View Image

HexDive is a command-line tool which can display interesting ASCII and UNICODE strings embedded within any binary file. HexDive is smarter, because it comes with a dictionary of keywords (which is also why it’s an 18.4MB download) and by default only displays the matches. Run something like hdive file.exe at the command line to view the results, or try hdive file.exe | clip to send them to the clipboard.

This extra intelligence really can save you time and hassle, but there’s also the possibility HexDive might leave out something important. Fortunately the developer has provided additional switches, like hdive -a file.exe to display all strings within a file.

New version is 25% larger (what a bloatware! :)) as it brings in a huge number of new strings:

PE Section names and other packer identifiers
Installer-related strings
Identifiers of script-to-exe type tools e.g. perl2exe, py2exe, exerb, winbatch
Lots of known CLSID strings
It slowly gets to the point where I wanted it to be when I started writing it. I also think I finally got it right on how to present the data extracted from a file in a way that:

shows as many interesting strings as possible
makes it as readable as possible
with all that it still provides information about the string’s context
allows to quickly find the string in a hex editor
in a full-output mode allows for an easy parsing
avoid missing strings as much as possible