Editing raw packet data

Whenever Netdude encounters data that is not specifically interpreted by some protocol plugin, the data is displayed using a hex editor, in a tab titled "(raw)". This editor supports two modes of operation -- hex and ASCII. In hex mode, it works like usual hex editors. An image of an editing session is shown below:

By clicking into the editor field, the cursor is placed either over a hex digit or the corresponding ASCII display on the right. The actual cursor is blue, the corresponding indicator in the other display part in a bright gray [1].

But our editor is better than that. For normal text, editing using the hex editor is cumbersome. You can use ASCII mode in those situations -- here the editor behaves more like a normal text editor. You can literally type up packet content!

There's one point that needs to be addressed when editing arbitrary binary data using the ASCII characters: unprintable characters and the null character, which normally delimits character strings. These characters are displayed as follows:

• The null character is displayed using ASCII code 0xf8, which is a circle with a diagonal line crossing it diagonally, thus looking a bit like a "0".

• Other nonprintable characters (those smaller than 0x20 and in the 0x7f - 0xa0 range, except newlines) are printed using a centered little dot.

When editing data in ASCII mode, the size of the data chunk you're modifying is not increased. This means that for every excess character you're adding, there is a character falling off the end and lost. You can see the affected characters displayed in a lighter hue, see the above screenshot for an example.