ImHex is a cross-platform hex editor and binary analysis tool designed for reverse engineers, programmers, and digital forensics. It provides a rich GUI built on Dear ImGui and GLFW, with a modular plugin architecture that allows extending functionality through dynamically loaded plugins. The core library (libimhex) implements a provider abstraction for various data sources (files, disks, process memory, GDB, SSH, UDP, etc.), an event-driven communication system, a content registry for registering views, tools, settings, and data inspectors, and a pattern language engine for declarative binary parsing. The application includes built-in plugins for hex editing, data inspection, disassembly (Capstone), diffing, YARA rule matching, hashing, decompression, visualizations (3D, plots, images), scripting (C and .NET), and a Model Context Protocol (MCP) server for AI-assisted analysis. It supports undo/redo, bookmarks, patches, projects, themes, layouts, achievements, tutorials, and a command palette. The codebase is well-structured with clear separation between core library, plugins, and platform-specific code, though some components are tightly coupled to ImGui internals and the custom pattern language.
heh (HEx Helper) is a cross-platform terminal hex editor written in Rust. It provides a TUI for viewing and editing binary files in both hexadecimal and ASCII representations, with features like search (hex/ASCII), jump-to-byte, undo, clipboard integration, and configurable endianness. The architecture follows a clean separation of concerns: `app.rs` orchestrates state and event handling, `screen.rs` manages rendering via ratatui, `input.rs` dispatches keyboard/mouse events to pluggable `KeyHandler` implementations (editor, popups), and `buffer.rs` implements an asynchronous memory-mapped buffer for responsive editing of large files. The codebase demonstrates strong Rust practices, including use of traits for extensibility, iterator patterns for decoding, and a custom `OverlappingChunks` iterator for handling UTF-8 boundary issues. It is primarily an application but includes a library interface for embedding as a ratatui widget.
The RevokeMsgPatcher is a Windows Forms application designed to patch instant messaging clients (primarily Tencent's WeChat and QQ) to prevent message recall and enable multiple simultaneous instances. The application operates by modifying binary files of the target applications at specific offsets or through pattern-based searches, guided by a version-specific patching database stored in JSON format. The architecture is monolithic, consisting of a single executable that embeds patching data as resources. Key components include a user interface for selecting the target application and version, a patching engine that applies the binary modifications, and a data layer (exemplified by JsonData.cs) responsible for parsing the JSON patch definitions. The workflow involves user selection, loading of the appropriate patch set, application of patches to the target binaries, and launching the patched application. While the tool effectively achieves its goals, it faces inherent challenges due to the fragile nature of binary patching. The patching logic is tightly coupled to specific byte sequences, requiring frequent updates to keep pace with target application releases. The project employs a two-tier strategy (exact offset patches for specific versions and pattern-based ranges for version intervals) to mitigate this, but maintenance remains high. Despite these challenges, the project demonstrates practical engineering in managing version-specific patches and provides a reusable pattern for JSON-driven binary modification systems.