WerWolv / ImHex

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
https://imhex.werwolv.net
GNU General Public License v2.0
44.7k stars 1.95k forks source link

[Pitch] Merge Pattern Tree and Hex Editor #71

Closed vprimachenko closed 1 month ago

vprimachenko commented 3 years ago

first off thank you for your great work!

while trying around ImHex pattern tree feature i found myself wishing to have some kind of "code-folding" on the hex data. after some thought i came up with this mockup

ImHex-structured

when a tree item is collapsed it will show the content of all children condensed ( optionalHeader above), it is possible to use colorcoding here too

ImHex-structured-color

it is further possible to extend this concept by inlining the disassembly info too

ImHex-structured-disasm

while this looks a bit much in dense things like a PE header, this would be a great addition for

where one works with repeated large chunks of similarly structured information

so for example the tree would present the different frames of an mpeg stream, the user would have the ability to open one and make manipulation without having to hop between views

czghzc commented 3 years ago

This method is very good, I also agree

WerWolv commented 3 years ago

Hi! Your mockup indeed looks very neat. However, I have concerns about the actual readability. Right now the pattern data view shows precisely the data people are interested in, all the other "unnecessary garbage" stays in the hex editor so the user can solely focus on the interpretation of the data. I think this kinda takes away from this

vprimachenko commented 3 years ago

thanks for your feedback @WerWolv . can you please elaborate on the workflow you have in mind when working only on interpretation of data? in my mock up the hex editor is just a column, so the user should be able to just hide it and focus on the interpretation. a thing that is better in my mock up is that the user can immediately edit the data inline wile focusing on the interpretation, instead of selecting a row in the patter view, jumping to hexview, editing the data and switching focus back to patter tree.

[edit] exploring further about your point of "interpretation of data" i believe i got a feeling what you mean.

101559340-34120680-39c1-11eb-9ea6-d1eb28373dd6

vprimachenko commented 3 years ago

@WerWolv do you have any feedback on the updated mockup?

WerWolv commented 3 years ago

Yes! Sorry. My idea originally was to separate the actual data and the interpretation since the binary data in most cases is not that interesting anymore when you have the interpretation of it already. I want the data view to be clean and only contain information interesting to the user. While your mockup looks really neat, it also clutters the rows a lot and make them a lot harder to read in my opinion.

Do you think being able to modify the data directly from the data view (and it automaically be converted into the right format) would be sufficient? Or what advantage brings your idea over mine?

kitlith commented 3 years ago

I think this could be a useful layout for file types that you are in the middle of writing a pattern for/in the middle of reverse engineering, when you are looking back and forth between the binary data and the interpretation to make sure it looks correct, or are trying to spot where the error you know is present is located. Otherwise, yes, I agree that once you have a polished pattern written it's likely not as helpful.

Flamaros commented 2 years ago

I am actually working on a compiler and I try to generate exe by myself, and it is really hard to find issues I have with the pattern tree separated of the hex view. From what I see in mockups I think it can be much more efficient view to debug generated files.

Maybe it might be possible to a such layout with optional table columns?

And the possibility to indicate the code architecture in the pattern file is also a great idea to have an automatic disassembly view.

github-actions[bot] commented 2 months ago

This issue is marked stale as it has been open for 11 months without activity. Please try the latest ImHex version. (Avaiable here: https://imhex.download/ for release and https://imhex.download/#nightly for development version) If the issue persists on the latest version, please make a comment on this issue again

Without response, this issue will be closed in one month.