8 ms·

I strongly recommend checking out 010 Editor [1]. It's very powerful, lets you display in multiple different formats (not just 1/2/4/8 bytes, but interlaced fo

I strongly recommend checking out 010 Editor [1]. It's very powerful, lets you display in multiple different formats (not just 1/2/4/8 bytes, but interlaced formats and byte-arrays) and has the most amazing templating / scripting engine I've seen for this type of tool. The only caveat is that it isn't free, but if this is something you do for a living (as I do) it's an indispensable tool for exploring file formats and other binary data sources. [1]: https://www.sweetscape.com/010editor/ https://www.sweetscape.com/010editor/

mkroman 6y ago
Yep, same! 010 Editor is one of the few commercial tools that I just have to have a license for - I don't use it to make a living, but I've participated in some CTFs and challenges, and just yesterday I noticed that a WAV file had metadata which I didn't know was a thing, so I just opened it in 010 Editor with the WAV template and I could see how the metadata was stored, and all other fields!
mockery 6y ago
Yes! The 010 Editor's templating language is a nearly unique (in my experience) hybrid between C-like declarations and imperative flow that's exactly what I want for parsing arbitrary binary files. The template executes like a script (with conditionals and looping) and a line like "int32 myNum;" is actually just syntactic sugar for "read 4 bytes from the current file pointer and label it myNum." Their example probably does a better job explaining it than I can: struct FILE { struct HEADER { char type[4]; int version; ushort numRecords; } header <bgcolor=cLtGray>; struct RECORD { int employeeId; char name[40]; float salary; if( file.header.version > 1 ) int numChildren; if( file.header.version > 2 ) time_t birthDate; } record[ file.header.numRecords ]; } file; ( From: https://www.sweetscape.com/010editor/templates.html https://www.sweetscape.com/010editor/templates.html )
- deleted 6y ago
  [deleted]
app4soft 6y ago
> I strongly recommend checking out 010 Editor. Thanks, but NO. Because 010 Editor is closed-source/proprietary commercial software. rehex is fully free & open-source instead. There are also few other cross-platform FLOSS Hex editors with GUI: - https://github.com/afrantzis/bless https://github.com/afrantzis/bless (mostly I'm using it) - https://github.com/EUA/wxHexEditor https://github.com/EUA/wxHexEditor - https://github.com/wxMEdit/wxMEdit https://github.com/wxMEdit/wxMEdit
- nostoc 6y ago
  It is closed source, but the templating language is amazingly useful, and nothing in the open source comes close to what it offers. If you need a hex editor for RE purposes, I'd highly recommend at least trying it out.
  - app4soft 6y ago
    > It is closed source, but the templating language is amazingly useful > I'd highly at least trying it out No, thanks. This is known as drug dealers' "free sample".[0,1] [0] https://skeptics.stackexchange.com/questions/33094/do-dealers-give-free-drugs-to-teenagers https://skeptics.stackexchange.com/questions/33094/do-dealer... [1] https://steamcommunity.com/app/1275630/ https://steamcommunity.com/app/1275630/ [2] https://gameplay.tips/guides/7409-drug-dealer-simulator.html https://gameplay.tips/guides/7409-drug-dealer-simulator.html
    - smabie 6y ago
      drug dealers don't actually give out free samples to people they don't know. Also just.. wow. Not sure if you're being serious since two of your links are about a video game?
      - app4soft 6y ago
        > drug dealers don't actually give out free samples to people they don't know. > actually What a worst time we live. > Not sure if you're being serious since two of your links are about a video game? Links are about simulator, not a game. All is simulation, as Elon says[0],... and simulation of simulation.[1] [0] https://twitter.com/elonmusk/status/915957815197319168 https://twitter.com/elonmusk/status/915957815197319168 [1] https://www.msn.com/en-ca/news/canada/getting-the-drug-dealers-drug-dealers-ontario-police-target-wholesale-traffickers-in-large-probe/ar-BBZv33I https://www.msn.com/en-ca/news/canada/getting-the-drug-deale...
kop316 6y ago
Serious question, is it really worth it for $130?
- mkroman 6y ago
  The next time you want to dwell into a file format, download it and do the 30 day trial - maybe there's already an existing template for the file you're looking for - if not, try making your own - it's super easy! Then you can decide if it's worth it. If such a situation never arises, then no, it's not worth it in your case. I used it a lot when datamining in World of Warcraft - I would find reverse engineered documentation from previous versions of the game, write it into a 010 editor template struct, run it on the DBC file and then I'd usually get a result where the header and the first few fields would be fine, but the rest would be completely wrong. All I did was add a field in the template before the first obviously wrong field, with different, random sizes, to add random padding until the field started looking correct again. It's a pretty specific case, but it almost always worked!
jahewson 6y ago
If you’re on the Mac, Synalyze It! is somewhat similar. https://www.synalysis.net/ https://www.synalysis.net/
- radicality 6y ago
  I used this for viewing mysql binary logs recently to understand the format. I was upset when I realized the $10 version was severely nerfed. With lack of scripting I couldn't write even a basic grammar to parse out the binlog file. At that point I was too annoyed to shell out another $40 for the pro version. If you are considering this, get the Pro version. I would recommend to the owner to just make the non-pro version free.
rootw0rm 6y ago
it's also my hex editor of choice, has been for years
TomVDB 6y ago
What's the lowest level of granularity? Byte level? Because I'd love templating feature like that works at the bit level. IOW: you can specify some a bunch of fields to be, say, 3 bits each, and that when all the bits of a byte are used, it simply spills over to the next byte.
- oauea 6y ago
  https://www.sweetscape.com/010editor/manual/Bitfields.htm https://www.sweetscape.com/010editor/manual/Bitfields.htm
appleflaxen 6y ago
Okteta is part of the KDE project, GPL, and has similar templating functionality

mkroman 6y ago

Yep, same! 010 Editor is one of the few commercial tools that I just have to have a license for - I don't use it to make a living, but I've participated in some CTFs and challenges, and just yesterday I noticed that a WAV file had metadata which I didn't know was a thing, so I just opened it in 010 Editor with the WAV template and I could see how the metadata was stored, and all other fields!

mockery 6y ago

Yes! The 010 Editor's templating language is a nearly unique (in my experience) hybrid between C-like declarations and imperative flow that's exactly what I want for parsing arbitrary binary files. The template executes like a script (with conditionals and looping) and a line like "int32 myNum;" is actually just syntactic sugar for "read 4 bytes from the current file pointer and label it myNum." Their example probably does a better job explaining it than I can: struct FILE { struct HEADER { char type[4]; int version; ushort numRecords; } header <bgcolor=cLtGray>; struct RECORD { int employeeId; char name[40]; float salary; if( file.header.version > 1 ) int numChildren; if( file.header.version > 2 ) time_t birthDate; } record[ file.header.numRecords ]; } file; ( From: https://www.sweetscape.com/010editor/templates.html https://www.sweetscape.com/010editor/templates.html )

deleted 6y ago
[deleted]

app4soft 6y ago

> I strongly recommend checking out 010 Editor. Thanks, but NO. Because 010 Editor is closed-source/proprietary commercial software. rehex is fully free & open-source instead. There are also few other cross-platform FLOSS Hex editors with GUI: - https://github.com/afrantzis/bless https://github.com/afrantzis/bless (mostly I'm using it) - https://github.com/EUA/wxHexEditor https://github.com/EUA/wxHexEditor - https://github.com/wxMEdit/wxMEdit https://github.com/wxMEdit/wxMEdit

nostoc 6y ago
It is closed source, but the templating language is amazingly useful, and nothing in the open source comes close to what it offers. If you need a hex editor for RE purposes, I'd highly recommend at least trying it out.
- app4soft 6y ago
  > It is closed source, but the templating language is amazingly useful > I'd highly at least trying it out No, thanks. This is known as drug dealers' "free sample".[0,1] [0] https://skeptics.stackexchange.com/questions/33094/do-dealers-give-free-drugs-to-teenagers https://skeptics.stackexchange.com/questions/33094/do-dealer... [1] https://steamcommunity.com/app/1275630/ https://steamcommunity.com/app/1275630/ [2] https://gameplay.tips/guides/7409-drug-dealer-simulator.html https://gameplay.tips/guides/7409-drug-dealer-simulator.html
  - smabie 6y ago
    drug dealers don't actually give out free samples to people they don't know. Also just.. wow. Not sure if you're being serious since two of your links are about a video game?
    - app4soft 6y ago
      > drug dealers don't actually give out free samples to people they don't know. > actually What a worst time we live. > Not sure if you're being serious since two of your links are about a video game? Links are about simulator, not a game. All is simulation, as Elon says[0],... and simulation of simulation.[1] [0] https://twitter.com/elonmusk/status/915957815197319168 https://twitter.com/elonmusk/status/915957815197319168 [1] https://www.msn.com/en-ca/news/canada/getting-the-drug-dealers-drug-dealers-ontario-police-target-wholesale-traffickers-in-large-probe/ar-BBZv33I https://www.msn.com/en-ca/news/canada/getting-the-drug-deale...

kop316 6y ago

Serious question, is it really worth it for $130?

mkroman 6y ago
The next time you want to dwell into a file format, download it and do the 30 day trial - maybe there's already an existing template for the file you're looking for - if not, try making your own - it's super easy! Then you can decide if it's worth it. If such a situation never arises, then no, it's not worth it in your case. I used it a lot when datamining in World of Warcraft - I would find reverse engineered documentation from previous versions of the game, write it into a 010 editor template struct, run it on the DBC file and then I'd usually get a result where the header and the first few fields would be fine, but the rest would be completely wrong. All I did was add a field in the template before the first obviously wrong field, with different, random sizes, to add random padding until the field started looking correct again. It's a pretty specific case, but it almost always worked!

jahewson 6y ago

If you’re on the Mac, Synalyze It! is somewhat similar. https://www.synalysis.net/ https://www.synalysis.net/

radicality 6y ago
I used this for viewing mysql binary logs recently to understand the format. I was upset when I realized the $10 version was severely nerfed. With lack of scripting I couldn't write even a basic grammar to parse out the binlog file. At that point I was too annoyed to shell out another $40 for the pro version. If you are considering this, get the Pro version. I would recommend to the owner to just make the non-pro version free.

rootw0rm 6y ago

it's also my hex editor of choice, has been for years

TomVDB 6y ago

What's the lowest level of granularity? Byte level? Because I'd love templating feature like that works at the bit level. IOW: you can specify some a bunch of fields to be, say, 3 bits each, and that when all the bits of a byte are used, it simply spills over to the next byte.

oauea 6y ago
https://www.sweetscape.com/010editor/manual/Bitfields.htm https://www.sweetscape.com/010editor/manual/Bitfields.htm

appleflaxen 6y ago

Okteta is part of the KDE project, GPL, and has similar templating functionality