Capstone: hex editor

The goal

Build a hex dumper: hexdump file prints offset, hex bytes, and ASCII side by side, and hexpatch file offset byte patches one byte. It uses open, read, write, close, and a hex-digit lookup table.

Design

Read the file in 16-byte chunks into a .bss buffer. For each chunk, print the 8-digit hex offset, two spaces, then each byte as two hex digits from a table db "0123456789abcdef", then the printable characters with a dot for non-printables. The patcher opens O_RDWR (2), seeks with lseek (8) to the offset, writes one byte, and closes:

%define O_RDWR 2 %define SYS_LSEEK 8 mov rax, SYS_LSEEK mov rdi, fd mov rsi, offset xor rdx, rdx ; SEEK_SET syscall

Build steps

Build the dumper first: open, loop read-until-zero, format each 16-byte row, close. Then the patcher: validate the offset and the byte value (two hex digits), open O_RDWR, lseek, write, close. Test on a copy of a text file, then diff the patched copy against the original to confirm exactly one byte changed.

Next: Performance: cycles and cache

Article author: Arthur Isaev