4 ms·
Next time you find yourself reverse engineering a weird protocol - use ImHex. You can literally define patterns (in a C++ / Rust -like language) so that your bi
by denysvitali 3y ago
Next time you find yourself reverse engineering a weird protocol - use ImHex. You can literally define patterns (in a C++ / Rust -like language) so that your binary file gets highlighted and processed.
I can't recommend it enough - it's perfect for the job and it's free and Open Source.
https://imhex.werwolv.net/ https://imhex.werwolv.net/
- raggles 3y agoJust coming here to say this. I was reversing a license file for some software so I could play with it yesterday, and I could implement the encryption/decryption code direct in the data processor of imhex, such a time saver.
- smlx 3y agoI have never heard of ImHex before. Thanks, I'll take a look!
- turtledragonfly 3y agoJust piggybacking here to mention a variety of other "interpret structured binary data" tools. Apparently I collect links to these (: * fq - like jq for binary data: https://github.com/wader/fq https://github.com/wader/fq * Kaitai Struct - https://kaitai.io/ https://kaitai.io/ ** visualizer, for the above: https://github.com/kaitai-io/kaitai_struct_visualizer/ https://github.com/kaitai-io/kaitai_struct_visualizer/ * HexFiend - a hex editor, but with "binary templates" feature : https://github.com/HexFiend/HexFiend https://github.com/HexFiend/HexFiend ** binary templates, for the above: https://github.com/HexFiend/HexFiend/blob/master/templates/Tutorial.md https://github.com/HexFiend/HexFiend/blob/master/templates/T... * binspector - https://github.com/binspector/binspector https://github.com/binspector/binspector * binary-parsing - a collection of links to similar such tools : https://github.com/dloss/binary-parsing https://github.com/dloss/binary-parsing * unblob - https://github.com/onekey-sec/unblob https://github.com/onekey-sec/unblob * ImHex, which you mention
- declaredapple 3y agois binwalk still used these days?
- sitzkrieg 3y agobinwalk or even strings as your first steps for shaking down a binary is often still very useful before pulling out the big guns
- denysvitali 3y agoFrom my experience, yes, it's still quite useful to find embedded formats
- moyix 3y agoNot free, but I have used 010 Editor for years and it's excellent.
- denysvitali 3y agoFrom experience, this is even better than 010Editor , and free
- wwader 3y agoHey! fq author here. I have a bunch of related tools in the readme https://github.com/wader/fq?tab=readme-ov-file#tools https://github.com/wader/fq?tab=readme-ov-file#tools two suggestions: gnu poke and wireshark (can decode lots of more things then just network protocols)
- username135 3y agoThanks!
- deleted 3y ago[deleted]
- mrmuagi 3y agoDo you know about any protocol deciphering tool? I'm trying to reverse engineer a kinda simple tcp data stream, and the values are tag-length-value for the most part, and I made a simple mitm proxy that prints known tags and their data values (that I was able to decipher) live, but I am doing the deciphering of known and unknown tags manually, but I was wondering if there is some way to automate this? I basically would be interested in automatic seen tag tracking, replaying select tags many times to see if they are idempotent, replaying and modifying bytes on a select tag, omitting a select tag and seeing how the client responds. I guess I could find the socket receive function in the binary and see if the tag values are in a switch or something too but like the original article, it's also new territory for me to read that. I am just about to expand my mitm proxy with more code to inject/filter packets.
- denysvitali 3y agoHave you tried Wireshark? It does support Lua templates, although for the initial analysis I would still suggested ImHex
- devwastaken 3y agoAre there tools that help in identifying structures? For example reverse engineering binary file formats like for bnd4, a save game format.