ImHex: a hex editor for reverse engineers

What is ImHex?

ImHex is a free, open source hex editor built for reverse engineers, programmers, and anyone parsing binary files at 3 AM. It overlays structure on raw bytes using a custom C-like pattern language, turning a file format into named fields instead of a wall of hex. It also bundles a Capstone-based disassembler and YARA rule scanning in one dark-mode interface, and runs natively on Windows, macOS, and Linux.

Key features of ImHex

• ✓A custom C-like pattern language that parses and highlights a file's structure — arrays, pointers, structs, unions, enums, bitfields, both endiannesses.
• ✓An integrated disassembler built on Capstone, covering ARM32/64, MIPS, x86, PowerPC, SPARC, RISC-V, WebAssembly, and more.
• ✓YARA rule scanning highlights matches directly in the hex view.
• ✓A data inspector that reinterprets the same bytes as integers, floats, LEB128, GUIDs, or timestamps, with live editing.
• ✓A node-based data preprocessor for decrypting or decoding bytes before they hit the hex view, without touching the source file.
• ✓Loads data from local files, raw disks, GDB server memory, running process memory, and remote files over SSH/SFTP.
• ✓Hashing support for a long list of algorithms — MD5, the SHA family, CRC variants, Murmur, XXHash, Blake2, and more.
• ✓A built-in content updater that pulls pattern files, magic files, custom encodings, and themes from the ImHex-Patterns database.

Installing ImHex

The README points to a separate INSTALL.md guide rather than listing package-manager commands inline, so exact install commands aren't clearly documented in the repo's main README. What is documented: Windows 7 or higher is supported (10/11 recommended); macOS needs version 15 (Sequoia) or higher for the release binaries, and since the build isn't signed you'll need to manually allow it in Security & Privacy settings; Linux has official releases for Ubuntu, Debian, Fedora, RHEL/AlmaLinux, and Arch, with AppImage, Flatpak, and Snap covering other distros. ImHex needs a GPU with OpenGL 3.0 support; releases with a -NoGPU suffix are software-rendered and don't need one, though they're slower. Minimum footprint is about 50MiB of RAM and 100MiB of storage.

Alternatives to ImHex

Frequently asked questions

The problem it solves

Reading raw bytes in a hex grid tells you nothing about what they mean until you count offsets by hand or bounce between the hex view, a separate disassembler, and a malware-scanning tool. ImHex folds structure definition, disassembly, and YARA scanning into one editor: you write a pattern file once, describing a header as a struct with named fields, and ImHex applies it automatically based on the file's magic bytes, instead of you re-deriving the layout every time you open a similar file.

Best use cases

• •Reverse engineering an unknown binary or firmware dump by defining its structure with a pattern file instead of guessing offsets by eye.
• •Digital forensics work — carving strings, hashing regions of evidence, and diffing two versions of a file.
• •Parsing proprietary or undocumented file formats and sharing the resulting pattern file with the ImHex-Patterns database.
• •Quick malware triage with YARA rules and the integrated disassembler before reaching for a full disassembler suite.
• •Late-night hex editing where a bright default UI would be the real usability problem.

Who should try it — and who should skip

Try ImHex if you regularly open binary files without a matching viewer — firmware dumps, game saves, unknown container formats — and want to define their structure once instead of re-deriving it by eye each time. Skip it if you mainly need to view or lightly edit hex without ever writing a pattern, since a minimal hex viewer opens faster and asks nothing of you. Malware analysts who already live in Ghidra or radare2 can still use ImHex as a fast first-pass triage tool before switching to a full decompiler.

Related repositories