This page is an easy-to-use list of Hiew documentation.
Help find that shortcut you've forgotten, or remind yourself how a feature works.
If you'ld like to help contribute corrections, demos or documents, click here.
Mark/unmark a block, this is like visual mode in Vim, it selects a contiguous region of bytes. Press * to start a block under cursor, then use the cursor keys to move to extend the block. Press * again to mark the end. Only one block can be active at a time.
You can use most navigation shortcuts while marking a block, here are some common examples:
See Alt* if you need to resize an existing block, you don't have to start again if you made a mistake!
Add the whole file to the current block, this is useful if you want to remove everything except the section you're working on. To do that, type Ctrl*, move to the new end, and type Alt *.
You can also use this to exclude a section from a search, by changing the search scope to block.
Resize block to current offset. Move the start of the current block to the current cursor position.
Assign a color to the active block. You can change the colors asssigned to different fields to help differentiate them quickly, this is useful to mark header fields. Note that the color persists even if you start a new block.
To move around in the color selection dialog, use ←, ↑, ↓, and →.
When you use colors, hiew will ask if you want to save them when
you exit. Colors are saved to a
I like to group similar fields together with the same color, but sometimes you just want to differentiate a field and don't care which color is used, use Shift AltM, which assigns a random color.
AltN jumps to the next marked block, which is very handy to skim through a file that was already colored by kiewtai for example (use Shift to jump to the previous marked block).
Move to the start of the current block.
Move to the end of the current block.
Toggle insert/overwrite block mode, the current mode is displayed in the status indicator.
Write block, save the current block to a file.
Read block, insert or overwrite data with contents from a file. Use Ins to toggle insert or overwrite mode.
The block is inserted at the current cursor location, so position it at the start of the block with [ if necessary.
Fill block, fill the selected block with a repeating pattern. This is usually used with a single byte, e.g.
If you use this shortcut in code view without an active block, the current instruction will be
Delete marked block, the block is removed and the file truncated.
Copy marked block, this duplicates the active block at the current cursor position. This operation can use insert or overwrite mode, use Ins to toggle it.
Move marked block, this is a copy and delete operation in one. This operation can use insert or overwrite mode, use Ins to toggle it.
Save the current location to the bookmarks stack. Bookmarks are quick and easy ways to jump around and explore, but only a limited number are available.
Hiew can only save 8 bookmarks. If you need more than that you should use comments instead with ;. You can add an unlimited number of comments, which are added to the Names window. You can also name a location with Shift F12.
Each view (hex, text, code) has it's own bookmark stack. Changing view will not discard bookmarks.
Restore the last bookmarks state. The last state is indicated by a diamond symbol in the bookmark indicator. See also BkSp and 0.
Delete current bookmark, the current bookmark is indicated by a diamond symbol in the bookmark indicator.
Clear all bookmarks.
Return to the previous location. For example, if you use F5 to jump to an offset and change your mind, use this to return quickly.
This is also useful if you want to follow a
For following offsets or references, see e.g. F6, ShiftF9, ShiftF10, ShiftF11, and others.
Restore a saved bookmark by number. Bookmarks are saved with +.
Start or stop recording a macro. An 'R' is displayed in the title bar, and all actions are recorded. Macros can be saved, loaded, organized, played and configured from the macro manager, Ctrl-.
Play a saved macro by number. Macros can be saved, loaded, organized, played and configured from the macro manager, Ctrl-.
Switch to Hex, Code, or Text mode. You can safely switch modes without losing any context. I'm used to quickly switching through modes if I'm not sure what the data I'm looking at is.
See also, F4.
In hex, code or text mode, Esc will exit hiew without updating the timestamp of the file. If you do want to update the timestamp, use F10.
The Esc key usually cancels or exits the current mode, it only exits Hiew if there is no other operation to cancel.
Open the next file from file history. From within Hiew, you can open a new file with F9, then quickly switch between open files with Tab. This is the equivalent of
Use the file history manager to manage open files, CtrlBkSp.
Open the previous/next file in command line arguments.
Also works when used with a wildcard parameter like
Even more useful when opened with a specific opening parameter such as
Enable or disable beeps.
Save a (text) screenshot of the current screen for future reference. The screen can be saved to a file, or to the clipboard.
The Shift F4 Print Block command does the same with the currently selected block, which can be as small or as big as needed.
Start calculator. The calculator is a 64bit programming calculator, supports the standard C logical, bitwise, and comparison operators.
You can enter numbers using C notation, or masm-like suffixes (0fffh), octal, binary, decimal and hex are supported.
The most useful feature is reading data from the cursor to use in calculations, to do this use
For example, to multiply the QWORD under the cursor by two, use
The calculator remembers it's state, so it's safe to close it and look around, then return to it when you need to.
The calculator is the best way to see what a value is in other bases, simply open the calculator and type
As far as I'm aware there is no way to use the
The default input base is hex, this won't be surprising if you've used windbg, but might be surprising if you're used to gdb. Append a
Use the Up/Down keys to move the calculator around.
Show some information about the current file, hiew, and the system. Includes full path, file size, free memory, the last error message displayed, and so on.
Shows a list of all opened files, and allows you to switch between them, or close them.
If a previous search exists, find the next match. If you don't have a previous search, hiew will prompt you for one. See also F7.
If you want to change the string encoding (e.g. unicode), see AltF8.
ShiftF7 does the same thing.
AltF7 changes the next search direction. It displays the direction in the status.
Enter a comment for the current instruction or location. Comments are displayed when the cursor is over the commented location. If you to search, browse or go to a previous comment, use the Names window, F12.
Comments can be saved and loaded between sessions, or imported from
plain text files. The format for importing or exporting from text
A location can have a name and a comment.
Enter edit mode. The cursor changes to a caret and the bookmark indicator displays "EDITMODE".
To exit from editmode, press Esc to exit and discard your changes, or F9 to exit and save them.
In hex mode, use Tab to switch between hex and character input. In code mode, Tab switches between opcodes (hex) and assembler mode.
The default cursor is a block █, and the edit cursor is a caret |.
In hex mode, you can choose what character set to use, you don't have to manually enter NULs for UTF-16 strings! Use the translation table, which is AltF8.
Goto offset. You can enter a relative offset, absolute offset, or virtual address.
The default input base is hexadecimal. If you want decimal, use the
If you're navigating around a file, you probably want something like ShiftF9 to follow the offset under the cursor, there are many variants of this operation.
Use PgDn to show the entry history.
Find code references to this location, use CtrlF6 to find the next match and BkSp to go back.
This is similar to xrefs in IDA, it will find the next location
This works well for quickly navigating, but use IDA if you need this to be reliable.
If you want to find all references to an import, select the import from the import view, F8F7, then choose one with Enter, then keep pressing CtrlEnter to cycle through them. You can also filter by DLL, ordinal, and so on.
Search for a string, instruction, or sequence of bytes. To switch between string and hex entry, use Tab. Esc will cancel the search. To repeat the last search, use CtrlEnter.
While in the search dialog, you can select:
You can't toggle between unicode/ascii searches from within the search dialog, do that first with AltF8.
If you type more than 3 non-Hex characters in the Hex entry (which is the default one), it will automagically switch to ASCII and remember what you typed so far.
You can type single-char wildcards in your search with Alt?.
View and edit PE, ELF, Mach-o etc headers. Hiew supports most common EXE formats. When applicable, many tables can be browsed and edited with F3. Some of the common tables are, imports F7, exports F9, sections F6, and so on.
If you want to go to the entry point, the quickest way is F8F5.
If you are not editing an executable file, then this view will show some minimal com header.
Insert bytes at the current position. The file is extended and the number of bytes requested are inserted. The new bytes will all be nuls.
Once the bytes are created them, you can edit them by pressing F3.
If you want the new bytes to contain a value pattern, create the bytes and then use AltF2.
If you want to insert the contents of a file instead, see CtrlF2. You don't need to create the bytes first, simply switch to insert mode.
While in the strings dialog, you can use:
|1 2 3 4 5 6 7 8 9 A||
Hiew automatically assigns a shortcut key to every branch in code
view, so you can easily follow
The assigned shortcut is displayed next to the instruction with an arrow indicating the direction of the branch, either ↑ or ↓.
If you change your mind, press BkSp to return to the previous location.
Change the opcode size, cycle between 16bit, 32bit and 64bit instruction set. This is useful if you're trying to extract the shellcode from an exploit and hiew used the wrong instruction set to decode it.
The current mode is displayed next to the bookmark indicator.
If you want to change the architecture, not the size (e.g. ARM instead of x86_64), use ShiftF1.
Opens the Crypt dialog. It's an editor for a tiny subset of x86 to manipulate data. Choose the data size it's operating with F2.
For example, this code in Byte mode will fill the current block with
You can also use the output of the Crypt interpreter while editing with F7. When editing, you can open the Crypt dialog again with CtrlF7.
Open the HEM menu, which allows you to load Hiew plugins. HEMs can extend Hiew to add additional functionality and features.
Press F6 to see information about each module.
A HEM exports what filetypes it supports. If you don't see a HEM you need, it might not be registered for this file type. If you are certain you still want to use it, you can unhide it with F5.
The • symbol indicates the module is loaded and available, you can unload it with F9.