Efficient hex editor
tweak [-l | -f] [-e] [-w width] [-o offset] filename
tweak is a hex editor. It allows you to edit a file at very low level, letting you see the full and exact binary contents of the file. It can be useful for modifying binary files such as executables, editing disk or CD images, debugging programs that generate binary file formats incorrectly, and many other things.
Unlike simpler hex editors, tweak possesses a fully functional insert mode. This is not useful when editing many of the types of file described above, but can be useful in other situations. Also, an insert mode makes it easy to use tweak to construct new files from scratch.
When you open a file in tweak, you can expect to see the screen contents looking something like this:
00000000 7F 45 4C 46 01 01 01 00 .ELF.... 00000008 00 00 00 00 00 00 00 00 ........ 00000010 02 00 03 00 01 00 00 00 ........ 00000018 D0 8E 04 08 34 00 00 00 ....4... 00000020 2C EF 01 00 00 00 00 00 ,.......
The central column shows you the hexadecimal value of each byte in the file you are editing. The column on the right shows the ASCII interpretation of those bytes, where applicable. In the example above, the sequence 45 4C 46 on the first line translates into the ASCII upper-case letters "ELF", but the subsequent sequence 01 01 01 00 does not have any printable ASCII representation and so the right-hand column simply prints dots.
The column on the left shows the position within the file of the start of each row.
In fact, when you start tweak, you will usually see 16 bytes of the file per row, not 8 as shown above. However, this is configurable if your screen is narrower - or wider - than the usual 80 columns, or if the file you are editing consists of fixed-size records of some other size.
By default, tweak does not load its entire input file into memory. Instead, it loads it lazily, reading from the file on disk when you request a view of a part of the file it doesn't have stored. When you modify the file, it stores your modifications in memory, but continues to refer to the original disk file for the parts you have not touched. This means you can edit extremely large files (for example, entire CD images) without difficulty; opening such a file is instantaneous, making modifications causes tweak's memory usage to grow with the size of the changes rather than the size of the whole file, and only when saving the altered version will tweak have to read through the entire input file to write the output.
However, this mode of operation has a disadvantage, which is that if the input file is modified by another program while tweak is running, tweak's internal data structures will not be sufficient to keep track, and it is likely that the file written out will contain a mixture of the old and new contents of the input file. Therefore, you can disable this lazy loading if you need to; see the -e option below.
This section lists the command-line options supported by tweak.
Runs tweak in "fix" mode, i.e. with the insert function entirely disabled. This might be useful if you are editing a file in which the insert mode is of no use (executables, for example, tend to have strong dependencies on precise file offsets which make it almost impossible to insert data in one without rendering it unusable) and you want to avoid turning it on by mistake.
Runs tweak in "look" mode. In this mode tweak does not allow you to modify the data at all; it becomes simply a tool for examining a file in detail.
Runs tweak in "eager" mode. In this mode tweak will read its entire input file when starting up. This causes it to take up more memory, but means that it has no dependency on the input file remaining unmodified, and other programs can alter it if they need to without causing trouble.
Specifies the number of bytes tweak will display per line. The default is 16, which fits neatly in an 80-column screen.
If this option is specified, tweak will ensure that the given file offset occurs at the start of a line. For example, if you loaded a file using the options -w 8 -o 0x13, you might see a display a bit like this:
00000000 7F 45 4C .EL 00000003 46 01 01 01 00 00 00 00 F....... 0000000B 00 00 00 00 00 02 00 03 ........ 00000013 00 01 00 00 00 D0 8E 04 ........ 0000001B 08 34 00 00 00 2C EF 01 .4...,..
By putting only three bytes of the file on the very first line, tweak has arranged that the file offset 0x13 (19 in decimal) appears at the beginning of the fourth line.
You might use this option if you knew you were editing a file in a particular format. For example, if your file contained a 53-byte header followed by a series of 22-byte records, you might find it useful to specify the options -w 22 -o 53. This would arrange that after the header, each individual record of the file would appear on precisely one line of tweak's display.
If this option is specified, tweak will not attempt to load and edit a file at all, but will simply produce its default .tweakrc file on standard output. This is a useful way to give yourself a starting point if you want to begin reconfiguring tweak's keyboard layout.
This section describes all the editing keys supported by tweak by default. The default key bindings for tweak are basically Emacs-like.
The Emacs cursor movement keys should all work, and their counterparts in ordinary function keys ought to work too:
^P and ^N go to the previous and next lines; Up and Down should do the same.
^B and ^F go back and forward one character; Left and Right should do the same.
M-v and ^V go up and down one screenful at a time; Page Up and Page Down should do the same.
^A and ^E go to the beginning and end of the line; Home and End should do the same.
Press M-< and M-> go to the beginning and end of the file.
Press ^X g to go to a particular byte position in the file; you will be asked to type in the position you want. You can enter it in decimal, or as a hex number with "0x" before it.
Press Return to move the cursor between the hex section of the screen and the ASCII section.
When in the hex section, you can enter hexadecimal digits to alter data; when in the ASCII section, you can directly type ASCII text.
In ASCII mode, you can also press ^Q to literally quote the next input character; for example, if you want to insert a Control-V, you can press ^Q^V and tweak will automatically insert the byte value 0x16.
Press ^X^I, or the Insert key if you have one, to toggle between overwrite mode and insert mode. In insert mode, typing hex or ASCII input will insert new bytes containing the values you provide. Also, you can then press Backspace to delete the byte to the left of the cursor, or ^D or Delete to delete the byte under the cursor.
Press ^@ (this character may be generated by the key combination Control-@, or Control-2, or Control-Space) to mark the end of a selection region. After you do this, the bytes between that mark and the cursor will be highlighted. Press ^@ again to abandon the selection.
Press M-w while a selection is active to copy the selected region into tweak's cut buffer.
In insert mode, you also have the option of pressing ^W to cut the selected region completely out of the file and place it in the cut buffer.
Finally, press ^Y to paste the cut buffer contents back into the file (this will overwrite or insert depending on the current mode).
Press ^S to search for a byte sequence. You will be asked to enter some text to search for on the bottom line of the screen. You can type this text in ASCII, or as a sequence of hex byte values prefixed with backslashes (\). For example, if you wanted to search for the byte value 5 followed by the word "hello", you might enter \05hello. If you want to specify a literal backslash character, you can either enter it in hex (as \5C), or simply double it on input (\\).
Press ^R to search backwards instead of forwards from the current cursor position.
Since tweak deals in pure binary data, searches are always case-sensitive.
If you press ^X w, you will be asked to enter a new display width. This has the same effect as passing the -w option on the command line. Similarly, pressing ^X o allows you to enter a new display offset, equivalent to the -o option.
By default, the current file position and file size are displayed on tweak's status line in hex. If you prefer them in decimal, you can press ^X x or ^X h to toggle them between hex and decimal.
Press ^L to redraw the screen and recentre the cursor. Press ^Z to suspend tweak and return temporarily to the shell.
Press ^X^S to save the file you are editing.
Press ^X^C to exit tweak. (If you do this with changes unsaved, you will be asked whether you want to save them.)
tweak's keyboard bindings are configurable. It will attempt to read a file from your home directory called .tweakrc, and if it finds one it will use the keyboard bindings described in it. If it does not find one, it will use its internal default bindings.
Most of the directives in .tweakrc are of the form "bind command-name key". For example, "bind exit ^X^C". Additionally, there are two other directives, width and offset, which give the default display parameters if no -w and -o options are specified.
The easiest way to learn about the .tweakrc file is to begin by having tweak output its internal default one:
tweak -D > $HOME/.tweakrc
Then you can read the default file, learn the tweak internal command names, and edit the file to do what you want.
This man page probably ought to contain an explicit list of internal command names, rather than simply referring you to the default .tweakrc.