Skip to content
FrostyBee Docs LogoFrostyBee Docs

Hex Analysis Tools

Four tools in Hex view look at a whole file, or a selection of bytes, at once:

Tool Open it with
Find strings Alt + S, or More actions (…) → Find strings
Entropy strip Alt + E, Entropy in the toolbar, or More actions (…) → Entropy strip
Byte histogram More actions (…) → Byte histogram
Checksums Ctrl + Shift + K, or More actions (…) → Checksums

Each tool is also a command in the command palette. They work in Hex view only. In other views, the menu items are dimmed, with the reason Available in Hex view.

Find strings

Section titled “Find strings”

Find strings lists the runs of readable text in a file, such as messages, paths, and names, like the strings command. It opens the search panel in Str mode. For the search options, the minimum length, and UTF-16LE text, see Printable strings.

Each result shows the offset where the text starts, for example 0x0001F400, and the text, cut after 200 characters. Text found as UTF-16LE shows as ordinary characters. The results list does not show the length of each run.

Select a result, or press F3 or Shift + F3, to scroll to it; from another view this switches to Hex view. Vaste places the byte cursor on its first byte, so the data inspector reads from there. The runs are highlighted in both panes.

  • Like other searches, the list shows the first 10,000 results. See The 10,000-match limit.
  • The results cannot be copied, exported, pinned, or shown in Grep view, and a strings search cannot be combined with other searches. The search itself can be saved as a filter.
  • If you turn off Str after a search, the old results stay in the list but no longer lead to their bytes. Run the search again.

Entropy strip

Section titled “Entropy strip”

The entropy strip is a narrow bar beside the Hex view scrollbar. It shows how random each part of the file is, from the start of the file at the top to the end at the bottom:

  • Low entropy, a short bar in the theme’s info color, usually blue: text, padding, or repeated values.
  • High entropy, a long bar in the theme’s danger color, usually red: compressed or encrypted data, which is close to 8 bits per byte.

Use it to find the parts of a file: a text header before compressed data, embedded images, or a run of zeros.

The first time you show the strip for a file, Vaste reads the whole file. While it works, the strip fills from the top, and an × button cancels the work and hides the strip. After that, showing and hiding the strip is instant.

Hover over the strip to see the offset and the entropy of that part of the file, for example 0x01A40000 · 7.98 bits/byte. On a large file, each pixel of the strip covers several parts, and its bar shows the highest entropy among them, so one random part makes the whole pixel look random. A band on the strip marks the rows on screen. Click the strip to jump to that part of the file and place the byte cursor at its start.

The strip does not update while the file grows. A reload or an encoding change clears it, and you need to show it again.

Byte histogram

Section titled “Byte histogram”

The byte histogram counts how often each of the 256 byte values occurs. Text files use mostly printable values, and compressed or encrypted data uses every value about equally.

The dialog has these options:

  • Whole file or Selection followed by the size of the selected bytes. Selection (none) means no bytes were selected when you opened the dialog. A selection needs at least 2 bytes. See Select and copy bytes.
  • Log scale makes rare values visible next to very common ones.

The chart shows one bar per byte value, from 00 on the left to FF on the right. Hover over a bar to see its value, the character for printable values, the count, and the share of all bytes, for example 0x41 'A' · 1,204 · 0.12 %. Below the chart, a summary shows how many different values occur, the number of bytes, and the entropy in bits per byte.

For Whole file, the histogram uses the same reading of the file as the entropy strip, with Analysing… N% and a Cancel button the first time. Canceling also hides the entropy strip. For a selection, the dialog shows Analysing… 0% while it counts, without a way to cancel.

Checksums

Section titled “Checksums”

Checksums computes CRC32, MD5, SHA-1, SHA-256, and XXH3-64 for the whole file or for the selected bytes.

  1. Choose Whole file or Selection. The selection option shows its size and start offset.

  2. Clear the checkboxes of the algorithms you do not need. All five are selected by default.

  3. Select Compute.

While Vaste reads, the dialog shows the progress and the read speed, with a Cancel button. Closing the dialog also cancels. Vaste computes all the chosen checksums in one reading of the file.

When it finishes, the dialog shows Done in N ms and one value per algorithm, as lowercase hexadecimal. Select Copy next to a value to copy it. The dialog has no field for an expected value: to verify a download, compare the values by eye or paste the copied value where you need it. The values are lost when you close the dialog.

For a file that is still being written, the checksum covers the file as it was at the last reload. See Live reload.

Next steps

Section titled “Next steps”