ImHex

https://docs.werwolv.net/imhex
Admin
ImHex is a hex editor designed for reverse engineers, programmers, and anyone needing to work with...
Tokens:10,378
Snippets:92
Trust Score:7.6
Update:11 months ago
Show doc for...
Tokens:
Raw
### C++ Provider Interface for Data Access

Source: https://docs.werwolv.net/imhex/common/providers

This C++ code defines the essential interface for ImHex Providers. It includes functions for opening/closing connections, reading/writing raw data, and getting the actual data size. These methods are crucial for any data source ImHex needs to interact with.

```cpp
// Called when a new provider is created. Opens a connection
// to its data source
bool open();

// Called when the provider is closed. Handles cleanup
void close();


// Called whenever ImHex wants to read any data from this provider
void readRaw(u64 offset, void *buffer, size_t size);
// Called whenever Imhex wants to write any data to this provider
void writeRaw(u64 offset, const void *buffer, size_t size);

// Called when ImHex wants to know the size of this data
size_t getActualSize();
```

--------------------------------

### 3D Model Vertices Example (IMHex)

Source: https://docs.werwolv.net/imhex/views/pattern-data

Example of how to define vertices for a 3D model when not using an indices array. Each group of three vertices forms a triangle.

```IMHex Script
vertices = [
    // 1st triangle
    { -1.0, -1.0, 0.0 }, // vertex (0)
    { 1.0, -1.0, 0.0 },  // vertex (1)
    { 0.0, 0.0, 0.0 },   // vertex (2)
    // 2nd triangle
    { 1.0, -1.0, 0.0 },  // vertex (1)
    { 0.0, 0.0, 0.0 },   // vertex (2)
    { 1.0, 1.0, 0.0 },   // vertex (3)
]
```

--------------------------------

### Visualize Raw Audio Data as Sound (IMHex)

Source: https://docs.werwolv.net/imhex/views/pattern-data

Converts raw signed 16-bit PCM audio stream bytes into playable sound. Requires the pattern containing the audio data, the number of channels, and the sample rate.

```IMHex Script
[[hex::visualize("sound", pattern, num_channels, sample_rate)]]
```

--------------------------------

### Hex View Formatting for Bytes

Source: https://docs.werwolv.net/imhex/views/hex-editor

Illustrates a 'Hex View' format, displaying bytes with their corresponding addresses and ASCII representation. This format is commonly used in hex editors for visualizing raw data.

```text
Hex View  00 01 02 03 04 05 06 07  08 09 0A 0B 0C 0D 0E 0F
 
000000A0        1B D2 E6                                     ...
```

--------------------------------

### Visualize Raw RGBA8 Data as Bitmap (IMHex)

Source: https://docs.werwolv.net/imhex/views/pattern-data

Renders raw RGBA8 byte data (RR GG BB AA) into an image. Requires the pattern containing the data, along with the width and height in pixels.

```IMHex Script
[[hex::visualize("bitmap", pattern, width, height)]]
```

--------------------------------

### Visualize Data as Line Plot (IMHex)

Source: https://docs.werwolv.net/imhex/views/pattern-data

Visualizes an array of 4-byte float values as a line plot. Requires an array of floats as input.

```IMHex Script
[[hex::visualize("line_plot", float_array)]]
```

--------------------------------

### Applying Visualizer Attribute in C++

Source: https://docs.werwolv.net/imhex/views/pattern-data

Demonstrates how to apply the `[[hex::visualize]]` attribute to a C++ struct to enable advanced data visualization in ImHex. This attribute links a visualizer to a specific data type or variable, allowing for custom display of decoded data.

```cpp
struct Coordinates {
    float latitude;
    float longitude;
} [[hex::visualize("coordinates", latitude, longitude)]];
```

--------------------------------

### Visualize Pattern as Image (IMHex)

Source: https://docs.werwolv.net/imhex/views/pattern-data

Decodes a pattern containing image bytes into an actual image. Supports JPG, PNG, TGA, BMP, PSD, GIF, HDR, and PIC formats.

```IMHex Script
[[hex::visualize("image", pattern)]]
```

--------------------------------

### Visualize 3D Model Data (IMHex)

Source: https://docs.werwolv.net/imhex/views/pattern-data

Visualizes 3D model data. Expects an array of vertices (each with X, Y, Z float coordinates) and an optional array of indices for defining triangles. If indices are null, vertices should define triangles directly.

```IMHex Script
[[hex::visualize("3d", vertices, indices)]]
```

--------------------------------

### C++ Array Representation of Bytes

Source: https://docs.werwolv.net/imhex/views/hex-editor

Demonstrates how to represent a sequence of bytes as a `std::array` in C++ for use in programming. This is useful when exporting hex data for integration into C++ projects.

```cpp
constexpr std::array<uint8_t, 3> data = {
    0x1B, 0xD2, 0xE6
};
```

--------------------------------

### ImHex Button Inline Visualizer

Source: https://docs.werwolv.net/imhex/views/pattern-data

Inline visualizer that replaces the value column with a clickable button. When clicked, this button executes a specified function. It requires the name of the function to be executed as a string argument.

```hexscript
hex::inline_visualize("button", function_name)
```

--------------------------------

### Visualize Data as Scatter Plot (IMHex)

Source: https://docs.werwolv.net/imhex/views/pattern-data

Visualizes two arrays of 4-byte float values as a scatter plot, using the first array for X coordinates and the second for Y coordinates. Both arrays must have the same size.

```IMHex Script
[[hex::visualize("scatter_plot", x_float_array, y_float_array)]]
```

--------------------------------

### ImHex Entropy Visualizer

Source: https://docs.werwolv.net/imhex/views/pattern-data

Visualizes the entropy of a given pattern, split into chunks of a specified size. This is useful for analyzing data distribution and identifying patterns. It requires a pattern and a chunk size as input.

```hexscript
hex::visualize("chunk_entropy", pattern, chunk_size)
```

--------------------------------

### ImHex Hex Viewer Visualizer

Source: https://docs.werwolv.net/imhex/views/pattern-data

Displays a pattern in a hex viewer format, similar to a hex editor. This visualizer is primarily used for inspecting raw byte data, splitting large byte sequences, or debugging pattern formatting.

```hexscript
hex::visualize("hex_viewer", pattern)
```

--------------------------------

### ImHex Gauge Inline Visualizer

Source: https://docs.werwolv.net/imhex/views/pattern-data

Inline visualizer that displays a progress bar representing a given value. The input is a single progress value expected to be between 0 and 100, where 0 is an empty bar and 100 is a full bar.

```hexscript
hex::inline_visualize("gauge", progress)
```

--------------------------------

### ImHex Color Inline Visualizer

Source: https://docs.werwolv.net/imhex/views/pattern-data

Inline visualizer that displays a color based on provided RGBA values. Each component (red, green, blue, alpha) should be an integer ranging from 0 to 255. The color is shown directly in the value column.

```hexscript
hex::inline_visualize("color", r, g, b, a)
```

--------------------------------

### Create Custom Section in IMHex Pattern Language

Source: https://docs.werwolv.net/imhex/views/pattern-editor

Demonstrates how to create a custom section in IMHex using the Pattern Language. This function is essential for organizing and accessing specific data segments within the hex editor. It takes a string argument for the section name.

```Pattern Language
std::mem::create_section("MyCustomSection")
```

--------------------------------

### 3D Model Vertices and Indices Definitions

Source: https://docs.werwolv.net/imhex/views/pattern-data

Defines arrays of vertices and indices for constructing 3D models. Vertices are represented as {x, y, z} coordinates, and indices specify the order in which vertices form triangles.

```pseudocode
// 3rd triangle
    { 1.0, 1.0, 0.0 },   // vertex (3)
    { 0.0, 0.0, 0.0 },   // vertex (2)
    { -1.0, 1.0, 0.0 },  // vertex (4)
    // 4th triangle
    { -1.0, 1.0, 0.0 },  // vertex (4)
    { 0.0, 0.0, 0.0 },   // vertex (2)
    { -1.0, -1.0, 0.0 }, // vertex (0)
]

vertices = [
    { -1.0, -1.0, 0.0 }, // vertex (0)
    { 1.0, -1.0, 0.0 },  // vertex (1)
    { 0.0, 0.0, 0.0 },   // vertex (2)
    { 1.0, 1.0, 0.0 },   // vertex (3)
    { -1.0, 1.0, 0.0 },  // vertex (4)
]
indices = [
    // 1st triangle
    0, 1, 2,
    // 2nd triangle
    1, 2, 3,
    // 3rd triangle
    2, 3, 4,
    // 4th triangle
    4, 2, 0
]
```

--------------------------------

### Rust Custom Inspector for ImHex

Source: https://docs.werwolv.net/imhex/views/data-inspector

Defines a custom data structure and its formatter for display in the ImHex inspector. This allows for custom data decoding and presentation based on byte patterns. It requires the `std::io` module and defines a struct with a formatter function.

```rust
import std.io;

// Type definition for the custom type we want to decode
struct MyCustomInspector {
    u32 value;
} [[format_read("custom_inspector_formatter")]];

// Formatter function which formats the displayed value
fn custom_inspector_formatter(MyCustomInspector customInspector) {
    return std::format("Hello World: {:02X}", customInspector.value);
};

// Placements. Each individual placement becomes a new line in the inspector
// All values need to be placed at the current cursor position ($) to respect
// the cursor position set in the editor
// The [[name]] attribute changes the value in the Name column, otherwise
// 'customInspector' would be used.
MyCustomInspector customInspector @ $ [[name("Custom Inspector Name")]];
```

--------------------------------

### ImHex Coordinates Visualizer

Source: https://docs.werwolv.net/imhex/views/pattern-data

Visualizes geographical coordinates (latitude and longitude) on a world map. It can also attempt to find the approximate location name or address by searching the internet. Requires latitude and longitude as floating-point numbers.

```hexscript
hex::visualize("coordinates", latitude, longitude)
```

--------------------------------

### Yara Rule for MSVC Compiler Detection

Source: https://docs.werwolv.net/imhex/views/data-information

This Yara rule, named 'CompilerMSVC', is designed to detect if a binary was compiled using Microsoft Visual C++ (MSVC). It looks for specific string patterns commonly found in MSVC-compiled executables. No external dependencies are required beyond the Yara engine.

```Yara
rule CompilerMSVC {
    meta:
        category = "Compiler"
        name = "MSVC"

    strings:
        $iostreams_mangled_name = "$basic_iostream@DU" ascii
        $std_namespace = "@@std@@" ascii

    condition:
        any of them
}
```
Tokens:
Raw