10

Why is it that if you open up an EXE in a hex editor, you will see all sorts of things. If computers only understand binary then shouldn't there only be 2 possible symbols seen in the file? Thanks

Michael Petrotta
  • 59,888
  • 27
  • 145
  • 179
jmasterx
  • 52,639
  • 96
  • 311
  • 557
  • 45
    Because you opened it with a HEX editor -- so it's in HEX. Open it up with a binary editor and you'll get your beloved zeros and ones. – Billy ONeal Mar 19 '10 at 22:45
  • 17
    I don't get why people are down voting this. It's a common mistake to misunderstand content and how it's represented. Just because you find the question trivial doesn't make it less of a question. – GManNickG Mar 19 '10 at 22:51
  • 3
    I guess you mean the "ascii" display in the hexeditor. Not many will understand raw HEX I imagine – epatel Mar 19 '10 at 22:51
  • @Gman: agreed, there are some mean-ass people roaming this site downvoting things for no apparent reason other than to be mean. – Todd Main Mar 19 '10 at 22:57
  • 4
    @epatel: What would "raw" HEX be, then? – T.J. Crowder Mar 19 '10 at 23:00
  • @Otaku: Change is in the air: http://blog.stackoverflow.com/2010/03/important-reputation-rule-changes/ "after casting 300 votes, you cannot downvote non community wiki posts at more than a 2:1 ratio" – Michael Petrotta Mar 19 '10 at 23:02
  • @T.J Crowder Hex is often written as 0xnn ie 0x12 for the value 18 (decimal). Strings stored in ascii ie `A113` would be `0x41 0x31 0x31 0x33` in "raw hex" – epatel Mar 19 '10 at 23:05
  • @Michael: Interesting. From the blog: *"realize that this will affect very, very few users — on the order of about 6 users out of 100,000+ on Stack Overflow"* So that's...9 users then. http://stackoverflow.com/users Wow that's targeted. Still probably a good idea, though. – T.J. Crowder Mar 19 '10 at 23:07
  • 3
    @epatel: Your distinction misses the point. File hex editors display the "raw" hex value of the file (`41 31 31 33` in your example). Sometimes they'll also display the contents interpreted as ASCII to one side, but that's what people are talking about here. – Michael Petrotta Mar 19 '10 at 23:10
  • 1
    @epatel: And that's what he's going to be seeing in a *hex editor* (minus the extraneous and language-specific `0x` prefix). Still not getting your point. He's certainly *not* looking at the ASCII character corresponding to that value. In a hex editor, a byte with the value 65 decimal will be shown in a hex editor as `41`, *not* `A`. – T.J. Crowder Mar 19 '10 at 23:10
  • @Michael Petrotta Did you read my comment I posted 18 min before yours? – epatel Mar 19 '10 at 23:13
  • @epatel: True that many (not all) hex editors *also* show ASCII to the side. – T.J. Crowder Mar 19 '10 at 23:15
  • @T.J. Crowder The hexeditors I have used have always shown the memory as ascii too, often just to the right of the hex values. – epatel Mar 19 '10 at 23:15
  • 1
    @epatel: I didn't read it closely enough. So, you're calling "41 31 31 33" the "raw hex"? No one here is using a hex editor to look at its ASCII interpretation, I'll wager. Their point *is* the "raw hex" display. – Michael Petrotta Mar 19 '10 at 23:18
  • @Michael Petrotta I often use a hexeditor to search for ascii strings in binary files. There is even a hexl-mode in emacs for it. Reading hex values and trying to figure something out is something I would never do, I'd even write my own run'n'throwaway tool to get useful data out of a binary file. Want an easy to use hexdump snippet? http://stackoverflow.com/questions/29242/off-the-shelf-hex-dump-code/29865#29865 – epatel Mar 19 '10 at 23:26
  • @epatel: Fair enough. I use a text editor or `strings` to search for strings in binary files - my editor's not tripped up by non-printable characters. I use a hex editor to read non-ASCII files. Then again, I used to be able to predict the connect speed of my modem by listening to the whistles, so to each their own. – Michael Petrotta Mar 19 '10 at 23:31

8 Answers8

32

You're confusing content with representation. Every single file on your computer can be represented with binary (1s and 0s), and indeed that's how it's generally stored on disk (alignment of magnetic particles) or RAM (charge).

You're viewing your exe with a "hex editor", which represents the content using hexadecimal numbers. It does this because it's easier to understand and navigate hex than binary (compare "FA" to "11111010").

So the hexadecimal symbol "C0" represents the same value as the binary "11000000", "C1" == "11000001", "C2" == "11000010", and so on.

Michael Petrotta
  • 59,888
  • 27
  • 145
  • 179
15

The hexadecimal values are interpreted binary values in memory. The software only make it a bit more readable to human beings.

0000 = 0
0001 = 1
0010 = 2
0011 = 3
0100 = 4
0101 = 5
0110 = 6
0111 = 7
1000 = 8
1001 = 9
1010 = 10 A
1011 = 11 B
1100 = 12 C
1101 = 13 D
1110 = 14 E
1111 = 15 F

nelaaro
  • 3,006
  • 5
  • 38
  • 56
Klaim
  • 67,274
  • 36
  • 133
  • 188
  • Ok so then there is actually 8 * more stuff, its just that it makes an ascii and therein hex version of the binary? – jmasterx Mar 19 '10 at 22:45
  • No, usually a byte will be represented by 2 hex values (4 bits to a HEX char) that can be converted directly to binary. Converting to ASCII would result in a lot of values that couldn't be rendered, also, it wouldn't be in HEX... – Chris Thompson Mar 19 '10 at 22:48
  • 2
    @user146780: Each hexadecimal digit is worth four binary bits. That's two place values to the byte. For example, the ASCII code for upper-case J is "4A." Most hex editors will also show printable characters if they exist in the code. – Max E. Mar 19 '10 at 22:49
7

Computers don't only understand binary, that's a misconception. At the very lowest, lowest, lowest level, yes, data in digital computers is a series of 1s and 0s. But computer CPUs group those bits together into bytes, words, dwords, qwords, etc. The basic unit dealt with by a modern CPU is a dword or a qword, not a bit. That's why they're called 32-bit or 64-bit processors. If you want to get them to work with a single bit, you pretty much end up including 31 or 63 extraneous bits with it. (It gets a bit blurry when you start dealing with flag registers.)

Digital computers really came into their own as of 8-bit processors, so hexadecimal became a very useful display format as it succinctly represents a byte (8 bits) in two characters. You're using a hex editor, so it's showing you hex, and because of this early byte-orientation, it's showing you two characters for every 8 bits. It's mostly a display thing, though; there's little reason it couldn't show you one character for every 4 bits or four characters for every 16 bits, although file systems generally work on byte granularity for actual data (and much, much larger chunks for storage allocation granularity -- almost always 4k or more).

T.J. Crowder
  • 1,031,962
  • 187
  • 1,923
  • 1,875
2

This character A you see here on the screen is just a pattern made of ones and zeros. It's how we all cooperate by all the standards that make all ones and zeros making patterns ending up on the screen understandable.

The character A can have the value 65. In binary this is 0100 0001 but on the screen it might be the pattern

   ##
  #  #
  ####
  #  #
  #  #

In a exe file a lot of stuff is stored in various formats, floats, integers and strings. These formats are often used as they will easily be read directly by the computer without further conversion. In a Hex editor you will often be able to read strings that happen to be stored in the exe file.

In a computer everything's binary

epatel
  • 45,805
  • 17
  • 110
  • 144
1

Each character (byte) in the file represents 8 bits (8 ones or zeroes). You don't see bits, you see bytes (and larger types).

robert4
  • 1,072
  • 15
  • 20
UncleBens
  • 40,819
  • 6
  • 57
  • 90
  • 2
    Except when displayed in a hex viewer as in the question, each hex digit represents 4 bits of the binary file. – Clifford Mar 19 '10 at 23:24
1

There are only two possible states. What you're seeing is larger patterns of combinations of them, much in the same way that the only things sentences are made of are letters and punctuation.

Ignacio Vazquez-Abrams
  • 776,304
  • 153
  • 1,341
  • 1,358
-1

So I am going to give a layman answer here. What others suggested above is correct, you can read binary through Hex representation. Most data is saved in round number of bytes anyway. It is possible that e.g. compression algorithm computes a compressed representation in some odd number of bits, but it would still pad it to a full byte to save it. And each byte can be represented as 8 bits or 2 hex digits.

But, this may not be what you have asked. Quite likely you found some ascii data inside the supposedly binary data. Why? Well, sometimes code is not just for running. Sometimes compilers include some bits of human readable data that can help debugging if the code were to crash and you needed to access the stack trace. Things like variable names, line numbers etc.

Not that I ever had to do that. I don't have bugs in my code. Thats right.

Nikola Jevtic
  • 49
  • 3
-2

Don't forget that about operating system and disk file sytem. They are may only use files in their formats. For example executable files in win32 must begin with PE header. Operation system loads exutable in memory and transfer control, assort api-instructions in the exutables and so on...The low level instructions executes by CPU, for that level instructions already may be a sets of byte.

Victor
  • 177
  • 1
  • 1
  • 6