最近在看內(nèi)核地址轉(zhuǎn)換相關(guān)的內(nèi)容 用到了 hexedit 發(fā)現(xiàn) 沒有相關(guān)的說明，所以自己學(xué)習(xí)后簡單寫一下
hexedit(1) - Linux man page
hexedit 是查看和編輯十六進制或 ASCII 文件的工具

hexedit [-s | --sector] [-m | --maximize] [-h | --help] [filename]

Hexedit 同時以 ASCII 和十六進制顯示文件。文件可以是一個設(shè)備，因為文件是一次讀取一個片段。您可以修改文件并在其中搜索。

可選操作：

-s, --sector 將顯示設(shè)置為包含整個扇區(qū) -m, --maximize 盡量把顯示效果最大化。

快速命令

進入編輯器以后直接按鍵即可操作的命令

移動

<,> : 轉(zhuǎn)到文件的開頭/結(jié)尾
Right: 下一個字符
Left: 前一個字符
Down: 下一行
Up: 前一行
Home: 行的第一個字符
End: 行的最后一個字符
PUp: 向上翻頁
PDown: 向下翻頁

其他命令

F2: 保存
F3: 打開其他文件
F1: 幫助
Ctrl-L: redraw
Ctrl-Z: 暫時停辦（推出后使用fg回來，使用jobs 查看 停辦的任務(wù)）
Ctrl-X:保存并推出
Ctrl-C: 退出不保存
Tab: hex和ascii之間切換
Return: 跳到指定地址（不區(qū)分大小寫）
Backspace: 撤消前一個修改的字符
Ctrl-U: 撤銷所有的修改
Ctrl-S: 向前搜索 16進制值
Ctrl-R: 向后搜索 16進制值

剪切粘貼

Ctrl-Space: set mark
Esc-W: copy
Ctrl-Y: paste
Esc-Y: paste into a file
Esc-I: fill

命令詳解

上下左右箭頭用來移動光標(biāo)一個字符 Ctrl+F, Ctrl+B（上下頁） Ctrl+N, Ctrl+P（上下行） 移動光標(biāo). Ctrl+Right-Arrow, Ctrl+Left-Arrow, Ctrl+Down-Arrow, Ctrl+Up-Arrow 移動 n 次光標(biāo) （有時候沒有用） Esc+Right-Arrow, Esc+Left-Arrow, Esc+Down-Arrow, Esc+Up-Arrow 移動 n 次光標(biāo) Esc+F, Esc+B,（左右N次） Esc+N, Esc+P（上下N次）移動 n 次光標(biāo) Home, Ctrl+A - go the beginning of the line. End, Ctrl+E - go to the end of the line. Page up, Esc+V, F5 - go up in the file by one page. Page down, Ctrl+V, F6 - go down in the file by one page. <, Esc+<, Esc+Home - go to the beginning of the file. >, Esc+>, Esc+End - go to the end of the file (for regular files that have a size). Ctrl+Z - suspend hexedit. Ctrl+U, Ctrl+_, Ctrl+/ - undo all (forget the modifications). Ctrl+Q - read next input character and insert it (this is useful for inserting control characters and bound keys). Tab, Ctrl+T - toggle between ASCII and hexadecimal. /, Ctrl+S - search forward (in ASCII or in hexadecimal, use TAB to change). Ctrl+R - search backward. Ctrl+G, F4 - go to a position in the file. Return - go to a sector in the file if --sector is used, otherwise go to a position in the file. Esc+L - display the page starting at the current cursor position. F2, Ctrl+W - save the modifications. F1, Esc+H - help (show the man page). Ctrl+-, F3 - open another file Ctrl+L - redisplay (refresh) the display (usefull when your terminal screws up). Backspace, Ctrl+H - undo the modifications made on the previous byte. Esc+Ctrl+H - undo the modifications made on the previous bytes. Ctrl+Space, F9 - set mark where cursor is. Esc+W, Delete, F7 - copy selected region. Ctrl+Y, Insert, F8 - paste (yank) previously copied region. Esc+Y, F11 - save previously copied region to a file. Esc+I, F12 - fill the selection with a string Esc+T - truncate the file at the current location Ctrl+C - unconditional quit (without saving). F10, Ctrl+X - quit.

For the Esc commands, it sometimes works to use Alt instead of Esc. Funny things here (especially for froggies 😃 egrave = Alt+H , ccedilla = Alt+G, Alt+Y = ugrave.
Modeline
At the bottom of the display you have the modeline (copied from emacs). As in emacs, you have the indications --, ** and %% meaning unmodified, modified and read-only. Then you have the name of the file you’re currently editing. Next to it is the current position of the cursor in the file followed by the total file size. The total file size isn’t quite correct for devices.
While in --sector mode, it shows the sector the cursor is in.
Editing
You can edit in ASCII or in hexadecimal. You can switch between the two with Tab. When the file is read-only, you can’t edit it. When trying to edit a read-only file, a message (’‘File is read-only’’) tells you it is non-writable.
The modifications are shown in bold until they are saved. The modeline indicates whether you have modified the file or not.
When editing in hexadecimal, only 0,1,…,9, a,b,…,f, A,B,…F are legal. Other keys are unbound. The first time you hit an unbound key, the help pops up. It won’t pop again unless you call the help directly (with F1).
When editing in ascii, you can find it difficult to enter characters like / which are bound to a function. The solution is to use the quoted insert function Ctrl+Q, the key after the quoted insert function is not processed by hexedit (like emacs’ quoted-insert, or like the \ character in C).
Searching
You can search for a string in ASCII or in hexadecimal. You can switch between the two with Tab. If the string is found, the cursor is moved to the beginning of the matching location. If the search failed, a message (’‘not found’’) tells you so. You can cancel the search by pressing a key.
The search in hexadecimal is a bit confusing. You must give a hexadecimal string with an even number of characters. The search can then be done byte by byte. If you want to search a long number (eg: a 32 bit number), you must know the internal representation of that number (little/big endian problem) and give it the way it is in memory. For example, on an Intel processor (little endian), you must swap every bytes: 0x12345678 is written 0x78563412 in memory and that’s the string you must give to the search engine.
Before searching you are asked if you want to save the changes, if the file is edited.
Selecting, copying, pasting, filling
First, select the part of the buffer you want to copy: start setting the mark where you want. Then go to the end of the area you want to copy (you can use the go to function and the search functions). Then copy it. You can then paste the copied area in the current file or in another file.
You can also fill the selected area with a string or a character: start choosing the block you want to fill in (set mark then move to the end of the block), and call the fill function (F12). hexedit ask you the string you want to fill the block with.
The code is not tuned for huge filling as it keeps the modifications in memory until you save them. That’s why hexedit will warn you if you try to fill in a big block.

When the mark is set, the selection is shown in reverse mode.
Be aware that the copied area contains the modifications done at the time of the copy. But if you undo the modifications, it does not change the content of the copy buffer. It seems obvious but it’s worth saying.

Scrolling
The scrolling is different whether you are in --sector mode or not. In normal mode, the scrolling is line by line. In sector mode, the scrolling is sector by sector. In both modes, you can force the display to start at a given position using Esc+L.
See Also
od(1), hdump(1), hexdump(1), bpe(1), hexed(1), beav(1).
Author
Pixel (Pascal Rigaux) pixel@merd.net,
Home page is http://merd.net/pixel/.
Unrestrictions
hexedit is Open Source; anyone may redistribute copies of hexedit to anyone under the terms stated in the GNU General Public License.
You can find hexedit at
http://merd.net/pixel/hexedit-1.2.10.src.tgz and
http://merd.net/pixel/hexedit-1.2.10.bin.i386.dynamic.tgz.

Todo
Anything you think could be nice…
Limitations
There are problems with the curses library given with Redhat 5.0 that make hexedit think the terminal is huge. The result is that hexedit is not usable.
The shortcuts work on some machines, and not on others. That’s why there are many shortcuts for each function. The Ctrl+Arrows and the Alt+. do not work work as they should most of the time. On SUNs, you must do Ctrl+V-Ctrl+V instead of Ctrl+V (!); and the Alt key is the diamond one.

While searching, it could be interesting to know which position the search has reached. It’s always nice to see something moving to help waiting.

The hexadecimal search could be able to search modulo 4 bits instead of 8 bits. Another feature could be to complete padd odd length hexadecimal searches with zeros.

Bugs
I have an example where the display is completly screwed up. It seems to be a bug in ncurses (or maybe in xterm and rxvt)?? Don’t know if it’s me using ncurses badly or not… It seems to happen when hexedit leaves only one space at the end of the lines… If anyone has a (or the) solution, please tell me!
If you have any problem with the program (even a small one), please do report it to me. Remarks of any kind are also welcome.
Referenced By
guestfish(1)

總結(jié)

以上是生活随笔為你收集整理的hexedit详解的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。