🥮 mooncakes.io

hex_editor

Terminal hex editor & binary analysis toolkit: 20 format parsers, wildcard search, entropy analysis, steganography detection, Base64/URL/Unicode/Hex codecs. Cross-platform (Windows/Linux), dual-target (Native + Wasm-GC).

hex
editor
binary
tui
parser
forensics
entropy
steganography
moon add R00TK17/hex_editor@0.1.2
Download zip
Author
Version
0.1.2
License
Apache-2.0
Repository
Last updated
last month
Downloads
28

Dependencies

README

#R00TK17/hex_editor

CI

Terminal hex editor and binary file analysis toolkit written in MoonBit.

#Features

  • Hex Editor TUI — interactive terminal UI with gap-buffer O(1) editing, undo/redo, clipboard
  • 20 Format Parsers — JPEG, PNG, GIF, BMP, WAV, FLAC, MP3, OGG, AVI, MP4, WebM/MKV, ZIP, RAR, TAR, ZLIB, GZip, 7z, BZip2, PE, ELF
  • Wildcard Search — BMH exact, Shift-Or bit-parallel (??), greedy segment (*, *N)
  • Signature Scanner — Aho-Corasick multi-pattern matching with 18 per-format validators
  • Entropy Analysis — Shannon entropy on 256-byte blocks (precomputed lookup table)
  • Codecs — Base64, URL percent-encoding, Unicode escape, Hex encode/decode
  • Strings Extraction — printable ASCII sequences ≥ 4 chars
  • File Browser — UTF-8 path support, multi-file switching, persistent bookmarks
  • Steganography Detection — embedded file extraction, trailing data detection

#Quick Start

# Clone and setup (auto-installs MoonBit, GCC, builds, tests)
git clone https://github.com/R00TK17/moonbit-HexEditor.git
cd moonbit-HexEditor
chmod +x setup.sh && ./setup.sh   # Linux
# .\setup.ps1                     # Windows

# CLI usage
moon run cmd/main -- struct file.bin
moon run cmd/main -- scan file.bin
moon run cmd/main -- entropy file.bin

# TUI mode
moon run cmd/main -- file.bin

#Usage as a Library

// Parse binary file structure

///|
let fields = @R00TK17/hex_editor.parse_structure(bytes)

// Scan for embedded file signatures

///|
let matches = @R00TK17/hex_editor.scan_signatures(bytes)

// Shannon entropy analysis (256-byte blocks)

///|
let blocks = @R00TK17/hex_editor.entropy_scan(bytes)

// Search with wildcards

///|
let result = @R00TK17/hex_editor.find_hex_pattern(bytes, "FF ?? ?? EE")

///|
let result = @R00TK17/hex_editor.find_text_pattern(bytes, "He*ld")

// Codecs

///|
let b64 = @R00TK17/hex_editor.base64_encode(bytes)

///|
let decoded = @R00TK17/hex_editor.base64_decode(b64)

#Platform Support

PlatformNativeWasm-GC
Windows✓ TUI + CLIN/A
Linux✓ TUI + CLIN/A
Browser—✓ CLI only

#Links

#
EntropyBlock

source
pub struct EntropyBlock {
  start : Int
  end : Int
  entropy : Double
} derive(
Debug)

#
HexBuffer

source
type HexBuffer

A mutable buffer for hex editing with Gap Buffer optimization.

Physical layout: [bytes | gap | bytes]
  • gap_start: first index of the gap
  • gap_end: first index after the gap
  • len: logical byte count (excluding gap)

The gap moves to the edit cursor on insert/delete. Consecutive edits at the same position are O(1).

#
HexBuffer::byte_at

source
fn HexBuffer::byte_at(self : HexBuffer, idx : Int) -> Byte

Fast byte read for rendering (no bounds check, no Option). Caller must ensure idx < self.len.

#
HexBuffer::data_ref

source
fn HexBuffer::data_ref(self : HexBuffer) -> FixedArray[Byte]

Returns internal data array (includes gap). Use byte_at() for correct access.

#
HexBuffer::delete_byte

source
fn HexBuffer::delete_byte(self : HexBuffer, offset : Int) -> Bool

Delete byte at logical offset. O(1) if gap is already at offset.
  1. Move gap to offset
  2. Expand gap_end by 1 (the byte at gap_end is "deleted")

#
HexBuffer::from_bytes

source
fn HexBuffer::from_bytes(bytes : Bytes) -> HexBuffer

Creates a HexBuffer from bytes. Gap is placed at the end. Layout: [file_bytes | gap]

#
HexBuffer::from_file

source
fn HexBuffer::from_file(path : String) -> HexBuffer raise

#
HexBuffer::get_byte

source
fn HexBuffer::get_byte(self : HexBuffer, offset : Int) -> Byte?

Safe byte read with bounds check.

#
HexBuffer::get_file_path

source
fn HexBuffer::get_file_path(self : HexBuffer) -> String?

#
HexBuffer::insert_byte

source
fn HexBuffer::insert_byte(self : HexBuffer, offset : Int, value : Byte) -> Bool

Insert a byte at logical offset. O(1) if gap is already at offset.
  1. Grow gap if exhausted
  2. Move gap to offset
  3. Write byte into gap_start, advance gap_start

#
HexBuffer::is_empty

source
fn HexBuffer::is_empty(self : HexBuffer) -> Bool

#
HexBuffer::is_modified

source
fn HexBuffer::is_modified(self : HexBuffer) -> Bool

#
HexBuffer::length

source
fn HexBuffer::length(self : HexBuffer) -> Int

#
HexBuffer::new

source
fn HexBuffer::new() -> HexBuffer

Creates a new empty HexBuffer with 256-byte initial gap.

#
HexBuffer::save

source
fn HexBuffer::save(self : HexBuffer, path? : String) -> Unit raise

#
HexBuffer::set_byte

source
fn HexBuffer::set_byte(self : HexBuffer, offset : Int, value : Byte) -> Bool

Set byte at logical offset. Returns false if out of bounds.

#
HexBuffer::set_file_path

source
fn HexBuffer::set_file_path(self : HexBuffer, path : String) -> Unit

#
HexBuffer::to_bytes

source
fn HexBuffer::to_bytes(self : HexBuffer) -> Bytes

Compact copy of logical bytes (no gap).

#
HexBuffer::to_fixedarray

source
fn HexBuffer::to_fixedarray(self : HexBuffer) -> FixedArray[Byte]

#
HexViewConfig

source
type HexViewConfig

Configuration for hex dump display formatting.

#
HexViewConfig::default

source
fn HexViewConfig::default() -> HexViewConfig

Creates a default HexViewConfig.

#
HexViewConfig::with_ascii

source
fn HexViewConfig::with_ascii(self : HexViewConfig, show : Bool) -> HexViewConfig

Creates a HexViewConfig with custom show_ascii setting.

#
HexViewConfig::with_bytes_per_row

source
fn HexViewConfig::with_bytes_per_row(self : HexViewConfig, bpr : Int) -> HexViewConfig

Creates a HexViewConfig with custom bytes per row.

#
HexViewConfig::with_uppercase

source
fn HexViewConfig::with_uppercase(self : HexViewConfig, upper : Bool) -> HexViewConfig

Creates a HexViewConfig with custom uppercase_hex setting.

#
ScanMatch

source
pub struct ScanMatch {
  offset : Int
  name : String
  size : Int
  confidence : Int
} derive(
Debug)

#
StringMatch

source
pub struct StringMatch {
  offset : Int
  text : String
} derive(
Debug)

#
StructField

source
type StructField derive(
Debug)

A parsed field from a file structure.

#
base64_decode

source
fn base64_decode(text : String) -> Bytes?

Decode Base64 string to bytes.

#
base64_encode

source
fn base64_encode(data : Bytes) -> String

Encode bytes to Base64 string.

#
entropy_scan

source
fn entropy_scan(bytes : Bytes) -> Array[EntropyBlock]

Scan bytes in 256-byte blocks, compute Shannon entropy per block. Full blocks use precomputed table (pure lookup, no log2 calls).

#
extract_region

source
fn extract_region(bytes : Bytes, start : Int, name : String, base_path : String) -> String

#
find_all_bytes

source
fn find_all_bytes(data : Bytes, pattern : Bytes) -> Array[Int]

Boyer-Moore-Horspool search — all occurrences.

#
find_hex_pattern

source
fn find_hex_pattern(data : Bytes, pattern : String) -> (Array[Int], Array[Int])?

Search data for a hex pattern with ?? and * wildcards. Returns Some((offsets, match_lengths)) or None if pattern is invalid.

#
find_strings

source
fn find_strings(bytes : Bytes) -> Array[StringMatch]

Scan bytes for printable ASCII strings of length >= 4.

#
find_text_pattern

source
fn find_text_pattern(data : Bytes, pattern : String) -> (Array[Int], Array[Int])?

Search data for a text pattern with ?, *, *N wildcards and \ escape. Returns Some((offsets, match_lengths)) or None if pattern is invalid.

#
format_ascii

source
fn format_ascii(byte : Byte) -> Char

Converts a byte to its ASCII representation for the text column. Printable ASCII characters (0x20-0x7E) are shown as-is. Non-printable bytes are shown as '.'.

#
format_buffer_info

source
fn format_buffer_info(buffer : HexBuffer) -> String

Returns a brief summary of a HexBuffer.

#
format_byte_hex

source
fn format_byte_hex(byte : Byte, uppercase? : Bool) -> String

Converts a byte to a 2-character hex string.

#
format_hex_dump

source
fn format_hex_dump(buffer : HexBuffer, start_offset? : Int, length? : Int, config? : HexViewConfig) -> String

Formats a complete hex dump from a HexBuffer.

#
format_hex_row

source
fn format_hex_row(data : FixedArray[Byte], start : Int, length : Int, base_offset : Int, config : HexViewConfig) -> String

Formats a single row of a hex dump.

#
format_offset

source
fn format_offset(offset : Int, width? : Int, uppercase? : Bool) -> String

Formats an integer offset as a hex address string.

#
format_size

source
fn format_size(len : Int) -> String

Formats a byte count in human-readable form.

#
format_strings_export

source
fn format_strings_export(matches : Array[StringMatch]) -> String

Format strings matches as plain text for export.

#
format_structure

source
fn format_structure(fields : Array[StructField]) -> String

Display parsed structure as readable text.

#
format_structure_json

source
fn format_structure_json(fields : Array[StructField]) -> String

Format StructField array as JSON string.

#
hex_decode

source
fn hex_decode(text : String) -> Bytes?

Hex decode: space-separated hex values → bytes. Example: "48 65 6C" → b"\x48\x65\x6C"

#
hex_encode

source
fn hex_encode(data : Bytes) -> String

Hex encode: bytes → space-separated hex values. Example: b"\x48\x65" → "48 65"

#
parse_hex_string

source
fn parse_hex_string(hex_str : String) -> Bytes?

Parses a hex string like "FF 00 AB" into a Bytes sequence.

#
parse_structure

source
fn parse_structure(bytes : Bytes) -> Array[StructField]

Parse structure of file bytes. Returns top-level fields or empty array.

#
scan_signatures

source
fn scan_signatures(bytes : Bytes) -> Array[ScanMatch]

#
to_hex_string

source
fn to_hex_string(n : Int, width? : Int) -> String

Converts a number to a fixed-width hex string (useful for UI).

#
unicode_decode

source
fn unicode_decode(text : String) -> Bytes?

Unicode decode: parse \uXXXX sequences to bytes. Plain ASCII characters are kept as-is. Codepoints <= 0x7F → 1 byte, <= 0x7FF → 2 bytes, else → 3 bytes (UTF-8). Returns None on invalid input.

#
unicode_encode

source
fn unicode_encode(data : Bytes) -> String

Unicode encode: each byte → \u00XX notation.

#
url_decode

source
fn url_decode(text : String) -> Bytes?

URL percent-decode a string to bytes. %XX is decoded, + is decoded as space. Returns None on invalid input.

#
url_encode

source
fn url_encode(data : Bytes) -> String

URL percent-encode bytes. Unreserved characters (A-Z, a-z, 0-9, -, _, ., ~) pass through, all others become %XX.

Source Files

Powered by MoonBit

Site sourceReport issuePackagesBuild queueSkillsStatistics

© 2026 mooncakes.io