General

Menus have hotkeys, they are being presented in a different color. To jump from one menu item to the next, the cursor keys or the TAB key can be used.

Input fields can be closed by pressing ESC, ENTER, or any cursor key. Only pressing ESC will not save the changes made in there.

The keyboard setup

When running dhex for the first time, without any configfile present, or with the parameter -k, the first screen shown is that of the keyboard setup. In this screen, the program asks the user to press certain keys. Which are (in order) ESCAPE, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, BACKSPACE, DEL, ENTER, TAB, UP, DOWN, RIGHT, LEFT, PG UP, PG DOWN, HOME, END. It also tells the user what it intends to do with those keys later. So the user can decide on any alternative he chooses. If he does not want to bind a specific function to a certain key, he can simply press ESCAPE and skip to the next question.

After pressing all the keys, the user can chose whether or not to write those keys into the config file.

The main screen

The main screen is broken down into three columns: The first column contains the offset within the file for the current line. The second column contains the bytes in the file in hex format. Finally, the third coumn contains the same bytes, but this time in ascii format. If a byte is not printable, it is being substituted with a '.'. How many bytes are are being shown in a line depends on the width of the terminal. For example, if the terminal is 80 characters wide, 16 bytes are being shown in each line.

If no other [-o] or [-a] parameter was given at start time, the cursor is being set to offset 0. It is also being shown in the hex column. Here, it can be moved with the cursor keys. When entering a hexadecimal number, the file is being edited. The file can be edited in the ascii column as well, simply by pressing the TAB key (or whichever key was substituted for it in the keyboard setup). Pressing TAB again will return the cursor to the hex column. Pressing F9 (or its substitute) will undo the last of the changes. Changes are being shown in a different color.

Editing is not possible in the diff mode. Here, pressing the cursor keys will move both files synchronously.

The goto screen

Pressing F1 (or its substitute) will open the Goto... screen. Here, it is possible to jump to a specific address directly, without the need of scrolling there with the cursor keys. The address can be entered in the 'To' field, either absolute or relative (to leap over a specified amount of bytes). An absolute address is being chosen by pressing '=', and a relative one by pressing '+' or '-', for a positive or negative leap respectively. Regardless of the addressing mode, it has to be entered as a hexadecimal number.

It is also possible to set up to ten bookmarks in this screen: Pressing '0'...'9' will select one of them. Moving the cursor to "Set" and pressing ENTER will alter one of those book marks. The "Diff:" fields are showing the difference between the actual cursor position and the bookmark.

Bookmarks can be stored and loaded, for this there are the "Save Markers" and "Load Markers" items on the bottom. Upon selecting one of them, the user is being prompted for a filename. It is possible to load a marker file at start time, by providing the [-m markerfile] parameter. dhex_markers(5) describes the format of the marker files.

Searching

Pressing F2 (or its substitute) will open the Search... screen. Here, a short string can be entered (either in hex, or in ascii). If no logfiles are being selected, the cursor will jump to the next occurrence of this search string upon selection of "Go". It can be chosen if the search is supposed to be conducted forward of backwards.

To jump to the next occurrence, F3 (or its substitute) has to be pressed. To jump to the previous one, F4 has to be pressed. The search itself wraps at the edges of the file, meaning that when it reaches the end, it will start from the beginning and vice versa.

Searchlogs are an advanced way of searching: Writing to the searchlog does not jump the cursor from one occurrence to the next. Instead, it will write the offsets of all of them into the logfile. Their format is described in dhex_searchlog(5).

Reading from this searchlog means that the search does not cover the whole file: Only the addresses which have been provided in this file are being searched. Thus it is possible to search for specific changes. Like for example the number of lives stored in the save file of a game. dhex_searchlog(5) describes the format of the searchlog.

HexCal

Pressing F5 (or its substitute) will open a small 64 bit calculator. This calculator is capable of not only performing arithmetic operations (+, -, *, /, modulo), but also logic ones. (and, or, xor, shift). There are three columns to enter numbers as hexadecimals, decimals or in binary format. Pressing 'x' will close this screen. Using the command line argument [-x] will start it from the commandline.

Correlation

When dhex(1) is running in diff mode, pressing F6 (or its substitute) will open the dialog for file correlation. This will try to find the optimal offset between the two files. There are three algorithms available for finding this offset: Searching for the best match (as many bytes as possible are the same), the longest match (as many consecutive bytes match as possible), or the minimum difference (as little differences between the bytes as possible).

Even though it seems like the same at first, looking for the minimum difference is in fact faster. This can be improved even more, if the user sets an upper difference limit.

Upon selecting Go, the program will search for the optimal offset. This will take some time.

Saving and quitting

Pressing F10 (or its substitute) will close dhex. In case there have been changes made to the file, a save dialog opens up. Here, it is possible to select whether or not to write the changes back into the file.