Table of Contents

hexedit in CTF: How to Inspect and Modify Binary Files

author:

rudy_candy

category:

tools

✅ What is hexedit?

hexedit is a command-line hexadecimal editor that allows you to:

View binary files in hexadecimal and ASCII side by side
Edit bytes directly
Analyze file headers, magic numbers, and embedded data

In CTF challenges, hexedit is an essential tool for:

Reverse engineering
File format analysis
Manual file repair or manipulation

It provides a low-level view of files that tools like strings or binwalk may miss.

🛠️ Basic hexedit Commands

1. Open a file

hexedit file.bin

Opens file.bin in interactive hex editing mode.

2. Navigate the file

Use arrow keys to move the cursor.
Jump to an offset using Ctrl+G (Go to address).

3. Edit bytes

Select a byte in hex or ASCII view and type new values.
Changes are written to disk when you save (Ctrl+X → confirm save).

4. Search for patterns

Ctrl+S → search for ASCII or hex patterns (e.g., a flag prefix CTF{).
Useful for quickly locating embedded strings.

5. Inspect file headers

Hexedit allows you to see magic numbers and header structures.
Compare them against standard formats to detect file type tampering.

🎯 How hexedit is Used in CTF Challenges

1. Modify file headers

Some challenges require repairing a corrupted file (e.g., ZIP, PNG).
Example: correcting the PNG signature 89 50 4E 47 0D 0A 1A 0A.

2. Extract hidden data manually

Flags may be hidden in non-printable bytes or unusual offsets.
Hexedit allows you to copy or modify these bytes directly.

3. Reverse-engineer custom file formats

Some binaries use custom headers or encodings.
Hexedit lets you visualize and decode structures manually.

4. Patch binaries

Modify compiled programs to bypass checks or change behavior.
Example: NOP out a conditional jump in a small binary.

🔍 Common CTF Patterns with Hexedit

Pattern	Description	How Hexedit Helps
Corrupted files	Broken PNG, ZIP, or BMP headers	Fix headers manually to open file
Hidden flags	Non-printable bytes or unusual offsets	Inspect hex to find embedded flags
Custom binaries	Reverse-engineering challenges	Modify bytes to bypass checks
Magic numbers	Detect file type or tampering	Compare header bytes against standard values
Encoded messages	XOR, ROT, or custom encoding	Apply manual decoding directly in hex editor

📌 Tips for Using hexedit in CTFs

Always backup the original file before editing.
Combine with strings and binwalk to locate interesting offsets.
Use hexedit to verify extracted fragments after automated tools fail.
Learn common magic numbers for file formats (PNG, ZIP, ELF, PDF) to speed up analysis.
Practice navigating offsets efficiently; large files can be tricky without shortcuts.

🧩 Recommended Workflow in CTF

Open the suspect file with hexedit file.bin.
Inspect the header for magic numbers or anomalies.
Search for ASCII patterns or potential flag prefixes.
Repair or modify bytes as needed to reveal hidden data.
Combine with tools like binwalk, strings, or zsteg for multi-layer challenges.

hexedit