The framework is designed to get you started quickly. Here’s a practical step-by-step guide:
The creator of HxD has stated that implementing a full-featured plugin system with custom editors and viewers is a long-term goal. As a result, the framework is currently focused on the Data Inspector, which provides a robust foundation for future expansion.
: It supports writing data type converters that translate byte sequences to strings and vice versa.
By configuring this, you can send data out of HxD, process it using any language or library you want, and reload the modified binary seamlessly. Native HxD Extensions: What’s Already Inside? hxd plugins
If you are looking to develop or use HxD plugins, the framework focuses on several core technical guidelines:
Plugins can decode fixed sizes (like 32-bit integers) or variable-width formats (like UTF-8 structures or x86 assembly lines).
To understand HxD plugins, it helps to understand how the software is built. HxD is written in Object Pascal (Delphi) by developer Maël Hörz. It is designed to be incredibly lightweight and fast, boasting a footprint that uses minimal system resources. The framework is designed to get you started quickly
If you want to tailor this workflow to a specific project, let me know:
Installing an HxD plugin requires manual folder creation. Ensure you are running , as older versions do not feature the updated API hooks. Step 1: Match the Architecture (Bitness)
Historically, HxD did not feature a standard, user-facing plugin architecture or a dedicated "plugin store" like modern code editors (e.g., VS Code or Notepad++). Instead, extending HxD typically happens through three distinct methods: : It supports writing data type converters that
A "Carver" plugin could implement the IHDxView interface. As the user scrolls through a raw disk image, the plugin asynchronously parses headers and populates a side-panel with a tree structure of recoverable files (PNGs, PDFs, ZIPs), offering a "Recover" context menu action.
A C# plugin could integrate with YARA rules. Upon loading a binary, the plugin hashes the selection and checks it against a local YARA rule set, highlighting malicious byte sequences directly in the hex view using color-coded backgrounds.