB-42 3 hours ago
      I can't think of anything better than a hex dump for representing raw binary data. I don't mean that there are no others, equally good representations, but hex dumps win because of familiarity.

      Of course, if you know about the format, there are better ways, but it goes beyond the scope of a hex editor, though the most advanced ones support things like template files and can display structured data, disassembly, etc...

    • q3k 2 hours ago
      > Actually why do we even have rendering with [012345678ABCDEF], when a specific set of (colored/imaged?) glyphs would be able to make more obvious what’s on the table?

      Most of us have internalized the relationship between digits in [0-9] for a very long time. Adding 6 more glyphs after that is quite easy (and they're also somewhat well known in the world), and after a while you stop even thinking about the glyphs consciously anyway. A hex 'C' intuitively means to me '4 from the end'. A hex 'F' intuitively means to me 'all 4 bits are set to 1'. I don't see any advantage to switching to a different glyph set for this base, other than disruption for disruption's sake.

      > Or even beyond the hexadecimal grouping, wouldn’t be more relevant to render something "intuitively" far more easy to grap without several layer of internalized interpretation through acculturation?

      Modern computers deal with 8-bit bytes, and their word sizes are a multiple of bytes - unless you're dealing with bit-packed data, which is comparatively rare (closest is bit twiddling of MMIO registers, which is when you sometimes switch to binary; although for a 4-bit hex nibble you can still learn arbitrary combinations of bits on/off into its value).

      This means you can group 8 bits into 1 digits of 8 bits as one glyph (alphabet too large to be useful), 2 digits of 4 (hex), 4 digits of 2 (alphabet too small to give a benefit over binary) and 8 digits of 1 (binary). Hex just works really well as a practical middle ground.

      Back when computers used 12 bit words (PDP-8 and friends) octal (4 digits of 3 bits represented in the 0-7 alphabet) was more popular.

      • js8 1 hour ago
        I thought about a similar concept for fun - each hex digit was replaced by 4x4 pixel matrix, where amount of pixels roughly corresponded to the value. So dot for 0, two dots for 1, checkerboard for 8 etc.

        Then byte was represented as 16x16 matrix where each 4x4 area had the lower digit pattern, and these were arranged in the shape of the higher digit.

        But at the end of the day, it wasn't really more readable.

  • red_admiral 1 hour ago
    My hex editor should let me turn syntax highlighting on and off; follow my personal color theme (and not produce light gray on white in the terminal); and let me highlight specific things I'm searching for like OD OA or FF FE.
  • js8 4 hours ago
    I think semantic coloring (based on structure) is more useful. Also (can't help as someone working with z/OS), if you really want to make hex output readable, I recommend using big-endian machine.
  • PunchyHamster 1 hour ago
    I wonder how hard it would be to color code repeating sequences
  • greatgib 2 hours ago
    To me the random colors at each byte is messing up with my brain making it hard to fast identify C0 or any other value that I could more easily identify in all black.

    But color would be nice more based on the bytes logic.

    Eventually the 00 in a shaded grey instead of black, and in best case scenario by logic unit based on your protocol. And worst case scenario by groups of words or so.

  • azalemeth 3 hours ago
    I really like hexyl [1], which does this by default.

    https://github.com/sharkdp/hexyl

    • kqr 3 hours ago
      The author uses hexyl as an example of trying, but not doing it right.
  • xyx0826 3 hours ago
    If you analyze binary files often, I highly recommend binvis - http://binvis.io/. It creates a colored minimap for files it loads and has two available arrangements. Pixel color is based on range of bytes, eg ASCII/null bytes/FF bytes. Besides, it’s a pretty basic hex viewer that runs in your browser. The minimap is extremely powerful for identifying interesting areas and patterns in unknown data.
    • pratyahava 3 hours ago
      > it’s a pretty basic hex viewer that runs in your browser

      excuse me? "basic" and "runs in your browser" together sound very contradictory to me. while doing things i actually feel (yes, emotionally) much better when there is no browser open on my machine, but only text editors, vcs gui and file managers, and terminals of course. and sometimes i reject an idea to start a browser just thinking how much ram it will take (ha, what a progress we have done - one github issue tab, with text only and no images, takes 180mb of ram).

      • franga2000 3 hours ago
        It's basic bause it does like two things. It's not advanced or complex. HN is also a basic forum, even though it runs in a browser.
  • asibahi 4 hours ago
    When I read this article a few days ago it inspired me to create my own hex viewer : https://ar-ms.me/thoughts/3sl-a-sweet-hex-utility/

    The cool thing about it imo (outside of colors) is a `--windows` flag. Which separates the hex view into partitions: so `-w 2:-3:5` shows the first two bytes on a line, then skips three bytes, then shows the next 5 bytes on a line, then the rest of the file. Easy to use combined with a terminal's up arrow.

  • a_t48 4 hours ago
    I've started doing this with hashes in a CLI I'm working on. For slow prints, it's somewhat helpful https://asciinema.org/a/aD38Pk88CZgSZqtq but for debug dumps with many many hashes it really helps readability and tracking hashes across lines.
  • adv_zxy 2 hours ago
    radare2 also has excellent hex viewing/editing support, if one manages to grok the usage of it.
  • 7bit 2 hours ago
    > it’s much easier to pick out the unique byte when it’s a different color! human brains are really good at spotting visual patterns—given the right format

    Don't really see the advantage. Unique bytes have no unique meaning across data types.

    The only good syntax highlight to me is 00 and perhaps FF. But that's my opinion of course.

    Anything else that has no direct relation to what you're looking at is meaningless.

    • masklinn 1 hour ago
      > The only good syntax highlight to me is 00 and perhaps FF. But that's my opinion of course.

      Would probably make the most sense to have various ranges you can enable depending on what you’re looking for (or to look for patterns) e.g. for single byte coloration I could see

      - nul

      - printable / non-printable ascii

      - non-ascii

      - UTF8 leading / continuation

      - separators

      - start/end pairs (both printable and non printable)

    • gblargg 2 hours ago
      It would be interesting to do a heat map coloring based on frequency of that value.
  • ralferoo 2 hours ago
    I actually stopped reading after the intro because I fundamentally disagreed with its premise. The "find the C0" took me about 1/4 second with uncoloured. Looking at the coloured took my eyes about 3 seconds to recover from the colour overload, then I was scanning down and found the colours so distracting with the constant switching between orange, pink and yellows than it took me a total of about 5 seconds to scan down as far as the blue C0. Maybe if it was all uncoloured and blue just for that, I might have actually noticed it looking different earlier.

    It's been a while since I used hexedit on Linux, but I think that highlighted search results in reverse colours, just like less does for text search. Personally, I'd prefer that to colours.

  • samzong_ 4 hours ago
    [dead]