Metadata-Version: 2.4
Name: hiew
Version: 1.0.2
Summary: Hiew - cross-platform Hacker's View: hex viewer, editor and disassembler for the terminal
Author-email: s1ngs0ng <7ingsong@gmail.com>
License-Expression: MIT
Project-URL: Homepage, https://github.com/7ingsong/hiew
Project-URL: Source, https://github.com/7ingsong/hiew
Project-URL: Issues, https://github.com/7ingsong/hiew/issues
Project-URL: Documentation, https://github.com/7ingsong/hiew#readme
Keywords: hiew,hex,hex-editor,hex-viewer,disassembler,reverse-engineering,pe,elf,mach-o,curses,tui
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console :: Curses
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Operating System :: MacOS
Classifier: Operating System :: Microsoft :: Windows
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Disassemblers
Classifier: Topic :: Utilities
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: capstone>=5
Requires-Dist: windows-curses>=2.3; sys_platform == "win32"
Provides-Extra: asm
Requires-Dist: keystone-engine; extra == "asm"
Dynamic: license-file

# Hiew — cross-platform Hacker's View

A console hex viewer, hex editor and disassembler with the modes, hotkeys and blue screen of **Hiew (Hacker's View)**.
Runs on macOS, Linux and Windows.

![Decode mode: arm64 code of /bin/ls](https://raw.githubusercontent.com/7ingsong/hiew/main/docs/decode.png)

*Decode mode on `/bin/ls` (arm64 slice of a universal Mach-O), at the entry point.*

![Hex mode: symbol strings of /bin/ls](https://raw.githubusercontent.com/7ingsong/hiew/main/docs/hex.png)

*Hex mode on the same file: address, 16 bytes in hex, the same bytes as characters.*

## Installation

Requires Python 3.9+.

```sh
pip3 install hiew                 # macOS / Linux / Windows (windows-curses is pulled in on Windows)
python3 -m hiew /bin/ls
```

The built-in assembler (F3 → F2) needs the keystone library:

| System | Command |
|---|---|
| macOS | `brew install keystone` |
| Linux | `apt install libkeystone0` (or your distribution's keystone package) |
| Windows | `pip install "hiew[asm]"` (installs `keystone-engine`) |

Everything else works without it. From a source checkout: `pip install .`, or `python -m hiew file`.

## What is supported

- **Formats:** PE32/PE32+ (x86, x64, ARM, ARM64) with imports and exports; ELF32/64 (LE/BE) with symtab/dynsym,
  GOT slot names, PLT stubs and DT_NEEDED libraries; Mach-O 32/64 and universal (fat) binaries with imports
  (stubs / GOT via the indirect symbol table), exports and libraries; DOS MZ. Other files open as raw data.
- **Disassembler:** capstone — x86-16/32/64, ARM/Thumb, ARM64, MIPS, PowerPC, RISC-V. Branch targets are shown as
  Hiew addresses (`.00401234`), `[rip+X]` is resolved to an absolute address, ARM64 `adrp` + `add`/`ldr` pairs
  are resolved too. Comments show import and symbol names, `@plt` stubs and the strings (ASCII and UTF-16) the code
  refers to.
- **Reference search (F6, imports):** byte-pattern scanning confirmed by the disassembler instead of disassembling the
  whole file — x86 `call`/`jmp`/`jcc`, `[rip+X]`, absolute addresses and jump tables; ARM64 B/BL, B.cond, CBZ/TBZ,
  ADR, literal loads and ADRP pairs. Counts match `otool` on large libraries; about 3 s on a 285 MB `libclang.dylib`.
- **Large files** are memory-mapped and never read into memory as a whole; edits are kept as patches.
