HexWalk: A Cross Platform Hex Editor With a Built-in Signature Scanner

A Hex Editor That Also Analyses

HexWalk is described as a hex editor, viewer and analyzer, and it is cross platform with plenty of features. The list is worth reading in full, because the combination is unusual:

- Advanced Find, which can find patterns in binary files based on HEX, UTF8, UTF16 and regex - Binary signature scanner and extractor, with HexDig built in or Binwalk external, picked in Options - Entropy analysis - Byte map - Hash calculator - Bin, Dec and Hex converter - Hex file editing - Diff file analysis - Byte patterns to parse headers - Disassembler for x86, ARM and MIPS architectures

The last two are the ones that separate this from a text editor with a hex mode. Byte patterns to parse headers means you describe the structure of a file format and the tool lays it out, and a disassembler for three architectures means you do not have to leave the window to look at what the bytes are.

The technical base is stated in the README: qhexedit2 for the hex editing widget, Capstone for the disassembly, and Qt for the application. The project is written in C++ and licensed under GPL-3.0, and the homepage is hexwalk.com.

Two Analyzer Engines, Chosen in Options

The binary analyzer can be backed by either of two engines, and the choice is made in Options, Analyzer.

HexDig is the default and it is built in, with no external dependency. It is the project's own scanner, and the README credits Binwalk as the inspiration for the embedded HexDig scanner. The acknowledgements list Binwalk under that description, and note that the built-in scanner was inspired by it, which is an honest way of saying the two do different things with the same idea. HexDig is also built as a command line tool as part of the project, with a separate hexdig/README.md for standalone usage, so the scanning logic is usable outside the GUI.

Binwalk is the alternative, invoked as an external command. It has to be installed separately, with sudo apt install binwalk on Linux, brew install binwalk on macOS, or from the upstream repository.

There is a practical dependency to know about for the default engine. HexDig uses the 7z tool when extracting archives, for ZIP, 7Z, TAR and GZIP among others. On Linux you install it with your package manager, sudo apt install 7zip, or p7zip-full on legacy systems. The Windows installer bundles it, and the macOS build ships it inside the application bundle.

Search That Goes Past Plain Text

Advanced Find is the feature that determines whether you can use the tool on a real format. It can find patterns in binary files based on HEX, UTF8, UTF16 and regex.

Those four modes are the practical set. A hex pattern handles byte sequences that have no text interpretation, which covers compressed data, headers and packed structures. UTF8 and UTF16 cover the two ways text is encoded in binaries, and UTF16 in particular is the one that trips people up when a string looks like garbage in a hex view because every other byte is a zero. Regex covers the case where you know the shape of a value but not its length.

The screenshot gallery in the README shows this panel, along with the main view, the byte map, the entropy calculator, the binary analyzer, the hash calculator, the diff analysis view and the byte patterns view for header parsing, which is a reasonable indication of how much of the application is analysis rather than editing.

The search and the analyser are complementary rather than overlapping. Search finds something you already suspect is in the file, and the analyser tells you what is in a file you have just been handed and know nothing about.

Entropy, Byte Map and the Hash Calculator

Three panels cover the quantitative side of looking at a file.

Entropy analysis tells you how the data is distributed, and it is the fastest way to see where a file changes character: a low entropy region is text or structured data, a high entropy region is compressed or encrypted content, and the boundary between them is often exactly the interesting part of the file.

The byte map is the visual counterpart, showing where each byte value occurs across the file rather than in order. The two together answer different questions, since entropy says how random something is and the byte map says what the values actually are, and a byte map will show a structured pattern where the entropy looks uniform.

The hash calculator covers the file identification question, computing digests so you can compare a file against a known value. The bin, dec and hex converter sits alongside it for the small arithmetic that comes up constantly when reading offsets and lengths.

Diff file analysis compares two files and shows what changed between them, which is the feature that turns the editor into a patch review tool. It is the one you would use to see what a specific patch to a binary actually touched.

Parsing Headers With Byte Patterns

The byte patterns feature is the one that requires the most setup and gives the most leverage for anyone who works with a specific file format. It lets you describe the structure of a header and have the tool parse it.

This is where the repository layout explains itself. There is a patterns/ directory at the top level, separate from the hexwalk/ application code, and that separation is the point: the knowledge about a file format lives in data, not in the program, so a new format is a new pattern definition rather than a code change.

Combined with the disassembler, which covers x86, ARM and MIPS through Capstone, the tool covers both halves of the question you ask about an unfamiliar binary. The header tells you what the file claims to be, and the disassembly tells you what the code does. Very few other tools put both in one window, and the Capstone dependency explains why the disassembly is available at all, since Capstone is the engine doing the decoding.

The capstone/ and qhexedit/ directories at the top of the repository, along with vendor/ and a .gitmodules file, show the third party code being carried in the tree rather than resolved at build time.

Five Ways to Install It

HexWalk is packaged for each platform, and the release executables are self-contained and usable as they are.

On Windows there are two flavours, an installer and a portable zip file, and the fastest route is winget:

winget install hexwalk

On macOS you download the .dmg file from the release page and drag the application into the Applications folder as usual.

On Debian the project is available on backports for Bookworm. You enable the backports repository by adding the line to /etc/apt/sources.list, and then install the package:

deb http://deb.debian.org/debian bookworm-backports main

sudo apt update

sudo apt install hexwalk

On Ubuntu the project is on launchpad, with a personal package archive:

sudo add-apt-repository ppa:carmix/ppa

sudo apt update

sudo apt install hexwalk

For other Linux distributions there is an AppImage on the release page, which you download, give execution permissions to and run. The AppImage needs libfuse2 to mount itself, or libfuse2t64 on Ubuntu 24.04 and newer, which is the usual first stumbling block with that format.

Building From Source and the Release Line

HexWalk uses CMake and requires Qt 6, specifically the Core, Gui, Widgets and Charts modules. The build is two commands from a clean checkout:

cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j

The Charts module is worth noting, since it is what the entropy and byte map visualisations are drawn with.

Three helper scripts at the repository root handle the packaging. linux_build.sh is a one-shot Linux build, build-appimage.sh produces a self-contained HexWalk-*.AppImage using linuxdeploy and the Qt plugin, downloading them on first run, and build-deb.sh produces a Debian source and binary package using the overlay under deb-packaging/hexwalk-2.0.0/debian/. The version in that path is the packaging overlay version rather than the current release, which is a small sign of how the packaging is versioned separately.

The release history is steady. The tags are v2.2.1 on 2026-09-13, v2.2.0 on 2026-08-27 and v2.1.0 on 2026-06-21, so minor versions land every few weeks, and the repository is not archived with the last push on 2026-09-13. The 2.x line is the one to follow, since the packaging overlay still references 2.0.0 and a 1.x user would be missing the analyser and the pattern work.

Editorial conclusion

HexWalk fits a reverse engineer or malware analyst who wants one window for editing, pattern search, entropy inspection and disassembly, and who would rather not assemble that from a separate editor, a separate scanner and a separate disassembler. It is a poor fit if you need to script analysis across a corpus, since its analysis features live in a desktop GUI rather than a scripted pipeline, and it is the wrong choice if you want a minimal editor, because the Qt dependency and the bundled panels make it a large download. Before installing, decide which analyzer engine you want, since the default HexDig needs the 7z tool for archive extraction on Linux, and check the AppImage requirement of libfuse2, or libfuse2t64 on Ubuntu 24.04 and newer. The project is GPL-3.0 licensed, the newest release is v2.2.1 from 2026-09-13, and the last push was on 2026-09-13.

Frequently asked questions

Official sources

1. gcarmix/HexWalk on GitHub
2. License: GPL-3.0
3. Project website
4. README
5. Releases