HM
HEX-MASTER
User Guide • by MKhanfar
HEX-MASTER Documentation
This guide explains the full workflow of HEX-MASTER: how to navigate a file, select bytes, edit values,
use the Inspector and checksum tools, apply colors/markers, compare tabs, run scripts, and use the
right-click tools (Swap bytes, XOR, Fill, Copy/Paste).
Important: HEX-MASTER is a byte editor. For real ECU/EEPROM work, you may still need
model-specific checksum/CRC correction tools. Always keep a clean backup of the original file and verify
changes before flashing.
1) Overview
HEX-MASTER is a fast desktop hex editor built for EEPROM dumps and ECU binary workflows. It shows:
address offsets, hex bytes, and ASCII together, and gives you practical editing tools:
- Quick navigation through large dumps (scroll + page jumps)
- Selection-based operations (swap bytes / XOR / fill / copy)
- Inspector to read/write values in normal and reverse byte order (big-endian / little-endian)
- Markers/colors to map regions and stay organized
- Multi-tab compare to highlight differences between dumps
- Simple checksums (SUM / XOR / SUM16) and expression calculator (EXPR)
2) Screen layout
Top area
- Toolbar: Scripts / Open / Save / Copy / Info / Perf Mode
- Tabs: one tab per opened file (close button x)
Center
- Color bar: quick marker colors + Apply toggle
- Hex view: Address + Hex + ASCII
Right side
- Inspector: HEX / !HEX / DEC / !DEC (normal + reversed order)
- Checksum: SUM / XOR / SUM16 for the selection
- EXPR: calculator that can use the selection as variables
Left side (optional)
- Scripts panel: opens when you press Scripts
HEX-MASTER automatically switches between 8 columns and 16 columns depending on window width.
This affects how far PageUp/PageDown jumps, and how selection looks.
3) Quick Start
- Click Open and choose your .bin / dump file.
- Scroll with the mouse wheel. Click a byte to place the cursor.
- Click + drag to select a region.
- Read the selection in the Inspector (normal and reverse order).
- Edit bytes by typing in HEX mode (0–9/A–F) or ASCII mode (printable chars).
- Right‑click for actions like Swap bytes, XOR, Fill, Copy, Paste.
- Click Save to write the modified file.
4) Navigation & Editing
Mouse
- Left click: set cursor
- Drag: select a range
- Mouse wheel: scroll a few rows
- Right click: open menu (Swap bytes / XOR / Fill / Copy / Paste / Select All)
Keyboard (movement)
- ↑/↓: move by one row (8 or 16 bytes)
- ←/→: move by one byte
- PageUp/PageDown: jump by one screen
Keyboard (editing)
- HEX mode: type two hex digits to write one byte (first digit = high nibble, second = low nibble)
- ASCII mode: type printable characters to write bytes directly
Tip: Click in the HEX area to ensure you are in HEX mode before typing.
To write FF, type FF.
5) Selection (why it matters)
Many tools operate on the selection. If nothing is selected, some operations apply to the
current byte (coloring) or the whole file (XOR/FILL scripts and some menu actions).
- Inspector reads/writes the selection (or current byte if no selection)
- Checksum values are computed from the selection
- Markers/colors apply to the selection range
- Right‑click tools apply to the selection (or entire file if no selection)
- Scripts typically operate on the selection
Always check whether you have a selection before using XOR or FILL.
If nothing is selected, those operations may affect the entire file.
6) Buttons & Features
| Button | What it does | Notes |
| Scripts |
Show/hide the Scripts panel (left side). |
Use scripts for repeatable reads/writes like Sum8/Xor8/Fill/XOR. |
| Open |
Open a binary file into a new tab. |
Open multiple files to compare dumps. |
| Save |
Save the current buffer to a file. |
Saves raw bytes exactly as edited. |
| Copy |
Copy the entire file as spaced hex bytes to clipboard. |
For selection-only copy, use right-click Copy or Ctrl+C. |
| Info |
Show information/about dialog. |
You can customize the message for your EXE release. |
| Perf Mode |
Reduces live updates to keep the UI fast on huge files. |
Inspector/EXPR updates are reduced while Perf Mode is enabled. |
7) Tabs, Compare, Master buffer
Tabs
- Each opened file becomes a tab. Click tab to activate.
- Click x on a tab to close it.
Tab right‑click menu
- Compare to…: compare this tab to another open tab; differences are highlighted.
- Set as master: marks this tab as the “master buffer” (used by Apply in the color bar).
Compare highlighting
After compare, differing bytes are highlighted (often shown with strong color, e.g. red text).
Compare marks differences in the tab you run it on. Compare the other way if you want the opposite view.
8) Colors / Markers + Apply
What markers are for
- Mark map/table areas
- Label checksum blocks
- Highlight “do not touch” areas
- Keep place while exploring big EEPROM files
How to apply a color
- Select a range (drag) or place cursor on a byte.
- Click a color square in the color bar.
- If a range is selected: the whole range is marked and the selection is cleared.
- If no selection: the current byte is marked and cursor advances by 1 byte.
Apply checkbox (master vs current)
- Apply ON: markers are written into the master buffer (set via tab right‑click → Set as master).
- Apply OFF: markers are written only into the current active buffer.
Clear markers
Right‑click in the hex view → Clear markers removes all marker colors from the target buffer.
9) Right‑Click Menu (Swap bytes, XOR, Fill…)
Right‑click inside the hex view to open the context menu.
| Menu item | What it does | Typical use |
| Clear markers |
Remove all color markers. |
Reset annotation layer for a clean pass. |
| Swap bytes |
Swap adjacent bytes in pairs across selection (or whole file if no selection). |
Endianness conversion for 16‑bit words (00 11 22 33 → 11 00 33 22). |
| XOR… |
Ask for a hex value (00–FF), then XOR every byte in the selection (or whole file). |
Obfuscation tests, bit flips, invert with FF. |
| FILL… |
Ask for a hex value (00–FF), then fill the selection (or whole file) with it. |
Blank a region, write 00/FF patterns. |
| Auto‑Find XOR checksum byte | Automatically extends the selection forward until the selection XOR becomes 00 (or reaches the search limit). Then highlights the discovered checksum byte. | Fast way to locate a 1‑byte XOR checksum inside cluster/EEPROM protected blocks before editing. |
| Checksum Finder… | Opens a dialog to search for checksum patterns in/near your selection using XOR8, SUM8, SUM16, CRC16, and CRC32. Includes options for “checksum stored at end / start / elsewhere” and a Fix button to write the correct checksum. | Use when you don’t know the exact checksum type or location. Great for cluster EEPROM, airbag, immo, and ECU flash blocks. |
| Checksum Map Runner… | Runs a multi‑segment checksum plan from a JSON map (compute only, or compute + write). | ECU flash workflows often have many protected segments — a map lets you validate/fix them in one run. |
| Export Checksum Map Template… | Exports a starter JSON template for checksum maps (segments, algorithm, storage location, parameters). | Use as a base for building checksum maps per ECU family/project. |
| Copy |
Copy selection as spaced hex bytes. |
Share/paste a patch snippet. |
| Paste… |
Paste at cursor. If clipboard looks like hex, parse as bytes; otherwise paste as ASCII bytes. |
Apply patches quickly from notes/tools. |
| Select All |
Select the entire file. |
Run checksums/scripts on the full dump. |
Note: Checksum Finder… is a dialog. Use Find to detect the checksum byte(s), and Fix to automatically write the correct checksum value once you finish editing the block.
XOR/FILL can modify a lot of data instantly if nothing is selected (whole file).
Select your region first if you want a safe targeted edit.
10) Inspector
Inspector reads the selection (or current byte) and shows numeric representations in two ways:
Normal order (file order) and Reverse order (byte-reversed for little-endian).
Normal order
- HEX: concatenated hex bytes in file order
- !HEX: per-byte inverted (byte XOR FF)
- DEC: integer value of HEX (big-endian interpretation)
- !DEC: complement within the selection width
Reverse order
Same fields, but bytes are reversed first. This helps interpret little-endian values.
Editing using Inspector
- Type into HEX or DEC fields to overwrite the selected bytes.
- Input is padded to match selection size.
- If invalid/out-of-range, the field becomes highlighted (error color) until corrected.
To write a clean 16-bit value, select exactly 2 bytes first. To write a 32-bit value, select 4 bytes.
11) Checksum box
The checksum panel shows quick integrity values for your selection:
- SUM: 8-bit sum of bytes (mod 0x100)
- XOR: 8-bit XOR of bytes
- SUM16: 16-bit sum of bytes (mod 0x10000)
These are quick checks, not ECU vendor CRC algorithms. Use them mainly for “did this region change?”
and simple validations.
12) Expression (EXPR)
EXPR is a mini calculator. It evaluates your expression using variables created from the selection.
Variables
hex, dec # selection interpreted as an integer (normal order)
hex_inv # selection bytes inverted (per-byte XOR FF), as integer
dec_inv # complement inside selection bit-width
rhex, rdec # selection interpreted as integer in reverse order (little-endian)
rhex_inv # inverted + reversed, as integer
rdec_inv # complement of reversed integer
sel # list of selected byte values, e.g. [0x12, 0x34, 0x56]
Examples
# 2-byte selection interpreted as little-endian decimal:
rdec
# Sum of bytes:
sum(sel) & 0xFFFF
# Add offset:
hex + 16
# XOR with a constant:
hex ^ 0x55
Keep EXPR to simple math on the provided variables. If you don’t need it, you can ignore it.
13) Scripts panel
Scripts are built-in helpers (left panel) that operate on your selection.
Use Read scripts to calculate values and Write scripts to modify bytes.
How to use
- Select a range (or leave no selection if you want the “whole file” behavior in some scripts).
- Press Scripts to open the panel.
- Choose a script name.
- Press Read (outputs info) or Write (applies changes).
Included scripts
| Script | Mode | Description |
| Selection Sum8 | Read | 8-bit sum of selection. |
| Selection XOR8 | Read | 8-bit XOR of selection. |
| Selection Sum16 | Read | 16-bit sum of selection. |
| XOR with value | Write | XOR selection with a user-provided hex byte. |
| Fill with value | Write | Fill selection with a user-provided hex byte. |
| Mileage (read-only) | Read | Displays two redundant mileage counters (if present) and a MATCH/MISMATCH status. Read-only for research/diagnostics; it does not modify the file. |
| VAG 95040 / Cluster Info (read-only) | Read | Analyzes common VAG 95040 ECU (512B) and cluster (2KB) dumps and displays non-sensitive metadata (e.g., VIN + checksum validity). Read-only; no write/patch actions and it does not show SKC/Pin or Immo-ID. |
Mileage (read-only) currently targets a known 4KB ST95320-style EEPROM layout used in some Bosch EDC16 variants. If your module uses a different layout or EEPROM size, the script will show “not supported”.
VAG 95040 / Cluster Info (read-only) is intended for research/diagnostics. It supports specific file sizes (512B/2KB/1KB) and formats; results may be “not supported” if the dump layout differs.
14) Clipboard formats
- Copy selection: right-click → Copy (or Ctrl+C)
- Paste: right-click → Paste… (or Ctrl+V)
Paste rules
- If clipboard looks like HEX, separators are ignored and bytes are parsed (ex:
DE AD BE EF, DE,AD,BE,EF).
- Otherwise, text is pasted as raw bytes (ASCII/Latin-1 style).
For ECU patch notes, keeping byte sequences in spaced hex is easiest:
12 34 56 78 9A BC.
15) Performance Mode + Autosave
Performance Mode
Designed for very large binaries. When enabled, HEX-MASTER reduces live refresh work to keep scrolling and editing fast.
Autosave
HEX-MASTER periodically writes an autosave file (for crash recovery) when changes exist.
You can document the autosave name/location here if you want users to recover it manually.
If you distribute as an EXE, consider changing the autosave filename and the Info text to match HEX-MASTER branding.
How to Use (full workflow)
New tools: use Auto‑Find XOR checksum byte to locate checksum bytes fast, and use the Checksum Status Badge to confirm blocks validate (XOR OK) after edits.
- Open your dump file.
- Inspect: select bytes and read values in Inspector (normal and reverse).
- Mark: color regions (maps, checksum blocks, “don’t touch” areas).
- Edit: type in hex/ASCII, or overwrite through Inspector DEC/HEX fields.
- Transform: right-click tools (Swap bytes, XOR, Fill) for region operations.
- Validate: look at checksum box and compare tabs to confirm what changed.
- Save the new file.
16) Showcase / examples
Example A — Mark a known region (map/table)
- Navigate to the region.
- Drag to select the region.
- Click a color in the marker bar (blue for maps, yellow for checksum area, gray for “do not edit”, etc.).
Example B — Edit a 16-bit little-endian value
- Select exactly 2 bytes.
- Use Reverse order → DEC to read the little-endian number.
- Type a new value in that field to overwrite the two bytes.
Example C — Compare original vs modified
- Open original, open modified.
- Right-click original tab → Set as master.
- Right-click modified tab → Compare to… → choose original.
- Differences are highlighted; add markers to label each changed area.
Example D — XOR a selected block
- Select a block.
- Right‑click → XOR… → enter
FF to invert all bits in that region.
- Check Inspector/checksums to confirm effect.
16A) Auto‑Find XOR Checksum Byte
16B) Checksum Status Badge
17) Tips & safety
- Keep backups of the original file. Work on copies.
- Change small regions and validate with compare + checksum box.
- Be careful with XOR/FILL when nothing is selected (whole-file operation).
- For real ECU flashing workflows, confirm required checksum/CRC correction with your specialized tools.
16C) Checksum Finder (XOR / SUM8 / SUM16 / CRC16)
Purpose: Many dumps are protected by different checksum styles. This tool helps you locate where a checksum byte/word is, by scanning around your selection and testing common rules.
Where to find it
- Right‑click inside the hex area → Checksum Finder...
What it can search
Profiles & safety levels
- Generic (Manual): You choose an algorithm and offsets. Fix is available because you are explicitly defining the rule.
- Bosch EDC16 ST95320 4KB EEPROM: “Verified” mode in HEX‑MASTER. Fix is enabled only when the opened file is exactly
0x1000 bytes (4KB EEPROM dump). If size does not match, HEX‑MASTER switches to read‑only / Find only. - Bosch EDC16CP ST95320 4KB EEPROM: Same verified EEPROM checksum family as the EDC16 ST95320 profile (SUM16 → XOR with 0xFFFF → subtract block number). Fix is enabled only when the file size is exactly
0x1000 (4KB).
- ME7 / MED17 / EDC17 / other flashes: shown as Verify‑only unless you provide a known checksum map. Use Checksum Map Runner… with a validated map for that ECU/software.
Safe workflow: Always Find / Verify first on an untouched (original) dump. Then apply edits, and only then use Fix (or a validated checksum map) to restore integrity.
- XOR8 (inclusive): finds an end (or start) position where XOR(block) equals your target (default
00).
- SUM8 (inclusive): finds a position where SUM(block) mod 256 equals your target (default
00).
- SUM16 (inclusive): finds a position where SUM(block) mod 65536 equals your target (default
0000).
- CRC16 (stored): checks common CRC16 variants where the last 2 bytes (or first 2 bytes when searching backward) are the stored CRC of the protected data.
- Bosch EDC16 ST95320 EEPROM (SUM16^FFFF - block#): Bosch-style 16-bit checksum used in some EEPROM layouts (sum bytes, invert with 0xFFFF, then subtract the block number). Stored as a 2-byte value at the end of the protected block.
How it works (simple)
- Select the suspected protected data block (usually without the checksum bytes).
- Open Checksum Finder...
- Choose algorithm (XOR/SUM/CRC), target (if applicable), endianness (for 16‑bit), direction, search window, and checksum length.
- Click Find. HEX‑MASTER will extend your selection to the matching boundary and outline the found checksum bytes in green.
Recommended settings (real automotive use)
- Clusters / EEPROM blocks: start with XOR8 target 00, window 64–256 bytes.
- Simple additive protected blocks: try SUM8 target 00 (or SUM16 target 0000) and set checksum length 1 or 2.
- ECU areas: try CRC16/CCITT‑FALSE and CRC16/MODBUS first (checksum length 2). Use both endianness if unsure.
- Bosch EDC16 ST95320 4KB EEPROM: choose profile Bosch EDC16 ST95320 4KB EEPROM (or algorithm
Bosch EDC16 ST95320 EEPROM (SUM16^FFFF - block#)). Select the protected data bytes only, set Block number (commonly 4 in many blocks), and set Endian to match how the two checksum bytes are stored in your dump.
Important note (avoid false matches)
This is a pattern finder. Large windows can produce accidental matches. For best results:
- Use a small, correct block (don’t scan the whole file).
- If you find a match, verify by changing 1 byte in the block and confirming the checksum rule breaks, then fixing checksum and confirming it becomes valid again.
New in v4: “stored elsewhere”, “Fix”, custom CRC params, and checksum maps
- Stored elsewhere: Some ECUs store the checksum in a different address (not directly at the end/start of the block).
Choose an algorithm like
CRC16 (stored elsewhere) or XOR8 (stored elsewhere), then choose a
Search scope:
- near selection: scans forward/backward within the window
- entire file: scans the whole dump
- custom range: scans only between your start/end offsets
When a match is found, HEX-MASTER keeps your data selection and highlights the checksum bytes wherever they are stored.
- Fix button: Use Fix to write the correct checksum value.
- For
(checksum at end) algorithms, HEX-MASTER writes right after your selection.
- For
(checksum at start) algorithms, HEX-MASTER writes right before your selection.
- For
(stored elsewhere), set Fix checksum at offset (hex) to the target address.
This is useful after you edit bytes and want to restore a valid checksum quickly.
- Custom CRC parameters: Some OEMs use CRCs with different polynomials / init / xorout / reflection.
Choose
CRC16 (custom params, stored at end) or CRC32 (custom params, stored at end) and fill:
poly, init, xorout, and refin/refout.
(If you are not sure, start with a known CRC preset first.)
- Checksum Map Runner (multi-segment ECU flash workflows): Many ECU flashes have multiple checksum regions.
Use Right click → Checksum Map Runner… to load a JSON map and compute (and optionally write) all checksums in one step.
You can also generate a ready template with Right click → Export Checksum Map Template….
Checksum map JSON format (quick example)
Each segment defines a data range, an algorithm, and a store address where the checksum is saved.
{
"name": "Example ECU map",
"segments": [
{"data_start":"0x1000","data_end":"0x1FFF","algo":"CRC16",
"store_at":"0x2000","store_len":2,"endian":"big",
"params":{"variant":"CRC-16/CCITT-FALSE"}}
]
}
Tip: For Bosch/VAG style “checksum tables”, you normally represent each table entry as a segment in the JSON map.
HEX-MASTER does not guess OEM tables automatically (they differ by ECU family), but it gives you a clean way to apply a verified map.