Plugins — Hxd

Here’s a minimal plugin (in C) that XORs the selected bytes with a user-provided key.

#include <windows.h>
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) 
return TRUE;

__declspec(dllexport) void __cdecl HxDPluginInfo(char* pNameBuffer, int nBufferSize) 
strncpy_s(pNameBuffer, nBufferSize, "XOR Cipher", _TRUNCATE);

__declspec(dllexport) int __cdecl HxDMenuClick(HWND hParentWnd, unsigned char* pData,
unsigned __int64 qwDataSize, unsigned __int64 qwCurrentOffset) 
char key[8] = 0;
// Simple dialog to get XOR key (implementation abbreviated)
// For demo, we use a fixed key 0xAA
for (size_t i = 0; i < qwDataSize; i++) 
pData[i] ^= 0xAA;
MessageBoxA(hParentWnd, "XOR operation complete.", "Plugin", MB_OK);
return 0; // success
 hxd plugins

Compile as a DLL and place in Plugins. After restart, the XOR function operates directly on the selected bytes in HxD.

If you are a developer tired of waiting for official HxD plugins, you can build a bridge that feels native. Here is a conceptual architecture for a third-party "HxD Plugin Loader": Here’s a minimal plugin (in C) that XORs

This is a frequent source of confusion. There is a plugin for Notepad++ called NppExec that allows Notepad++ to talk to HXD. Users often mistakenly search for "HXD Notepad++ plugin" when they actually want to integrate the two.

Though HxD’s plugin API is relatively simple, the community and third-party developers have created several distinct categories:

Convert selected bytes to/from base64, hex string, binary string, or even floating-point representations (single/double). Ideal for extracting embedded data. it could corrupt evidence.

A "Carver" plugin could implement the IHDxView interface. As the user scrolls through a raw disk image, the plugin asynchronously parses headers and populates a side-panel with a tree structure of recoverable files (PNGs, PDFs, ZIPs), offering a "Recover" context menu action.

While you cannot install a .dll plugin directly into HxD, you can integrate external tools that act as plugins. Think of these as "companion applications" or "macro workarounds."

If a plugin modifies the IHDxDataSource unexpectedly, it could corrupt evidence.