WerWolv/ImHex

What it does

A hex editor shows a file as a grid of numbers in base 16 rather than as letters. ImHex does that and adds a pattern language, which is a C++-like way of writing down the structure of a format so the editor can highlight and name each field. It reads from more places than most: files on disk, raw disks and partitions, a running program's memory, a GDB debugging server, UDP network packets, Intel Hex and Motorola SREC records, Base64 text, and remote files over SSH. It also carries a data inspector that reads the bytes under the cursor as many different types, a disassembler that turns machine code back into readable instructions, file comparison, hashing, bookmarks, a node-based data processor and support for YARA rules. Bytes can be patched, with undo and redo. The README puts its appetite at about 50 MiB of memory and about 100 MiB of disk, more for heavy analysis. The licence is GPL-2.0 for most of the project, with the lib/libimhex and plugins/ui directories under LGPL-2.1. The project is clear about where it stops: MSVC and AppleClang cannot build it, the release binaries need macOS 15 or newer, and a graphics card with OpenGL 3.0 is expected, with slower software-rendered builds for machines that have none.

Why it matters

Who it suits. Anyone who has to look inside a file format nobody documented: a save file, a firmware image, a proprietary export, an old archive. It suits people who want a window rather than a terminal, because most of the alternatives in this corner are command-line tools. Skip it if you only ever need to peek at a few bytes, since a terminal tool does that faster. Skip it too if the machine runs macOS 14 or older, because the release binaries will not start there and the only route is compiling it yourself.

Verdict. Worth an afternoon if reverse engineering is part of the job, and worth nothing at all if it is not. The pattern language is where the value sits, and it is a real language, so expect to read documentation before the first useful result. It is also one of very few tools here that can write bytes back into a file, which is exactly as dangerous as it sounds, so keep a copy of the original. On currency, here is what was proven today: the repository is open and not archived, its main branch carries 6,571 commits, and the newest release is v1.38.1 from 21 December 2025. ungh.cc, the mirror this report uses for code dates, could not be read today, so the most recent code date stands at the 15 August 2026 one already in this report's own record. A release that old beside code that recent means the project ships from source faster than it tags, not that it stopped. For a smaller command-line counterpart, wader/fq reads binary formats the way jq reads JSON.