What Hexanot Actually Does
Hexanot is a hex editor and binary analysis tool primarily used for reverse engineering, malware analysis, and low-level file inspection. It isn't something most people outside security work ever touch, which is probably why documentation on it is thin and scattered across forums rather than coming from an official website. The core of the program is straightforward: you open a binary file, get a hex dump alongside ASCII representation, and can modify raw bytes directly. From there, it adds features like structure templates, byte search with regex support, and basic disassembly integration depending on the build.
Hexanot Download and Setup
The download exists on GitHub but the releases page is outdated in places. I ran into trouble with the installer on Windows 11 because the bundled dependencies for the disassembly module don't include the right version of Capstone. Download the latest release ZIP instead of the installer, extract it, and grab the DLLs from the repo's deps folder. Without those, the disassembly view stays blank and the program runs fine otherwise. If you need the raw binary analysis without the disassembly layer, the standalone executable works on its own. That's what most people actually need, honestly. The fancy FEAT-disassembly UI is nice until it doesn't and you spend an hour debugging missing libraries.
Practical Usage: Opening and Analyzing a File
Open Hexanot and drag your target file into the window. You'll see the standard split view: hex bytes on the left, character mapping on the right. Use Edit > Find to search for string patterns or raw byte sequences. The regex option works but has limitations. It won't handle multi-line matching across buffer boundaries the way you might expect from a proper hex tool like xxd or HxD. Here's where things get useful. If you're looking at a custom binary format, Hexanot lets you define a structure template. I built one once for a game save file that used a repeating header-record pattern. The template engine parses each block and displays fields with correct offsets. It's not as polished as what IDA or Radare2 offer, but for quick ad-hoc work it saves you from manually calculating offsets each time.
Edge Case I Ran Into
Working with a packed executable last year, I hit a bug where Hexanot would silently corrupt the file if you edited bytes beyond the original file size and then saved. The program doesn't pad the file with null bytes before writing. It just overwrites from the existing buffer boundary and truncates everything after. I lost about three hours of work on that one before I figured out what happened. The workaround is simple enough: before making edits that extend past EOF, use Edit > Insert Bytes to expand the file first, or manually set the new size through the Preferences panel. If you forget, make a backup copy of the original file before any editing session. Always.
Limitations You Should Know
Hexanot is not a full reverse engineering suite. Don't expect to replace IDA Pro or Ghidra with it. The disassembly is basic, it doesn't do cross-reference analysis, and the scripting API is minimal. For large files above roughly 500MB, the UI starts lagging noticeably because it loads the entire file into memory rather than using memory-mapped I/O. It also lacks undo history beyond the immediate previous action. One mistaken edit and you're back to your backup. I know that sounds obvious but the program gives no visual warning about that limitation. For casual hex editing and light binary inspection, it does the job at zero cost. For anything involving serious malware analysis or production reverse engineering work, you're better off with established tools. Hexanot fills a narrow niche and does it adequately within that niche. Just be aware of where that niche ends before you rely on it for something bigger.
