NAME

SYNOPSIS

DESCRIPTION

hexpeek has four main modes of operation: prompt, command, pack, and recovery. Prompt mode is entered by default, subject to OPTIONS. When invoked as hexview, hexDump, hexpack, or hexdiff, hexpeek runs as if given one of the flags -r, -dump, -pack, or -diff respectively.

Except when specifically indicated otherwise, hexpeek input and output are in unprefixed hexadecimal. This allows the user to work in hexadecimal without needing to prefix every number with "0x".

Thank you for trying hexpeek. Send your comments to hexpeek@hexpeek.com.

OPTIONS

-h

Print usage text about commonly used options; then exit.

-help

Print more complete help text; then exit.

-v

Print short version string; then exit.

-version

Print long version string; then exit.

-license

Print license text; then exit.

-d <FD>

Treat <FD>, a _decimal_ integer, as an already-open file descriptor and use it as the next file. Functionality on non-seekable files is limited (see LIMITATIONS below).

-r

Open subsequent infiles read-only.

-w

Open subsequent infiles writeable.

-W

Like -w, but do not creat infiles that do not exist.

+ik

Disable insert and kill commands.

-x <CMDS>

Execute semicolon-delimited commands (see COMMANDS below).

-dump

Dump a whole single infile. Same as "-x 0:max".

-pack

Treat infile as a hexpeek dump and pack it back into the outfile as binary. For best results, run with the same option flags with which the original dump was created.

-diff

Diff two files. Same as "-x ´$0@0:max~$1@0:max´".

-s <START>

With -dump or -diff, start output at given file offset.

-l <LEN>

Like -s, but stop output after <LEN> octets are processed.

-o <OUTFILE>

Write output to the given file.

[-|+]SET [ARG]

Set the given setting (for all applicable display modes). SET may be one of: endian, hex, bits, rlen, slen, line, cols, group, margin, scalar, prefix, autoskip, diffskip, text, and ruler. These options accept the same arguments and have the same effect as the commands of the same names (see COMMANDS below).

-b , -c , -g

Synonyms of -bits , -cols , and -group respectively.

-p

Output data in plain mode, which is the equivalent of "-c 0 -g 0 -margin 0 +autoskip +diffskip +text +ruler".

+lineterm

Skip line breaks in output.

-format <FMT>

Specify group delimiters. This both controls print output and allows the delimiters to be silently ignored in data input. Default: "%_l? %_g", which prints a leading space before each group except the zeroth group (if margin > 0, a space will be printed as part of the margin separator).

-unique

Skip uniqueness check - assume all infiles are unique. See warning in LIMITATIONS.

+tty

Skip TTY check - assume standard streams are not TTYs.

-pedantic

Generate a user-level error if filezone information is unspecified or ambiguous (instead of auto-inferring what to do) or if a print or diff (except with ":max") attempts to read beyond end of file (instead of printing nothing).

[-|+]strict

Toggle strict failure mode, which, when enabled, causes hexpeek to fail for user-level errors (like a malformed command string). This mode is enabled by default when hexpeek is run non-interactively.

-backup <DEPTH>

Backup depth may be 0 (to disable), max (0x20), or any number therebetween. The default depth is 8.

-backup sync

Aggressively sync backup to disk.

-recover

Prompt to revert operations recorded in backup files.

-trace <FILE>

Trace to the given file.

--

Denote end of option flags.

COMMANDS

q[uit]

Quit the program.

stop

Exit without unlinking backup files.

h[elp] [TOPIC]

Show general or specific helptext.

files

List open files with their paths (with C escapes for non-printable characters), writeability, lengths, and current offsets.

reset [$FILE]

Reset the current offset of FILE if specified, otherwise reset the current offsets of all open infiles.

settings

List the values of various settings.

endian<b|l>

Set big- (default) or little-endian mode. Little-endian mode is not compatible with zero group width.

hex[l|u]

Switch to hexadecimal display mode. The optional last character may be used to set the case of hex numerals to lower (default) or upper.

bits

Switch to bits display mode. This affects file data only, not scalar (control) information.

rlen <WIDTH>

Set default read length for the current display mode.

slen <WIDTH>

Set search print length for the current display mode. If 0, print only address of search match.

line <WIDTH>

Set line width for the current display mode; 0 disables.

cols <WIDTH>

Set rlen, slen, and line.

group <WIDTH>

Set group width for the current display mode; 0 disables. This option controls how many octets are printed between spaces (or other delimiters specified by -format).

margin <WIDTH>

Set octet width of printed file offset; 0 disables; "full" sets to maximum available width (default).

scalar <BASE>

Interpret scalar input according to the given <BASE>. Valid arguments are 0x10 (default) and 0. If 0, scalar input are interpreted as decimal unless prefixed with "0x" (hex) or "0" (octal). This flag does not affect scalar output.

[+]prefix

Print scalars with a "0x" prefix (default off).

[+]autoskip

Toggle autoskip mode. If on (default when interactive), repeated lines in dumps are replaced with "*".

[+]diffskip

Toggle diffskip mode. If on, identical lines in diffs are skipped.

[+]text[=CODE]

Toggle dump of text characters in a column to the right of print output. The optional argument controls the character encoding and should be ascii or ebcdic. Defaults on when interactive and line width is non-zero.

[+]ruler

Toggle octet ruler.

Numeric

[+][$FILE@][HEXOFF][,HEXLEN][+][SUBCOMMAND] [+][$FILE@][HEXOFF][:HEXLIM][+][SUBCOMMAND] ^--------filezone-------^

Execute a subcommand over a given filezone. If specified, FILE must be a numeric index; otherwise, file $0 will be used. HEXOFF may be used to specify an absolute file offset if positive, a relative offset from file end if negative, or the current offset if "@@" or not given.

HEXLEN is an optional length argument to the subcommand. HEXLIM specifies a length of HEXLIM - HEXOFF, or may be "max".

SUBCOMMAND may be one of: p, /, ~, r, i, k, their long forms, and offset. If no subcommand is specified, an implicit print is done.

If "+" precedes the filezone, file offset will be incremented before subcommand is run by the number of octets to be processed. If instead "+" follows, file offset will be incremented after subcommand is run by the number of octets processed.

An empty line at the prompt is equivalent to "+", and may be used to page through a file.

p[rint][v] , v

Output data starting at file offset. If HEXLEN is specified, that many octets are read; otherwise, the default number of octets are read. The output includes a left margin with file offset information. When "p" is given explicitly, offset start is outputted before file data.

Including "v" prints verbosely: each output line shows the file offset and data for just one octet with hexadecimal, decimal, octal, bits, high bit/low bit/bit count, and text formats shown side-by-side.

If autoskip is enabled, repeated lines are replaced with a single "*".

offset

Seek to the filezone offset and print it. Useful in scripts.

search <PATTERN> , /<PATTERN>

Search for the argument data within the specified filezone (or to file end if unspecified). A valid PATTERN is either: (1) fully specified octets in hexadecimal or bits (depending on mode), any number of spaces between octets, and the "." character (which matches any value); or (2) a filezone of the form described above, in which case data from that zone is used as search input. If filezone length is unspecified, the default length of 1 is used.

If the search succeeds, the file offset is set to the beginning of the first found match; unless "+" follows the filezone, in which case the file offset is set to immediately _after_ the first found match or to immediately _after_ the search area if there was no match.

~[ ][FILEZONE]

Perform a diff of two filezones. If no argument is given and two files are open, the diff is done between the two files. If two octets at a given relative offset are the same, they are printed as underscores. If diffskip is enabled, identical lines are not printed.

/~[ ][FILEZONE]

Search for the next difference between two filezones.

r[eplace ]<PATTERN>

Replace octets in the filezone with the argument data. The argument is of the same form as for the search command, but the "." matching character is not recognized. If HEXLEN is specified and is greater than the octet length of the input data, the data will be repeated to fill HEXLEN octets.

i[nsert ]<PATTERN>

Like replace, but expand file at file offset by number of octets to be written, thus preserving existing data.

k[ill] , delete

Remove the data in the specified filezone. If HEXLEN is unspecified, one octet will be removed. Note that a space is required between any numeric portion of the command and delete.

ops

Show operations available to be undone. For each operation the depth, operation number, and command string are printed.

u[ndo] [DEPTH]

Undo the number of operations specified by DEPTH (defaults to 1).

EXAMPLES

0

From beginning of file, print default number of octets.

10,40

Print 40 octets starting at the 10th octet in the file.

,2p

Print two octets starting at current file offset.

7:C/.1

Within domain starting at file offset 7 and ending at B inclusively, search for the first octet the second nibble of which is 1.

0:100 r 00

Zero out the first 100 octets.

100 r 1122

Replace the 100th octet with value 11 and the 101st octet with value 22.

-1r33

Replace the last octet in the file with the value 33.

i 44

Insert one octet with value 44 before the current offset.

-0i 5566

Append two octets to the end of file with values 55 and 66.

k

Remove one octet at the current file offset.

1:3k

Remove the first and second octets of the file.

20:60 r @30,3

Replace the 40 octet chunk starting at 20 with the values located in 30:33 repeated.

DEFAULTS

LIMITATIONS

Functionality on non-seekable files is inherently limited because hexpeek operates on them with a one-way seek. Thus, you can not seek backwards and post-incrementation for reads is always in effect. Moreover, the current offset has no impact on write operations (a duplex connection is assumed). Finally, the backup function does not work with non-seekable files for obvious reasons.

The insert and kill commands are inherently inefficient because they must move all the data after the point of insertion or deletion. Consider combining repeated insertions (or kills) into one large operation to limit the amount of time spent in file rearrangement.

Maximum line, group, and search argument octet width are 0x10000.

BACKUP AND RECOVERY

When an error occurs, use the undo command to revert it; or use stop and then invoke ´hexpeek -recover´. Otherwise, on successful exit, hexpeek automatically unlinks the backup files. A redo can be performed with the command line history functionality (if built with support).

VERSION

AUTHOR

hexpeek is a trademark of Michael Reilly.

SEE ALSO