63

I have a file, a little bigger than 500MB, that is causing some problems.

I believe the issue is in the end of line (EOL) convention used. I would like to look at the file in its uninterpreted raw form (1) to confirm the EOL convention of the file.

How can I view the "binary" of a file using something built in to Windows 7? I would prefer to avoid having to download anything additional.

(1) My coworker and I opened the file in text editors, and they show the lines as one would expect. But both text editors will open files with different EOL conventions and interpret them automagically. (TextEdit and Emacs 24.2. For Emacs I had created a second file with just the first 4K bytes using head -c4096 on a linux box and opened that from my windows box.

I attempted to use hexl-mode in Emacs, but when I went to hexl-mode and back to text-mode, the contents of the buffer had changed, adding a visible ^M to the end of each line, so I'm not trusting that at the moment.

I believe the issue may be in the end of line character(s) used. The editors my coworker and I tried (1) just automagically recognized the end of line convention and showed us lines. And based on other evidence I believe the EOL convention is carriage return only. (2) return only.

To know what is actually in the file, I would like to look at the binary contents of the file, or at least a couple thousand bytes of the file, preferablely in Hex, though I could work with decimal or octal. Just ones an zeros would be pretty rough to look at.

UPDATE

Except the one suggesting DEBUG, all the answers below work to some extent or another. I have up-voted each of those as helpful. My question was ill-formed. In testing each suggested solution I found I really wanted side by side hex and text contents viewing, and that I wanted it to be something where when I had my cursor over something, either a byte value or the text character, the matching thing on the other side would be highlighted.

I actually solved my problem when Emacs hexl-mode started working "correctly". So I ended up not using any of these answers, only testing them.(Really should investigate the weird Emacs behavior and file a bug-report.)

1
  • Likely there's some sort of tool under Cygwin, but that would require installing Cygwin. Or if you have, eg, Java installed on your box, it would be a fairly simple task to write a hex dump program in Java. Aug 31, 2012 at 3:32

13 Answers 13

15

You need a "hex editor". I've used "Hex Editor Neo" for years and it's very good. It's available in free and paid versions. (And I'm sure there are other similar tools available.)

5
  • 7
    I had asked how, without anything besides Windows 7 because I do not like adding additional programs because 1) Many install in a way that the rights I have do not allow. 2) Some look to be dodgy. That said Hex Editor Neo looks to be a good recommendation. +1 Aug 31, 2012 at 1:22
  • 1
    zblist.com is a standalone program that doesn't need to be installed or need any special rights and has an Alt-H or hex mode
    – sgmoore
    Aug 31, 2012 at 8:33
  • Met all my requirements including stated, misstated, unstated. Hex Editor Neo was fast too, and has been added to my tool bag. Sep 20, 2012 at 0:19
  • 1. Other editors are not native. 2. File managers are good for this purpose and there are plenty around that are portable. 3. Type command can display the content natively and has useful filters (like page by page).
    – Overmind
    May 4, 2017 at 12:30
  • The question was asking for a solution with provided tools in Windows, without external downloads
    – Zimba
    Apr 11, 2020 at 11:11
132

If you have powershell version 5.0 or later, you can use the powershell built-in function Format-Hex

PS:21 C:\Temp >Format-Hex application.exe

            0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

00000000   42 4D 5E 00 00 00 00 00 00 00 36 00 00 00 28 00  BM^.......6...(. 
00000010   00 00 0A 00 00 00 01 00 00 00 01 00 20 00 00 00  ............ ... 
00000020   00 00 00 00 00 00 C4 0E 00 00 C4 0E 00 00 00 00  ......Ä...Ä..... 
00000030   00 00 00 00 00 00 B7 59 71 FF B7 59 71 FF B7 59  ......•Yq.•Yq.•Y 
00000040   71 FF B7 59 71 FF B7 59 71 FF B7 59 71 FF B7 59  q.•Yq.•Yq.•Yq.•Y 
00000050   71 FF B7 59 71 FF B7 59 71 FF B7 59 71 FF        q.•Yq.•Yq.•Yq.
5
  • 15
    I'm frankly surprised that this isn't the top answer. This is THE correct way to do it using a built-in tool in windows. If you want to write the output to a file, you can use >Format-Hex application.exe > out.txt
    – techdude
    Feb 12, 2018 at 20:04
  • This seems nice, but Format-Hex is not available in my PowerShell; I just get a "not recognized" error
    – Kidburla
    Feb 14, 2018 at 16:30
  • 2
    According to JamieSee, it apparently wasn't added until powershell 5.0.
    – techdude
    Feb 15, 2018 at 21:23
  • @techdude: probably because powershell 5.1 format-hex seems to have a bug decoding binary files. A sample test had error displaying offsets 0x290 & 0x7c0 for a 2kB file.
    – Zimba
    Oct 15, 2021 at 7:12
  • How to get the binary only 424D5E...280000000A... instead of 0123456 ... 0000000424D5E...., or the 0123... is truely the binary of file? Mar 15, 2022 at 10:48
33

Built in, quick and dirty: start powershell, execute:

gc -encoding byte -TotalCount 100 "your_file_path" |% {write-host ("{0:x}" -f $_) -noNewline " "}; write-host   

TotalCount is count of bytes you want to read from file.

Google 'powershell hexdump' to get much more polished/workable versions.

If you have Windows Resource Kit Tools (not exactly built in, but close) you may also use a cmd line utility called list.exe. It's a small editor with hex mode. Designed specifically to work with big files:

List Text File Tool (List) is a command-line tool that displays and searches one or more text files. Unlike other text display tools, List does not read the whole file into memory when you open it. It allows a user to edit a text file in a hexadecimal format.

List is useful for displaying text or log files remotely, and for use on servers where administrators are concerned with degradation of system performance.

5
  • 1
    So far, this solution is the closest that I was asking for. Aug 31, 2012 at 1:10
  • 2
    Nice, simple, already installed. I changed the format to write-host ("{0:X2}" to force 0x0A to appear as "0A" not "A", the 2 for 2 digit the upper case because that's how I like it Nov 5, 2013 at 14:01
  • 1
    List.exe was perfect - the list.exe /? help command doesn't give much info, but once inside the editor just hit ? to see commands. H opens the Hex editor, & F1 toggles the way the Hex is displayed
    – Coruscate5
    Mar 22, 2017 at 16:14
  • @ShannonSeverance If this is the closest, what about changing the accepted answer? Jul 6, 2020 at 9:19
  • 1
    @marcellothearcane Because Hex Editor Neo was the answer I used. Jul 6, 2020 at 15:24
15

This also works on everything after XP:

certutil -encodehex MyProgram.exe MyProgram.txt

XP requires the Windows Server 2003 Administration Tools Pack from here :

https://www.microsoft.com/en-us/download/details.aspx?id=16770

3
  • most portable and back compatable solution on the windows, could be used even from windows batch scripts, amazed why is this still is not in the top of all answers
    – Andry
    Sep 9, 2018 at 10:15
  • totally unexpected and surprising solution. My certutil /? doesn't even report -encodehex as an option, yet it works. Excellent!
    – kuma
    Oct 29, 2020 at 10:43
  • Excellent. This worked perfectly. Also completed faster for me than the Powershell Format-Hex commandlet.
    – user497745
    Jul 7, 2022 at 18:58
8

HxD is a portable hex editor, which means no installation necessary, and is nothing more than a single exe file.

http://mh-nexus.de/en/hxd/

Another similarly portable option is Frhed:

http://frhed.sourceforge.net/en/screenshots/

3
  • Nice to have- There are installable and portable editions.
    – pdem
    May 4, 2016 at 15:35
  • I used to HxD but the question is asking for no external downloads. fc /b or certutil is a possible solution to this. JScript or VBScript will also qualify.
    – Zimba
    Apr 11, 2020 at 11:15
  • Active Disk Editor is similar and opens files.
    – pbies
    May 30, 2022 at 16:58
7

Since Windows 7 comes with the dotnet framework 3.5 built in, you will have the C# compiler built in, so you can grab, for example, the listing from http://illegalargumentexception.blogspot.co.uk/2008/04/c-file-hex-dump-application.html and then compile using

  \windows\Microsoft.NET\Framework\v3.5\csc printhex.cs 

and you should end up with a printhex.exe which should display both hex and ascii characters.

2
  • Simple, and no need for gigantic download.
    – live-love
    Sep 17, 2014 at 18:13
  • 1
    lol that's quite a bit of code for a 'simple file'
    – Zimba
    Apr 8, 2020 at 16:15
6

Copy the file to a name with a .COM extension, where the base name is no longer than eight characters.  Run

DEBUG your_filename

It will give a '-' prompt.  Type

DEnter

repeatedly to display the file 128 bytes at a time.  Type

D address Enter

to display 128 bytes starting at address, which must be typed in hex, where the beginning of the file is address 100.  Type

D address1 address2 Enter

to display from address1 to address2.  Type

D address Lnum Enter

to display num bytes (length) starting at addressnum is also entered in hex.  Use Q to quit.

For example,

C:\Users\scott\Documents> debug thispost.com
-d
0BE4:0100  43 6F 70 79 20 74 68 65-20 66 69 6C 65 20 74 6F   Copy the file to
0BE4:0110  20 61 20 6E 61 6D 65 20-77 69 74 68 20 61 20 2E    a name with a .
0BE4:0120  43 4F 4D 20 65 78 74 65-6E 73 69 6F 6E 2C 20 77   COM extension, w
0BE4:0130  68 65 72 65 20 74 68 65-20 62 61 73 65 20 6E 61   here the base na
0BE4:0140  6D 65 20 69 73 20 6E 6F-20 6C 6F 6E 67 65 72 20   me is no longer
0BE4:0150  74 68 61 6E 20 65 69 67-68 74 20 63 68 61 72 61   than eight chara
0BE4:0160  63 74 65 72 73 2E 0D 0A-52 75 6E 20 44 45 42 55   cters...Run DEBU
0BE4:0170  47 20 2A 79 6F 75 72 5F-66 69 6C 65 6E 61 6D 65   G *your_filename
-d
0BE4:0180  2A 0D 0A 49 74 20 77 69-6C 6C 20 67 69 76 65 20   *..It will give
0BE4:0190  61 20 27 2D 27 20 70 72-6F 6D 70 74 2E 0D 0A 54   a '-' prompt...T
0BE4:01A0  79 70 65 20 44 20 45 6E-74 65 72 20 72 65 70 65   ype D Enter repe
0BE4:01B0  61 74 65 64 6C 79 20 74-6F 20 2A 2A 64 2A 2A 69   atedly to **d**i
0BE4:01C0  73 70 6C 61 79 20 74 68-65 20 66 69 6C 65 20 31   splay the file 1
0BE4:01D0  32 38 20 62 79 74 65 73-20 61 74 20 61 20 74 69   28 bytes at a ti
0BE4:01E0  6D 65 2E 0D 0A 54 79 70-65 20 44 20 5F 61 64 64   me...Type D _add
0BE4:01F0  72 65 73 73 5F 20 74 6F-20 64 69 73 70 6C 61 79   ress_ to display
-d 200 L16
0BE4:0200  20 31 32 38 20 62 79 74-65 73 20 73 74 61 72 74    128 bytes start
0BE4:0210  69 6E 67 20 61 74                                 ing at
-
11
  • 5
    Unfortunately that won't work if the file is larger than about 64KB, the max for a .COM. (It has to fit in the segment starting at offset 100h.)
    – Ken
    Aug 31, 2012 at 0:18
  • 1
    C:\>attrib debug.exe /s. Results: File not found - debug.exe. Was unable to find official, debug is no longer supported statement, but from what I saw on the web it looks like debug support has been dropped awhile ago. I found DebugDiag from Microsoft. (Extra download.) Debugging? Maybe it supports looking at files in HEX? Delivered as an .MSI file. Needs an admin password to install. I'm not one. Aug 31, 2012 at 0:23
  • @Ken I had already used head -c4096 bigFileName > smallFileName on linux to get the first 4 KB of the files. Lines are small enough that four KB has plenty of lines for my purposes Aug 31, 2012 at 0:34
  • So why not use hexdump -C while on Linux?
    – Ken
    Aug 31, 2012 at 0:47
  • 3
    @Shannon debug is part of DOS, and as such, if you are using x64, it is not there.
    – kinokijuf
    Aug 31, 2012 at 5:27
3

It is not ideal, but if you really don't want to download anything, then you could try using fc /b (ie file compare in binary mode) to compare this file with another completely different file, and it will show you the hex values of each byte that is different. You will may get some values that happen to be the same in the two files and so may be skipped from the output, but you can tell if that happens by checking for missing values in the offset column.

2
  • 1
    Not ideal, but I was able to do so by creating a file of 0x00 bytes and then compare against that. Being a text file that I was looking at, and that I was interested in 0a and 0d mostly a file of nulls as comparison worked. But it doesn't provide both the character view and hex view side by side made finding where I wanted to look harder. (As debug does in Scott's answer and as Emacs's hexl-mode does. I had not asked for side by side view, but it's pretty crucial for how I actually use hex dumps.) Aug 31, 2012 at 0:47
  • When I compare files with fc /b 2 1, I get result: FC: 2 longer than 1. 1 is a zero byte file. Why don't I see any hex values?
    – Zimba
    Apr 8, 2020 at 16:04
2

You can use the PowerShell function below along with Get-Content to see a hexdump of the file contents, i.e., Get-Content -Encoding Byte 'MyFile.bin' | Format-HexDump. It takes about 23 seconds to dump a 222 KB file and, if desired, the output can be redirected to a text file to make examining the dump easier.

$encodingAutoCompleter = {
    param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)
    $availableEncodings = ([System.Text.Encoding]::GetEncodings() | Select Name, CodePage, DisplayName) + @( [PSCustomObject] @{ CodePage = '20127'; Name = 'ascii'; DisplayName = 'US-ASCII' }, [PSCustomObject] @{ CodePage = '1200'; Name = 'unicode'; DisplayName = 'Unicode' } )
    $availableEncodings | ?{ $_.Name.StartsWith($wordToComplete) } | %{ New-Object System.Management.Automation.CompletionResult -ArgumentList $_.Name, $_.Name, 'ParameterValue', "$($_.DisplayName). Code Page $($_.CodePage)." }
}

function Format-BufferText([byte[]] $buffer, [System.Text.Encoding] $displayEncoding, [switch] $useControlPictures)
{
    $bufferChars = $displayEncoding.GetChars($buffer);
    $bufferText = (($bufferChars | %{ if ([char]::IsControl($_) -eq $true) { if ($useControlPictures -eq $false) { '.' } else { [char] ($_.ToInt16([cultureinfo]::InvariantCulture) + 0x2400) } } else { "$_" } }) -join "")

    $bufferText
}

<#
    .Synopsis
    Displays binary data as a hexadecimal dump.

    .Description
     Displays binary data as a hexadecimal dump. Options are available to suppress displaying text and to display control characters 
     as Unicode Control Pictures instead of dots.

    .Parameter Bytes
    The bytes to be displayed.

    .Parameter Encoding
    The name of the text encoding to use. The default is ascii.

    .Parameter NoTextDisplay
    If specified the text display sidebar will be suppressed; otherwise, the display text sidebar will be present.

    .Parameter UseControlPictures
    If specified control characters will be displayed as Unicode Control pictures; otherwise, dots are used to represent control 
    characters.

    .Example
    Format-HexDump -Encoding unicode $bytes

    .Example
    Get-Content -Encoding Byte 'MyFile.bin' | Format-HexDump -Encoding unicode

    .Example
    0..255 | Format-HexDump -NoTextDisplay
#>
function Format-HexDump
{
    [CmdletBinding()]
    param
    (
        [Parameter(ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [byte[]] $Bytes,
        [ValidateScript({ if (([System.Text.Encoding]::GetEncodings().Name + @('unicode', 'ascii')) -icontains $_) { return $true } else { Throw "Encoding must be one of the following: $([System.Text.Encoding]::GetEncodings().Name -join ', '), unicode, or ascii." } })]
        [Parameter(ValueFromPipeline = $false)]
        [string] $Encoding = "ASCII",
        [Parameter()]
        [switch] $NoTextDisplay,
        [Parameter()]
        [switch] $UseControlPictures
    )

    BEGIN
    {
        $displayEncoding = [System.Text.Encoding]::GetEncoding($Encoding)

        $counter = 0
        $hexRow = ""
        [byte[]] $buffer = @()
    }

    PROCESS
    {
        foreach ($byte in $Bytes)
        {
            $buffer += $byte
            $hexValue = $byte.ToString("X2")

            if ($counter % 16 -eq 0)
            {
                $buffer = @($byte)
                $hexRow = "$($counter.ToString("X8")): $($hexValue) "
            }
            elseif ($counter % 16 -eq 15)
            {
                if ($NoTextDisplay -eq $true)
                {
                    $hexRow += "$($hexValue)"
                    $hexRow
                }
                else
                {
                    $bufferText = Format-BufferText $buffer $displayEncoding $UseControlPictures
                    $hexRow += "$($hexValue)   $($bufferText)"
                    $hexRow
                }
            }
            else
            {
                $hexRow += "$($hexValue) "
            }

            $counter++
        }
    }

    END
    {
        $counter--

        if ($counter % 16 -ne 15)
        {
            $hexRow += " " * (((16 - $counter % 16) * 3) - 1)

            if ($NoTextDisplay -eq $false)
            {
                $bufferText = Format-BufferText $buffer $displayEncoding $UseControlPictures
                $hexRow += "$($bufferText)"
            }

            $hexRow
        }
    }
}

Register-ArgumentCompleter -CommandName Format-HexDump -ParameterName Encoding -ScriptBlock $encodingAutoCompleter

Output looks like this:

00000000: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F   ................
00000010: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F   ................
00000020: 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F    !"#$%&'()*+,-./
00000030: 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F   0123456789:;<=>?
00000040: 40 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F   @ABCDEFGHIJKLMNO
00000050: 50 51 52 53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F   PQRSTUVWXYZ[\]^_
00000060: 60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F   `abcdefghijklmno
00000070: 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F   pqrstuvwxyz{|}~.
00000080: 80 81 82 83 84 85 86 87 88 89 8A 8B 8C 8D 8E 8F   ????????????????
00000090: 90 91 92 93 94 95 96 97 98 99 9A 9B 9C 9D 9E 9F   ????????????????
000000A0: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF   ????????????????
000000B0: B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 BA BB BC BD BE BF   ????????????????
000000C0: C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF   ????????????????
000000D0: D0 D1 D2 D3 D4 D5 D6 D7 D8 D9 DA DB DC DD DE DF   ????????????????
000000E0: E0 E1 E2 E3 E4 E5 E6 E7 E8 E9 EA EB EC ED EE EF   ????????????????
000000F0: F0 F1 F2 F3 F4 F5 F6 F7 F8 F9 FA FB FC FD FE FF   ????????????????
3
  • 1
    Or just use Format-Hex filename
    – techdude
    Feb 12, 2018 at 20:05
  • @techdude Format-Hex is not available in all versions of PowerShell. It does not exist in PowerShell 4 and earlier. I wrote this code before Format-Hex ever existed.
    – JamieSee
    Feb 15, 2018 at 21:08
  • How to reverse this back to the binary file?
    – Zimba
    Aug 24, 2019 at 17:19
1

As Sublime text is my favorite editor, I use its plugin to view hex files. http://facelessuser.github.io/HexViewer/

HexViewer

0

I know you are using Emacs but Vim users can use xxd utility:

xxd -s <start_offset> -l <length_offest> <file>

i.e.

Usage:
       xxd.exe [options] [infile [outfile]]
    or
       xxd.exe -r [-s [-]offset] [-c cols] [-ps] [infile [outfile]]
Options:
    -a          toggle autoskip: A single '*' replaces nul-lines. Default off.
    -b          binary digit dump (incompatible with -ps,-i,-r). Default hex.
    -c cols     format <cols> octets per line. Default 16 (-i: 12, -ps: 30).
    -E          show characters in EBCDIC. Default ASCII.
    -g          number of octets per group in normal output. Default 2.
    -h          print this summary.
    -i          output in C include file style.
    -l len      stop after <len> octets.
    -ps         output in postscript plain hexdump style.
    -r          reverse operation: convert (or patch) hexdump into binary.
    -r -s off   revert with <off> added to file positions found in hexdump.
    -s [+][-]seek  start at <seek> bytes abs. (or +: rel.) infile offset.
    -u          use upper case hex letters.
    -v          show version: "xxd V1.10 27oct98 by Juergen Weigert (Win32)".
0

In Windows PowerShell:

PS C:\Users\YourName\Desktop>Format-Hex file.dll

Or its shorter form:

PS C:\Users\YourName\Desktop>fhx file.dll

Alternatively, if you prefer to have the hexdump command available, create a batch script that works with both PowerShell and Command Prompt:

  • Create a file called hexdump.bat with the following content:
@echo off
powershell Format-Hex %*
  • Copy it to C:\Windows\System32 (requires admin rights)

  • Use it via PowerShell or Command prompt

C:\Users\YourName\Desktop>hexdump file.dll


           Path: C:\Users\YourName\Desktop\file.dll

           00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
00000000   4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00  MZ.............
00000010   B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00  ¸.......@.....
...
0

To view in decimal:
comp File1 File2 /D /m
(similar to gc -encoding byte File1 in powershell)

To view in hex:
fc /b File1 File2
(similar to gc -encoding byte File1 |% {write-host ("{0:X2}" -f $_)} in powershell)

NB:
File2 is a reference file with no similar characters to File1
If unsure, then a workaround would be to fill File2 with 0x20, then for 2nd comparison fill File2 with 0x00 and replace the missing characters with 0x20 (in the 1st comparison)
(Or just fill the missing offsets with 0x20 in lieu of 2nd comparison)

Update: 15 Oct 2021

powershell 5.1 format-hex seems to have a bug decoding binary files. A sample test had error displaying offsets 0x290 & 0x7c0 for a 2kB file.

Sample output:

00000280   5B E3 6D 67 2E D9 03 AB 0A DF D7 73 7A 3F 61 9B  [ãmg.Ù.«.ß×sz?a
E 4C FB 38 46 91 C7 13 42 92 C7 8A B4 DF E8 6A  ÞLû8FÇ.BÇ´ßèj
000002A0   00 0C 3D 68 50 9D D4 9C 1C 92 DB F0 B5 79 5F 4A  ..=hPÔ.Ûðµy_J
.
.
.
000007B0   5C F1 20 1F D8 8E EA 9B 03 91 EF 20 87 A4 4D 9B  \ñ .Øêï ¤M
0   A5 54 30 1D CC 4F 56 31 C5 39 15 2E 3A A8 8D BC  ¥T0.ÌOV1Å9..:¨¼
000007D0   B1 BA 8D 30 58 F5 DE 4F DD 8C 4B 34 22 D5 27 6A  ±º0XõÞOÝK4"Õ'j

certutil works well.

Tested on Win 10 x64

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .