🥮 mooncakes.io

    hex_editor

    Terminal hex editor & binary analysis toolkit: 20 format parsers, wildcard search, entropy analysis, steganography detection, Base64/URL/Unicode/Hex codecs. Cross-platform (Windows/Linux), dual-target (Native + Wasm-GC).

    hex
    editor
    binary
    tui
    parser
    forensics
    entropy
    steganography
    Download zip
    Author
    Version
    0.1.3
    License
    Apache-2.0
    Repository
    Last updated
    2 days ago
    Downloads
    33

    Dependencies

    #R00TK17/hex_editor

    CI

    Terminal hex editor and binary file analysis toolkit written in MoonBit.

    #Features

    • Hex Editor TUI — interactive terminal UI with gap-buffer O(1) editing, undo/redo, clipboard
    • 20 Format Parsers — JPEG, PNG, GIF, BMP, WAV, FLAC, MP3, OGG, AVI, MP4, WebM/MKV, ZIP, RAR, TAR, ZLIB, GZip, 7z, BZip2, PE, ELF
    • Wildcard Search — BMH exact, Shift-Or bit-parallel (??), greedy segment (*, *N)
    • Signature Scanner — Aho-Corasick multi-pattern matching with 18 per-format validators
    • Entropy Analysis — Shannon entropy on 256-byte blocks (precomputed lookup table)
    • Hash / Checksum — MD5, SHA1, SHA224, SHA256, SM3 (pure MoonBit, no FFI)
    • Codecs — Base64, URL percent-encoding, Unicode escape, Hex encode/decode
    • Strings Extraction — printable ASCII sequences ≥ 4 chars
    • File Browser — UTF-8 path support, multi-file switching, persistent bookmarks
    • Steganography Detection — embedded file extraction, trailing data detection

    #Quick Start

    # Clone and setup (auto-installs MoonBit, GCC, builds, tests)
git clone https://github.com/R00TK17/moonbit-HexEditor.git
cd moonbit-HexEditor
chmod +x setup.sh && ./setup.sh   # Linux
# .\setup.ps1                     # Windows

# CLI usage
moon run cmd/main -- struct file.bin
moon run cmd/main -- scan file.bin
moon run cmd/main -- entropy file.bin
moon run cmd/main -- hash file.bin

# TUI mode
moon run cmd/main -- file.bin

    #Usage as a Library

    // Parse binary file structure

    ///|
    let fields = @R00TK17/hex_editor.parse_structure(bytes)

    // Scan for embedded file signatures

    ///|
    let matches = @R00TK17/hex_editor.scan_signatures(bytes)

    // Shannon entropy analysis (256-byte blocks)

    ///|
    let blocks = @R00TK17/hex_editor.entropy_scan(bytes)

    // Search with wildcards

    ///|
    let result = @R00TK17/hex_editor.find_hex_pattern(bytes, "FF ?? ?? EE")

    ///|
    let result = @R00TK17/hex_editor.find_text_pattern(bytes, "He*ld")

    // Codecs

    ///|
    let b64 = @R00TK17/hex_editor.base64_encode(bytes)

    ///|
    let decoded = @R00TK17/hex_editor.base64_decode(b64)

    // Hash / checksum (MD5, SHA1, SHA224, SHA256, SM3)

    ///|
    let md5 : String = @R00TK17/hex_editor.md5_hex(bytes)

    ///|
    let results : Array[@R00TK17/hex_editor.HashResult] = @R00TK17/hex_editor.hash_all(
      bytes,
    )

    #Platform Support

    PlatformNativeWasm-GC
    Windows✓ TUI + CLIN/A
    Linux✓ TUI + CLIN/A
    Browser—✓ CLI only

    #Links

    EntropyBlock

    source
    pub struct EntropyBlock {
      start : Int
      end : Int
      entropy : Double
    } derive(
    Debug    )

    HashResult

    source
    pub struct HashResult {
      name : String
      value : String
    } derive(
    Debug    )

    HexBuffer

    source
    type HexBuffer

    A mutable buffer for hex editing with Gap Buffer optimization.

    Physical layout: [bytes | gap | bytes]
    • gap_start: first index of the gap
    • gap_end: first index after the gap
    • len: logical byte count (excluding gap)

    The gap moves to the edit cursor on insert/delete. Consecutive edits at the same position are O(1).

    HexBuffer::byte_at

    source
    fn HexBuffer::byte_at(self : HexBuffer, idx : Int) -> Byte

    Fast byte read for rendering (no bounds check, no Option). Caller must ensure idx < self.len.

    HexBuffer::data_ref

    source
    fn HexBuffer::data_ref(self : HexBuffer) -> FixedArray[Byte]

    Returns internal data array (includes gap). Use byte_at() for correct access.

    HexBuffer::delete_byte

    source
    fn HexBuffer::delete_byte(self : HexBuffer, offset : Int) -> Bool

    Delete byte at logical offset. O(1) if gap is already at offset.
    1. Move gap to offset
    2. Expand gap_end by 1 (the byte at gap_end is "deleted")

    HexBuffer::from_bytes

    source
    fn HexBuffer::from_bytes(bytes : Bytes) -> HexBuffer

    Creates a HexBuffer from bytes. Gap is placed at the end. Layout: [file_bytes | gap]

    HexBuffer::from_file

    source
    fn HexBuffer::from_file(path : String) -> HexBuffer raise

    HexBuffer::get_byte

    source
    fn HexBuffer::get_byte(self : HexBuffer, offset : Int) -> Byte?

    Safe byte read with bounds check.

    HexBuffer::get_file_path

    source
    fn HexBuffer::get_file_path(self : HexBuffer) -> String?

    HexBuffer::insert_byte

    source
    fn HexBuffer::insert_byte(self : HexBuffer, offset : Int, value : Byte) -> Bool

    Insert a byte at logical offset. O(1) if gap is already at offset.
    1. Grow gap if exhausted
    2. Move gap to offset
    3. Write byte into gap_start, advance gap_start

    HexBuffer::is_empty

    source
    fn HexBuffer::is_empty(self : HexBuffer) -> Bool

    HexBuffer::is_modified

    source
    fn HexBuffer::is_modified(self : HexBuffer) -> Bool

    HexBuffer::length

    source
    fn HexBuffer::length(self : HexBuffer) -> Int

    HexBuffer::new

    source
    fn HexBuffer::new() -> HexBuffer

    Creates a new empty HexBuffer with 256-byte initial gap.

    HexBuffer::save

    source
    fn HexBuffer::save(self : HexBuffer, path? : String) -> Unit raise

    HexBuffer::set_byte

    source
    fn HexBuffer::set_byte(self : HexBuffer, offset : Int, value : Byte) -> Bool

    Set byte at logical offset. Returns false if out of bounds.

    HexBuffer::set_file_path

    source
    fn HexBuffer::set_file_path(self : HexBuffer, path : String) -> Unit

    HexBuffer::to_bytes

    source
    fn HexBuffer::to_bytes(self : HexBuffer) -> Bytes

    Compact copy of logical bytes (no gap).

    HexBuffer::to_fixedarray

    source
    fn HexBuffer::to_fixedarray(self : HexBuffer) -> FixedArray[Byte]

    HexViewConfig

    source
    type HexViewConfig

    Configuration for hex dump display formatting.

    HexViewConfig::default

    source
    fn HexViewConfig::default() -> HexViewConfig

    Creates a default HexViewConfig.

    HexViewConfig::with_ascii

    source
    fn HexViewConfig::with_ascii(self : HexViewConfig, show : Bool) -> HexViewConfig

    Creates a HexViewConfig with custom show_ascii setting.

    HexViewConfig::with_bytes_per_row

    source
    fn HexViewConfig::with_bytes_per_row(self : HexViewConfig, bpr : Int) -> HexViewConfig

    Creates a HexViewConfig with custom bytes per row.

    HexViewConfig::with_uppercase

    source
    fn HexViewConfig::with_uppercase(self : HexViewConfig, upper : Bool) -> HexViewConfig

    Creates a HexViewConfig with custom uppercase_hex setting.

    ScanMatch

    source
    pub struct ScanMatch {
      offset : Int
      name : String
      size : Int
      confidence : Int
    } derive(
    Debug    )

    StringMatch

    source
    pub struct StringMatch {
      offset : Int
      text : String
    } derive(
    Debug    )

    StructField

    source
    type StructField derive(
    Debug    )

    A parsed field from a file structure.

    base64_decode

    source
    fn base64_decode(text : String) -> Bytes?

    Decode Base64 string to bytes.

    base64_encode

    source
    fn base64_encode(data : Bytes) -> String

    Encode bytes to Base64 string.

    entropy_scan

    source
    fn entropy_scan(bytes : Bytes) -> Array[EntropyBlock]

    Scan bytes in 256-byte blocks, compute Shannon entropy per block. Full blocks use precomputed table (pure lookup, no log2 calls).

    extract_region

    source
    fn extract_region(bytes : Bytes, start : Int, name : String, base_path : String) -> String

    find_all_bytes

    source
    fn find_all_bytes(data : Bytes, pattern : Bytes) -> Array[Int]

    Boyer-Moore-Horspool search — all occurrences.

    find_hex_pattern

    source
    fn find_hex_pattern(data : Bytes, pattern : String) -> (Array[Int], Array[Int])?

    Search data for a hex pattern with ?? and * wildcards. Returns Some((offsets, match_lengths)) or None if pattern is invalid.

    find_strings

    source
    fn find_strings(bytes : Bytes) -> Array[StringMatch]

    Scan bytes for printable ASCII strings of length >= 4.

    find_text_pattern

    source
    fn find_text_pattern(data : Bytes, pattern : String) -> (Array[Int], Array[Int])?

    Search data for a text pattern with ?, *, *N wildcards and \ escape. Returns Some((offsets, match_lengths)) or None if pattern is invalid.

    format_ascii

    source
    fn format_ascii(byte : Byte) -> Char

    Converts a byte to its ASCII representation for the text column. Printable ASCII characters (0x20-0x7E) are shown as-is. Non-printable bytes are shown as '.'.

    format_buffer_info

    source
    fn format_buffer_info(buffer : HexBuffer) -> String

    Returns a brief summary of a HexBuffer.

    format_byte_hex

    source
    fn format_byte_hex(byte : Byte, uppercase? : Bool) -> String

    Converts a byte to a 2-character hex string.

    format_hex_dump

    source
    fn format_hex_dump(buffer : HexBuffer, start_offset? : Int, length? : Int, config? : HexViewConfig) -> String

    Formats a complete hex dump from a HexBuffer.

    format_hex_row

    source
    fn format_hex_row(data : FixedArray[Byte], start : Int, length : Int, base_offset : Int, config : HexViewConfig) -> String

    Formats a single row of a hex dump.

    format_offset

    source
    fn format_offset(offset : Int, width? : Int, uppercase? : Bool) -> String

    Formats an integer offset as a hex address string.

    format_size

    source
    fn format_size(len : Int) -> String

    Formats a byte count in human-readable form.

    format_strings_export

    source
    fn format_strings_export(matches : Array[StringMatch]) -> String

    Format strings matches as plain text for export.

    format_structure

    source
    fn format_structure(fields : Array[StructField]) -> String

    Display parsed structure as readable text.

    format_structure_json

    source
    fn format_structure_json(fields : Array[StructField]) -> String

    Format StructField array as JSON string.

    hash_all

    source
    fn hash_all(data : Bytes) -> Array[HashResult]

    Compute all supported digests at once.

    hex_decode

    source
    fn hex_decode(text : String) -> Bytes?

    Hex decode: space-separated hex values → bytes. Example: "48 65 6C" → b"\x48\x65\x6C"

    hex_encode

    source
    fn hex_encode(data : Bytes) -> String

    Hex encode: bytes → space-separated hex values. Example: b"\x48\x65" → "48 65"

    md5_hex

    source
    fn md5_hex(data : Bytes) -> String

    MD5 digest (hex, lowercase). MD5 is cryptographically broken — prefer SHA-256.

    parse_hex_string

    source
    fn parse_hex_string(hex_str : String) -> Bytes?

    Parses a hex string like "FF 00 AB" into a Bytes sequence.

    parse_structure

    source
    fn parse_structure(bytes : Bytes) -> Array[StructField]

    Parse structure of file bytes. Returns top-level fields or empty array.

    scan_signatures

    source
    fn scan_signatures(bytes : Bytes) -> Array[ScanMatch]

    sha1_hex

    source
    fn sha1_hex(data : Bytes) -> String

    SHA-1 digest (hex, lowercase). SHA-1 is cryptographically broken — prefer SHA-256.

    sha224_hex

    source
    fn sha224_hex(data : Bytes) -> String

    SHA-224 digest (hex, lowercase).

    sha256_hex

    source
    fn sha256_hex(data : Bytes) -> String

    SHA-256 digest (hex, lowercase).

    sm3_hex

    source
    fn sm3_hex(data : Bytes) -> String

    SM3 digest (Chinese national standard, hex, lowercase).

    to_hex_string

    source
    fn to_hex_string(n : Int, width? : Int) -> String

    Converts a number to a fixed-width hex string (useful for UI).

    unicode_decode

    source
    fn unicode_decode(text : String) -> Bytes?

    Unicode decode: parse \uXXXX sequences to bytes. Plain ASCII characters are kept as-is. Codepoints <= 0x7F → 1 byte, <= 0x7FF → 2 bytes, else → 3 bytes (UTF-8). Returns None on invalid input.

    unicode_encode

    source
    fn unicode_encode(data : Bytes) -> String

    Unicode encode: each byte → \u00XX notation.

    url_decode

    source
    fn url_decode(text : String) -> Bytes?

    URL percent-decode a string to bytes. %XX is decoded, + is decoded as space. Returns None on invalid input.

    url_encode

    source
    fn url_encode(data : Bytes) -> String

    URL percent-encode bytes. Unreserved characters (A-Z, a-z, 0-9, -, _, ., ~) pass through, all others become %XX.

    Source Files

    Powered by MoonBit

    Site sourceReport issuePackagesBuild queueSkillsStatistics

    © 2026 mooncakes.io