CFS258 Chapter 3 | Hex Editor Workbench

Guided practice

Eight tasks build from one byte to a field inside a volume.

0 of 8 tasks complete

Choose a task

training-01.raw

Synthetic bytes

Enter an offset and a selection length (1–64 bytes). The first byte is offset 0. Hexadecimal accepts an optional 0x prefix.

A4 Filled cells are selected. The inset border marks the active byte.

Mouse, keyboard, and selection help

Click a byte to select it. Shift-click another byte to select a range. In the byte grid, arrow keys move one byte horizontally or one row vertically. Hold Shift with an arrow key to extend a selection. Home and End move to the row edges. Page Up and Page Down move 256 bytes. Selections can contain up to 64 bytes.

Use Tab to leave the grid. The offset form provides the same selection functions without using the grid. On a narrow screen, scroll the byte table sideways.

Changing the number base converts a valid offset input. Changing the origin keeps the selected destination when possible, or sets the input to zero if the selection precedes the new origin. Press Go / select to apply the input. An ASCII dot represents a byte outside the printable ASCII range; a literal period also displays as a dot.

Data interpreter (optional learning aid)

Interpret the selected bytes as an unsigned whole number. Use this after trying the conversion yourself.

Byte order

Working reference

Offsets, fields, and byte order

Offset: A byte's position from a chosen starting point. Offsets start at zero. In a 512-byte sector, the final byte has offset 511 (0x1FF).
Row plus column: The address at the left identifies the row's first byte. Add the column value: 0x30 + 0x0B = 0x3B.
Absolute and relative offsets: An absolute image offset starts at the beginning of the image. A structure-relative offset starts at the beginning of a structure. Add the structure's image offset to the relative offset to locate its bytes.
Byte and field widths: One byte contains eight bits and appears as two hex digits. In this activity, a word is 2 bytes, a double-word (DWORD) is 4 bytes, and a quad-word (QWORD) is 8 bytes. Use the width specified by the field's format.
Little-endian: The least significant byte comes first. To read 78 56 34 12 as a four-byte little-endian value, place the bytes in significance order: 0x12345678. Keep the two digits inside each byte together. A one-byte field needs no byte reversal.
Selection length: Both endpoints are included. Length = last offset − first offset + 1. Four bytes starting at 0x1FE end at 0x201.

Training data and interpretation limits

This activity contains selected, fictional structures inside a virtual byte space. It is a read-only navigation and interpretation exercise, not a complete mountable filesystem or a replacement for HxD. Navigation never accesses your disks.

The volume boot record contains geometry fields used by the filesystem. The supplied directory entry is a separate training record. Its location comes from the exercise brief. This activity does not derive its location or reconstruct a file's allocation.

A 55 AA byte pair or a readable filesystem label is a clue. Neither alone proves a structure is valid. A file-size field establishes a size value, not proof of transfer, file type, or intent.