3

I have a binary file that I'd like to analyze for its file format. For this, I'd like a tool that lets me define interpretation rules and then attempts to display the existing file contents according to these rules.

E.g. I have

00000000 00 00 00 18 31 32 33 34 00 00 00 05 35 36 37 38  ....1234....5678
00000010 61 62 63 64 65 00 00 00 00 00 00 08 39 30 31 32  abcde.......9012
00000020 66 67 68 69 6a 6b 6c 6d 00 00 00 00              fghijklm....

and I'd like to interpret these as

  • four bytes big-endian length field
  • four bytes tag field
  • (length) bytes contents
  • padding to the next multiple of four

If the tag is "1234", then I'd like to apply the rule recursively, and a single zero-length element without a tag is also fine as a record terminator.

Since I don't know the format for the data I'm currently analyzing yet, the program should allow me to define such a format interactively.

I'm flexible concerning OS and price, but price margin is probably around 200 Euros.

2

I made good experience with Hexinator. There's a Tutorial that contains a screenshot.

It

  • is available for Windows, Mac OS and Linux
  • costs ~90 USD for commercial use
  • supports all kinds of datatypes, including bits and bytes
  • can define structs that are repeatable
  • can deal with relative and absolute offsets
  • saves a grammer independent from content, so you can reuse it on many different samples

I'm not exactly sure about padding, but if I recall correctly, it has a scripting language which could solve this issue. Unfortunately my trial period ended, so I can't try that.

| improve this answer | |
1

I use my Binary Editor for this kind of task: http://www.nyangau.org/be/be.htm

| improve this answer | |
0

I would suggest having a play with ipython &/or jupyter and the python standard library struct.

  • Available for just about every platform
  • Free, gratis & Open Source
  • You can rapidly build and save code that will allow you to parse the same format again.
| improve this answer | |
0

At my old company we used WinHex for tasks like this. It was pricy for us but incredibly useful for decoding and extracting data from binary files when we didn't have a conversion / extraction tool available. It had a huge feature set and the help file was organized well enough for us to learn as we went.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.