3 ms·

For the uninitiated who might find the idea particularly daunting, looking at hex dumps is not really looking at hex (I mean it kind of is after a while but tha

For the uninitiated who might find the idea particularly daunting, looking at hex dumps is not really looking at hex (I mean it kind of is after a while but that’s not the main idea). You have this raw binary dump of the content of something - generally memory or network flow - and tools which can help you turn the binary dump into a structured view. The issue is mapping the structures onto the dump. That’s where magic values and known values are useful. You can find them in the middle of the apparent garbage and use them to align your decoder (or to start reading the dump - if you do it often enough it becomes very Matrix like, “blonde, brunette” but with ip packets and C structs).

urthor 4y ago
It's funny how what you say is correct. ...But it's also familiar even to little ole me the neophyte, essentially the opposite of a class of 1978 greybeard, from good old Cheat Engine save file manipulation. Just funny how times change. Even some of the zoomers will know exactly what you're talking about because of Cheat Engine.
- ModernMech 4y ago
  Ha yeah. I used to edit Baldur’s Gate save files with a hex editor, and my magic numbers I guess would have been the characters’ various stats. Once I found those, I could infer inventory, skills, spells, etc. I remember changing my character to a wyvern model and I gave myself a fireball spell, and pretended there was a dragon in my party. Good times…
JoeAltmaier 4y ago
It isn't just looking at hex ... until it is. I used to work on a medium-model kernel back in the 8086 days. When somebody brought me a crash-dump to look at, one process I'd use is to just page through the kernel data segment, watching the hex go by and relaxing my mind. As often as not I'd see the corrupt data go by. A string copied where no strings should be. A zero in a dense table that should not have any zeroes. A block duplicated. Whatever it was, your brain can pattern match way more than we imagine it can.
anyfoo 4y ago
No, I did actually mean looking at the hex values themselves, with not much more than eyes, mind, and an internal concept of how things work. In things like exception handling and bootstrapping code, there's often not much a tool that decodes structures would give you that you don't see with your own eyes and thoughts anyway. That is very different from debugging, say, networking code.
genocidicbunny 4y ago
> if you do it often enough it becomes very Matrix like, “blonde, brunette” but with ip packets and C structs At one job I used to spend a lot of time looking at crash dumps from a game, and at some point I was able to pretty reliably identify various objects in the engine (models, textures, physics volumes..etc) just from how they looked in a hex view of the crash dumps. If its a system you're familiar with enough, it really is Matrix-like as you say.

urthor 4y ago

It's funny how what you say is correct. ...But it's also familiar even to little ole me the neophyte, essentially the opposite of a class of 1978 greybeard, from good old Cheat Engine save file manipulation. Just funny how times change. Even some of the zoomers will know exactly what you're talking about because of Cheat Engine.

ModernMech 4y ago
Ha yeah. I used to edit Baldur’s Gate save files with a hex editor, and my magic numbers I guess would have been the characters’ various stats. Once I found those, I could infer inventory, skills, spells, etc. I remember changing my character to a wyvern model and I gave myself a fireball spell, and pretended there was a dragon in my party. Good times…

JoeAltmaier 4y ago

It isn't just looking at hex ... until it is. I used to work on a medium-model kernel back in the 8086 days. When somebody brought me a crash-dump to look at, one process I'd use is to just page through the kernel data segment, watching the hex go by and relaxing my mind. As often as not I'd see the corrupt data go by. A string copied where no strings should be. A zero in a dense table that should not have any zeroes. A block duplicated. Whatever it was, your brain can pattern match way more than we imagine it can.

anyfoo 4y ago

No, I did actually mean looking at the hex values themselves, with not much more than eyes, mind, and an internal concept of how things work. In things like exception handling and bootstrapping code, there's often not much a tool that decodes structures would give you that you don't see with your own eyes and thoughts anyway. That is very different from debugging, say, networking code.

genocidicbunny 4y ago

> if you do it often enough it becomes very Matrix like, “blonde, brunette” but with ip packets and C structs At one job I used to spend a lot of time looking at crash dumps from a game, and at some point I was able to pretty reliably identify various objects in the engine (models, textures, physics volumes..etc) just from how they looked in a hex view of the crash dumps. If its a system you're familiar with enough, it really is Matrix-like as you say.