Understanding the hex editor
Bytes on the left, ASCII on the right, offsets up top.
Why every binary tool looks the same, how file magic numbers work, and the editing rules that keep you out of trouble.
The three-column layout.
Every hex editor — from DOS Norton Commander to modern Hex Fiend — uses the same layout. Left column: byte offset from file start, usually in hex (00000000, 00000010, ...). Middle column: 16 bytes per row, each as two hex digits. Right column: the same 16 bytes rendered as ASCII, with dots for non-printable values. The format is so universal because it packs maximum information into a fixed-width view; cursor position in any column maps to a single byte.
Magic numbers.
The first few bytes of a file usually identify its format. PNG: 89 50 4E 47 0D 0A 1A 0A. JPEG: FF D8 FF. PDF: 25 50 44 46 ("%PDF"). ZIP: 50 4B 03 04 ("PK"). Gzip: 1F 8B. ELF: 7F 45 4C 46 ("\x7fELF"). Mach-O: CA FE BA BE. The Unix file command works by checking these. When you see a binary and don't know what it is, the first 16 bytes are almost always enough to tell.
Endianness lives here.
A 32-bit integer 1 stored little-endian: 01 00 00 00. Big-endian: 00 00 00 01. Most modern CPUs (x86, ARM mostly) are little-endian. Network protocols are usually big-endian ("network byte order"). The hex editor shows raw bytes; you choose how to read them. A length field "00 00 04 00" is either 1024 (big-endian) or 4 (little) — the file format dictates which.
A worked patch.
Suppose a PNG image starts with the eight-byte header and you want to corrupt the "type" field of the first chunk. Bytes 0x08-0x0B are the chunk length; 0x0C-0x0F are the chunk type ("IHDR" = 49 48 44 52). Change the I to a J (49 → 4A) and save. The PNG now fails the type check; image viewers refuse to open it. The four-byte CRC at the end of the chunk no longer matches; some viewers will tolerate that, others won't. That granularity is what the hex editor is for.
Patch a PNG chunk
single byte at 0x0C
Locate the chunk type, flip one byte, save.
0x0C: 49 → 4A
= Same file size, broken format
Length-prefixed vs delimited.
Binary formats come in two flavours. Length-prefixed: each record starts with its length (e.g. 04 00 00 00 41 41 41 41 = 4-byte string "AAAA"). Delimited: records are terminated by a marker (C strings end with 00; lines end with 0A). Length prefixes are faster to skip past; delimiters are simpler to write. Hex-editing into a length-prefixed file means updating the length when you insert bytes — easy to forget and easy to corrupt.
Insert vs overwrite.
Every hex editor has these two modes and they behave very differently. Overwrite: your edit replaces bytes one-for-one; file length doesn't change. Insert: your edit pushes following bytes forward; offsets after the cursor shift. Most binary formats break under insert mode because internal pointers and lengths become wrong. Overwrite is almost always what you want. Reach for insert only when you've recalculated every dependent offset.