mirror of
https://github.com/WerWolv/ImHex-Patterns.git
synced 2026-03-28 07:47:02 -05:00
ImHex-v1.37.1
Fixes #348 In issue #348 it is stated that the pattern fails to find the variable baseAddress in the parent of the parent of the attribute function. One parent is required to access the variables on the pattern that is using the attribute. That pattern is used in the pattern that contains baseAddress as a pointer to an array of the children pattern and that seems to require an extra parent level to be added in order to access baseAddress without errors. The fix was tested on an xbe file extracted from an xbox cd rom and while it failed without the fix as stated in issue 348 with the fix it ran to completion without issues.
ImHex Database
This repository serves as a database for files to use with the ImHex Hex Editor. It currently contains
- Patterns - Binary Format definitions for the Pattern Language
- Pattern Libraries - Libraries that make using the Pattern Language easier
- Magic Files - Custom magic file definitions for the use with libmagic
- Encodings - Custom encodings in the .tbl format
- Data Processor Nodes - Custom nodes made for ImHex's Data Processor
- Themes - Custom themes for ImHex
- Constants - Constants definition files
- Scripts - Various scripts to generate code or automate some tasks
- Yara - Custom Yara rules
Submissions
Most files in this repository have been submitted by the community. Please feel free to open a PR on your own and add files to it! Everything will immediately show up in ImHex's Content Store and gets bundled with the next release of ImHex.
Table of Contents
Hex Patterns
| Name | MIME | Path | Description |
|---|---|---|---|
| 3DS | patterns/3ds.hexpat |
Autodesk 3DS Max Model file | |
| 7Z | patterns/7z.hexpat |
7z File Format | |
| ADTS | audio/x-hx-aac-adts |
patterns/adts.hexpat |
ADTS/AAC audio files |
| AFE2 | patterns/afe2.hexpat |
Nintendo Switch Atmosphère CFW Fatal Error log | |
| ANI | application/x-navi-animation |
patterns/ani.hexpat |
Windows Animated Cursor file |
| AR | application/x-archive |
patterns/ar.hexpat |
Static library archive files |
| ARC | patterns/arc.hexpat |
Minecraft Legacy Console Edition ARC files | |
| ARIA2 | patterns/aria2.hexpat |
ARIA2 Download Manager Control files | |
| ARM VTOR | patterns/arm_cm_vtor.hexpat |
ARM Cortex M Vector Table Layout | |
| Bastion | patterns/bastion/* |
Various Bastion files | |
| BeyondCompare BCSS | patterns/bcss.hexpat |
BeyondCompare Snapshot (BCSS) file | |
| Bencode | application/x-bittorrent |
patterns/bencode.hexpat |
Bencode encoding, used by Torrent files |
| Prusa BGCODE | patterns/bgcode.hexpat |
PrusaSlicer Binary G-Code files | |
| BLEND | patterns/blend.hexpat |
Blender Project file | |
| BMP | image/bmp |
patterns/bmp.hexpat |
OS2/Windows Bitmap files |
| BIN | patterns/selinux.hexpat |
SE Linux modules | |
| BINKA | patterns/binka.hexpat |
RAD Game Tools Bink Audio (BINKA) files | |
| BSON | application/bson |
patterns/bson.hexpat |
BSON (Binary JSON) format |
| bplist | application/x-bplist |
patterns/bplist.hexpat |
Apple's binary property list format (bplist) |
| BSP | patterns/bsp_goldsrc.hexpat |
GoldSrc engine maps format (used in Half-Life 1) | |
| BZIP3 | patterns/bzip3.hexpat |
GoldSrc engine maps format (used in Half-Life 1) | |
| CAB | patterns/cab.hexpat |
Microsoft Cabinet (CAB) Files | |
| CCHVA | patterns/cchva.hexpat |
Command and Conquer Voxel Animation | |
| CCVXL | patterns/ccvxl.hexpat |
Command and Conquer Voxel Model | |
| CCPAL | patterns/ccpal.hexpat |
Command and Conquer Voxel Palette | |
| CDA | patterns/cda.hexpat |
Compact Disc Audio track | |
| CHM | application/vnd.ms-htmlhelp |
patterns/chm.hexpat |
Windows HtmlHelp Data (ITSF / CHM) |
| COFF | application/x-coff |
patterns/coff.hexpat |
Common Object File Format (COFF) executable |
| CPIO | application/x-cpio |
patterns/cpio.hexpat |
Old Binary CPIO Format |
| CrashLvl | patterns/Crashlvl.hexpat |
Crash Bandicoot - Back in Time (fan game) User created level format | |
| CREDHIST | patterns/credhist.hexpat |
CREDHIST Format | |
| DDS | image/vnd-ms.dds |
patterns/dds.hexpat |
DirectDraw Surface |
| DEX | patterns/dex.hexpat |
Dalvik EXecutable Format | |
| DICOM | application/dicom |
patterns/dicom.hexpat |
DICOM image format |
| DMG | patterns/dmg.hexpat |
Apple Disk Image Trailer (DMG) | |
| DMP | patterns/dmp64.hexpat |
Windows Kernel Dump(DMP64) | |
| DPAPI_Blob | patterns/dpapblob.hexpat |
Data protection API Blob File Format | |
| DPAPI_MasterKey | patterns/dpapimasterkey.hexpat |
Data protection API MasterKey | |
| DS_Store | patterns/dsstore.hexpat |
.DS_Store file format | |
| DTA | patterns/max_v104.hexpat |
Mechanized Assault and Exploration v1.04 (strategy game) save file format | |
| DTED | patterns/dted.hexpat |
Digital Terrain Elevation Data (DTED) | |
| ELF | application/x-executable |
patterns/elf.hexpat |
ELF header in elf binaries |
| EVTX | application/x-ms-evtx |
patterns/evtx.hexpat |
MS Windows Vista Event Log |
| EXT4 | patterns/ext4.hexpat |
Ext4 filesystem | |
| FAS | patterns/fas_oskasoftware.hexpat patterns/fas_oskasoftware_old.hexpat (Old versions of Oska DeskMate) |
Oska Software DeskMates FAS (Frames and Sequences) file | |
| FBX | patterns/fbx.hexpat |
Kaydara FBX Binary | |
| FDT | patterns/fdt.hexpat |
Flat Linux Device Tree blob | |
| FFX | patterns/ffx/* |
Various Final Fantasy X files | |
| File System | application/x-ima |
patterns/fs.hexpat |
Drive File System |
| FLAC | audio/flac |
patterns/flac.hexpat |
Free Lossless Audio Codec, FLAC Audio Format |
| Flipper Zero Settings | patterns/flipper_settings.hexpat |
Flipper Zero Settings Files | |
| GB | application/x-gameboy-rom |
patterns/gb.hexpat |
Game Boy ROM |
| GBA | application/x-gameboy-advance-rom |
patterns/gba.hexpat |
Game Boy Advance ROM header |
| GGUF | patterns/gguf.hexpat |
GGML Inference Models | |
| GIF | image/gif |
patterns/gif.hexpat |
GIF image files |
| GLTF | model/gltf-binary |
patterns/gltf.hexpat |
GL Transmission Format binary 3D model file |
| GZIP | application/gzip |
patterns/gzip.hexpat |
GZip compressed data format |
| Halo Tag | patterns/hinf_tag.hexpat |
Halo Infinite Tag Files | |
| Halo Module | patterns/hinf_module.hexpat |
Halo Infinite Module Archive Files | |
| Halo HavokScript | patterns/hinf_luas.hexpat |
Halo Infinite HavokScript 5.1 Bytecode | |
| HSDT | patterns/hsdt.hexpat |
HiSilicon device-tree table images | |
| ICO | patterns/ico.hexpat |
Icon (.ico) or Cursor (.cur) files | |
| ID3 | audio/mpeg |
patterns/id3.hexpat |
ID3 tags in MP3 files |
| Intel HEX | patterns/intel_hex.hexpat |
Intel hexadecimal object file format definition | |
| IP | patterns/ip.hexpat |
Ethernet II Frames (IP Packets) | |
| IPS | patterns/ips.hexpat |
IPS (International Patching System) files | |
| ISO | application/x-iso9660-image |
patterns/iso.hexpat |
ISO 9660 file system |
| Java Class | application/x-java-applet |
patterns/java_class.hexpat |
Java Class files |
| JPEG | image/jpeg |
patterns/jpeg.hexpat |
JPEG Image Format |
| LOC | patterns/loc.hexpat |
Minecraft Legacy Console Edition Language file | |
| Lua 5.1 | patterns/lua51.hexpat |
Lua 5.1 bytecode | |
| Lua 5.2 | patterns/lua52.hexpat |
Lua 5.2 bytecode | |
| Lua 5.3 | patterns/lua53.hexpat |
Lua 5.3 bytecode | |
| Lua 5.4 | patterns/lua54.hexpat |
Lua 5.4 bytecode | |
| LCE Savefile | patterns/lcesave.hexpat |
Minecraft Legacy Console Edition save file | |
| LZNT1 | patterns/lznt1.hexpat |
LZNT1 compressed data format | |
| Mach-O | application/x-mach-binary |
patterns/macho.hexpat |
Mach-O executable |
| MIDI | audio/midi |
patterns/midi.hexpat |
MIDI header, event fields provided |
| MiniDump | application/x-dmp |
patterns/minidump.hexpat |
Windows MiniDump files |
| mp4 | video/mp4 |
patterns/mp4.hexpat |
MPEG-4 Part 14 digital multimedia container format |
| msgpack | application/x-msgpack |
patterns/msgpack.hexpat |
MessagePack binary serialization format |
| MSSCMP | patterns/msscmp.hexpat |
Miles Sound System Compressed Archive | |
| NACP | patterns/nacp.hexpat |
Nintendo Switch NACP files | |
| NBT | patterns/nbt.hexpat |
Minecraft NBT format | |
| NE | application/x-ms-ne-executable |
patterns/ne.hexpat |
NE header and Standard NE fields |
| nes | patterns/nes.hexpat |
.nes file format | |
| NotepadCache | patterns/notepad-cache.hexpat |
Windows Notepad Cache | |
| NotepadWindowState | patterns/notepadwindowstate.hexpat |
Windows 11 Notepad - Window State .bin file | |
| NRO | patterns/nro.hexpat |
Nintendo Switch NRO files | |
| NTAG | patterns/ntag.hexpat |
NTAG213/NTAG215/NTAG216, NFC Forum Type 2 Tag compliant IC | |
| OGG | audio/ogg |
patterns/ogg.hexpat |
OGG Audio format |
| PAK | patterns/xgspak.hexpat |
Exient XGS Engine Pak files | |
| PCAP | application/vnd.tcpdump.pcap |
patterns/pcap.hexpat |
pcap header and packets |
| PCK | patterns/pck.hexpat |
Minecraft Legacy Console Edition .pck file | |
| PCX | application/x-pcx |
patterns/pcx.hexpat |
PCX Image format |
| PE | application/x-dosexec application/x-msdownload |
patterns/pe.hexpat |
PE header, COFF header, Standard COFF fields and Windows Specific fields |
| PP | patterns/selinuxpp.hexpat |
SE Linux package | |
| PFS0 | patterns/pfs0.hexpat |
Nintendo Switch PFS0 archive (NSP files) | |
| PIF | image/pif |
patterns/pif.hexpat |
PIF Image Format |
| PKM | patterns/pkm.hexpat |
PKM texture format | |
| PNG | image/png |
patterns/png.hexpat |
PNG image files |
| PRODINFO | patterns/prodinfo.hexpat |
Nintendo Switch PRODINFO | |
| Protobuf | patterns/protobuf.hexpat |
Google Protobuf encoding | |
| psafe3 | patterns/psafe3.hexpat |
Password Safe V3 | |
| PyInstaller | patterns/pyinstaller.hexpat |
PyInstaller binray files | |
| PYC | application/x-bytecode.python |
patterns/pyc.hexpat |
Python bytecode files |
| QBCL | patterns/qbcl.hexpat |
Qubicle voxel scene project file | |
| QOI | image/qoi |
patterns/qoi.hexpat |
QOI image files |
| quantized-mesh | patterns/quantized-mesh.hexpat |
Cesium quantized-mesh terrain | |
| RAR | application/x-rar |
patterns/rar.hexpat |
RAR archive file format |
| RAS | image/x-sun-raster |
patterns/ras.hexpat |
RAS image files |
| ReFS | patterns/refs.hexpat |
Microsoft Resilient File System | |
| RGBDS | patterns/rgbds.hexpat |
RGBDS object file format | |
| Shell Link | application/x-ms-shortcut |
patterns/lnk.hexpat |
Windows Shell Link file format |
| shp | patterns/shp.hexpat |
ESRI shape file | |
| shx | patterns/shx.hexpat |
ESRI index file | |
| sup | patterns/sup.hexpat |
PGS Subtitle | |
| SPIRV | patterns/spirv.hexpat |
SPIR-V header and instructions | |
| STL | model/stl |
patterns/stl.hexpat |
STL 3D Model format |
| StuffItV5 | application/x-stuffit |
patterns/sit5.hexpat |
StuffIt V5 archive |
| SQLite3 | application/vnd.sqlite3 |
patterns/sqlite3.hexpat |
SQLite3 Database |
| SWF | application/x-shockwave-flash |
patterns/swf.hexpat |
Shockwave Flash file format |
| TAR | application/x-tar |
patterns/tar.hexpat |
Tar file format |
| TES | patterns/wintec_tes.hexpat |
Wintec TES GPS log | |
| TIFF | image/tiff |
patterns/tiff.hexpat |
Tag Image File Format |
| TGA | image/tga |
patterns/tga.hexpat |
Truevision TGA/TARGA image |
| TTF | font/ttf, font/otf |
patterns/ttf.hexpat |
TrueType and OpenType font format |
| Ubiquiti | patterns/ubiquiti.hexpat |
Ubiquiti Firmware (update) image | |
| UEFI | patterns/uefi.hexpat` |
UEFI structs for parsing efivars | |
| UEFI Boot Entry | patterns/uefi_boot_entry.hexpat |
UEFI Boot Entry (Load option) | |
| UF2 | patterns/uf2.hexpat |
USB Flashing Format | |
| VBMeta | patterns/vbmeta.hexpat |
Android VBMeta image | |
| VDF | patterns/vdf.hexpat |
Binary Value Data Format (.vdf) files | |
| VEADO | patterns/veado.hexpat |
veadotube mini avatar file | |
| VGM | patterns/vgm.hexpat |
VGM (Video Game Music) sound log | |
| VHDX | patterns/vhdx.hexpat |
Microsoft Hyper-V Virtual Hard Disk format | |
| WAV | audio/x-wav |
patterns/wav.hexpat |
RIFF header, WAVE header, PCM header |
| WAS | patterns\was_oskasoftware.hexpat |
Oska Software DeskMates WAS/WA3 (WAVE/MP3 Set) file | |
| WAD | patterns/wad.hexpat |
DOOM WAD Archive | |
| WebP | image/webp |
patterns/webp.hexpat |
Google WebP image |
| XBEH | audio/x-xbox-executable |
patterns/xbeh.hexpat |
Xbox executable |
| XCI | patterns/xci.hexpat |
Nintendo Switch XCI cartridge ROM | |
| XGT | patterns/xgt.hexpat |
Exient XGS Engine Texture | |
| Xilinx BIT | patterns/xilinx_bit.hexpat |
Xilinx FPGA Bitstreams | |
| Xilinx Bootgen | application/x-xilinx-boot-zynqmp |
patterns/xilinx_bootgen.hexpat |
Xilinx ZynqMP Boot Images |
| ZIP | application/zip |
patterns/zip.hexpat |
End of Central Directory Header, Central Directory File Headers |
| ZLIB | application/zlib |
patterns/zlib.hexpat |
ZLIB compressed data format |
| ZSTD | application/zstd |
patterns/zstd.hexpat |
Zstandard compressed data format |
Scripts
| Name | Path | Description |
|---|---|---|
| svd2pat | scripts/svd2pat.py |
Converts a ARM .svd register MMIO definition file into a pattern |
| csv2tbl | scripts/csv2tbl.py |
Converts a 010 editor CSV encoding file into a table file |
Pattern Libraries
| Name | Path | Description |
|---|---|---|
| libhex | includes/hex/* |
Functions to interact with ImHex |
| libstd | includes/std/* |
Pattern Language Standard Library |
| libtype | includes/type/* |
Various custom types with special formatters |
Yara rules
| Name | Path | Description |
|---|---|---|
| Official Rules | yara/official_rules/* |
Official Yara rules repository |
Magic files
| Name | Path | Description |
|---|---|---|
| Nintendo Switch | magic/nintendo_switch_magic |
Identifies common file types used on the Nintendo Switch |
| Portable Executable | magic/portable_executable_magic |
Identifies PE files used on Windows |
Constants files
| Name | Path | Description |
|---|---|---|
| CRC-16 | constants/crc16.json |
Constants associated with CRC-16 operations |
| CRC-32 | constants/crc32.json |
Constants associated with CRC-32 operations |
| HTTP-Codes | constants/http_status.json |
HTTP Status code values |
| Linux Error Codes | constants/linux_errors.json |
Values of Linux error results |
Encoding files
| Name | Path | Description |
|---|---|---|
| Arabic ISO | encodings/arabic_iso.tbl |
Arabic ISO encoding |
| Arabic Windows | encodings/arabic_windows.tbl |
Arabic Windows encoding |
| ASCII | encodings/ascii.tbl |
Regular ASCII encoding |
| ASCII+ANSI | encodings/ascii_ansi.tbl |
Extended ASCII encoding |
| ASCII+OEM | encodings/ascii_oem.tbl |
ASCII encoding with Windows OEM characters |
| Baltic ISO | encodings/baltic_iso.tbl |
Baltic ISO encoding |
| Baltic Windows | encodings/baltic_windows.tbl |
Baltic Windows encoding |
| Big5 (Traditional Chinese) | encodings/big5.tbl |
Big5 encoding for Traditional Chinese |
| Cyrillic ISO | encodings/cyrillic_iso.tbl |
Cyrillic ISO encoding |
| Cyrillic Windows | encodings/cyrillic_windows.tbl |
Cyrillic Windows encoding |
| Cyrillic KOI8-R | encodings/cyrillic_koi8_r.tbl |
Cyrillic KOI8-R encoding (Russian Characters) |
| Cyrillic KOI8-U | encodings/cyrillic_koi8_u.tbl |
Cyrillic KOI8-U encoding (Ukranian Characters) |
| Eastern Europe ISO | encodings/eastern_europe_iso.tbl |
Eastern Europe ISO encoding |
| Eastern Europe Windows | encodings/eastern_europe_windows.tbl |
Eastern Europe Windows encoding |
| EBCDIC | encodings/ebcdic.tbl |
Extended Binary Coded Decimal Interchange Code, developed by IBM for their Main Frames |
| EUC-JP | encodings/euc_jp.tbl |
EUC-JP encoding with NEC special and IBM extended characters |
| EUC-KR | encodings/euc_kr.tbl |
EUC-KR encoding |
| Greek ISO | encodings/greek_iso.tbl |
Greek ISO encoding |
| Greek Windows | encodings/greek_windows.tbl |
Greek Windows encoding |
| Hebrew ISO | encodings/hebrew_iso.tbl |
Hebrew ISO encoding |
| Hebrew Windows | encodings/hebrew_windows.tbl |
Hebrew Windows encoding |
| ISO/IEC 646 | encodings/iso_646.tbl |
ISO/IEC 646 encoding, an older version of ASCII |
| ISO/IEC 6937 | encodings/iso_6937.tbl |
ISO/IEC 6937 encoding, an extension of ASCII containing additional character |
| JIS 0201 | encodings/jis_x_0201.tbl |
JIS X 0201 encoding in UTF-8 |
| JIS X 0211 | encodings/jis_x_0211.tbl |
JIS X 0211 encoding in UTF-8 |
| JIS 0213 | encodings/jis_x_0213.tbl |
JIS X 0213 encoding in UTF-8 |
| Macintosh | encodings/macintosh.tbl |
Macintosh character encoding used by the Kermit protocol |
| Pokémon (English, Generation 1) | encodings/pokegen1_en.tbl |
Character encoding used by the English generation 1 Pokémon games |
| Pokémon (English, Generation 3) | encodings/pokegen3_en.tbl |
Character encoding used by the English generation 3 Pokémon games |
| Shift-JIS UTF-8 | encodings/shiftjis.tbl |
Shift-JIS encoding in UTF-8 |
| Thai | encodings/thai.tbl |
Thai character encoding |
| Turkish ISO | encodings/turkish_iso.tbl |
Turkish ISO encoding |
| Turkish Windows | encodings/turkish_windows.tbl |
Turkish Windows encoding |
| UTF-8 | encodings/utf8.tbl |
UTF-8 encoding |
| Vietnamese | encodings/vietnamese.tbl |
Vietnamese character encoding |
Data Processor Nodes
| Name | Path | Description |
|---|---|---|
| Caesar Cipher | nodes/caesar.hexnode |
Simple adjustable per-byte Caecar Cipher (ROT) |
| XOR Cipher | nodes/xor.hexnode |
XORs a input with a repeating XOR pad |
Themes
| Name | Path | Description |
|---|---|---|
| Visual Studio Dark | themes/vs_dark.json |
Theme similar to Visual Studio's Dark theme |
| Solarized Dark | themes/solarized_dark.json |
Solarized Dark Theme |
| Catppuccin Latte | themes/catppuccin-latte.json |
Catppuccin Latte Flavor (Light Theme) |
| Catppuccin Frappe | themes/catppuccin-frappe.json |
Catppuccin Frappe Flavor (Dark Theme) |
| Catppuccin Macchiato | themes/catppuccin-macchiato.json |
Catppuccin Macchiato Flavor (Dark Theme) |
| Catppuccin Mocha | themes/catppuccin-mocha.json |
Catppuccin Mocha Flavor (Dark Theme) |
Disassemblers
| Name | Path | Description |
|---|---|---|
| 8051 | disassemblers/8051.json |
Intel 8051 Architecture |
Languages
Rust
97.1%
Python
0.5%
C++
0.5%
YARA
0.5%
Arc
0.4%
Other
1%