4 ms·
Kaitai Struct: declarative binary format parsing language
- zzlk 1y agoI wanted to use this a long time ago but the rust support wasn't there. I can see now that it's on the front page with apparently first class support so looks like I can give it a go again.
- jdp 1y agoI also like Protodata [1]. It's complementary as an exploration and transformation tool when working with binary data formats. [1]: https://github.com/evincarofautumn/protodata https://github.com/evincarofautumn/protodata
- woodruffw 1y agoKaitai Struct is really great. I've used it several times over the years to quickly pull in a parser that I'd otherwise have to hand-roll (and almost certainly get subtly wrong). Their reference parsers for Mach-O and DER work quite nicely in abi3audit[1]. [1]: https://github.com/pypa/abi3audit/tree/main/abi3audit/_vendor https://github.com/pypa/abi3audit/tree/main/abi3audit/_vendo...
- theLiminator 1y agoIs the main difference from https://github.com/google/wuffs https://github.com/google/wuffs being that Kaitai is declarative?
- setheron 1y agoLooking at that repo.. i have no clue how to get started.
- nigeltao 1y agoThe top-level README has a link called "Getting Started".
- Sesse__ 1y agoThey overlap, but none does strictly more than the other. Kaitai is for describing, encoding and decoding file formats. Wuffs is for decoding images (which includes decoding certain file formats). Kaitai is multi-language, Wuffs compiles to C only. If you wrote a parser for PNGs, your Kaitai implementation could tell you what the resolution was, where the palette information was (if any), what the comments look like and on what byte the compressed pixel chunk started. Your Wuffs implementation would give you back the decoded pixels (OK, and the resolution). Think of Kaitai as an IDL generator for file formats, perhaps. It lets you parse the file into some sort of language-native struct (say, a series of nested objects) but doesn't try to process it beyond the parse.
- nigeltao 1y agoSee https://github.com/google/wuffs/blob/main/doc/related-work.md https://github.com/google/wuffs/blob/main/doc/related-work.m... > Kaitai Struct is in a similar space, generating safe parsers for multiple target programming languages from one declarative specification. Again, Wuffs differs in that it is a complete (and performant) end to end implementation, not just for the structured parts of a file format. Repeating a point in the previous paragraph, the difficulty in decoding the GIF format isn't in the regularly-expressible part of the format, it's in the LZW compression. Kaitai's GIF parser returns the compressed LZW data as an opaque blob. Taking PNG as an example, Kaitai will tell you the image's metadata (including width and height) and that the compressed pixels are in the such-and-such part of the file. But unlike Wuffs, Kaitai doesn't actually decode the compressed pixels. --- Wuffs' generated C code also doesn't need any capabilities, including the ability to malloc or free. Its example/mzcat program (equivalent to /bin/bzcat or /bin/zcat, for decoding BZIP2 or GZIP) self-imposes a SECCOMP_MODE_STRICT sandbox, which is so restrictive (and secure!) that it prohibits any syscalls other than read, write, _exit and sigreturn. (I am the Wuffs author.)
- deleted 1y ago[deleted]
- corysama 1y agoWuffs looks pretty awesome. Thanks for making it. Wuffs is intended for files. But, would it be a bad idea to use it to parse network data from untrusted endpoints?
- nigeltao 1y agoIt's a great idea. Chromium uses Wuffs to parse GIF data from the untrusted network. There's also a "wget some JSON and pipe that to what Wuffs calls example/jsonptr" example at https://nigeltao.github.io/blog/2020/jsonptr.html#sandboxing https://nigeltao.github.io/blog/2020/jsonptr.html#sandboxing
- mturk 1y agoKaitai is absolutely one of my favorite projects. I use it for work (parsing scientific formats, prototyping and exploring those formats, etc) as well as for fun (reverse engineering games, formats for DOSbox core dumps, etc). I gave a guest lecture in a friend's class last week where we used Kaitai to back out the file format used in "Where in Time is Carmen Sandiego" and it was a total blast. (For me. Not sure that the class agreed? Maybe.) The Web IDE made this super easy -- https://ide.kaitai.io/ https://ide.kaitai.io/ . (On my youtube page I've got recordings of streams where I work with Kaitai to do projects like these, but somehow I am not able to work up the courage to link them here.)
- heromal 1y agoI'm curious, how do you use it for Game RE?
- ACCount37 1y agoNot the author, but also in RE. RE, especially of older and more specialized software, involves dealing with odd undocumented binary formats. Which you may have to dissect carefully with a hex editor and a decompiler, so that you can get at the data inside. Kaitai lets you prototype a parser for formats like that on the go, quick and easy.
- pvitz 1y agoA shot in the dark, but maybe you could give me a hint. Recently, I was interested in extracting sprites from an old game. I was able to reverse the file format of the data archive, which contained the game assets as files. However, I got stuck because the image files were obviously compressed. By chance, I found an open source reimplementation of the game and realised it was LZ77+Huffman compressed, but how would one detect the type of compression and parameters with only the file? That seems a pretty hard problem or are there good heuristics to detect that?
- ACCount37 1y ago
- setheron 1y agoGreat timing! I just published https://github.com/fzakaria/nix-nar-kaitai-spec https://github.com/fzakaria/nix-nar-kaitai-spec and contributed kaitai C++ STL runtime to nixpkgs https://github.com/NixOS/nixpkgs/pull/454243 https://github.com/NixOS/nixpkgs/pull/454243
- layoric 1y agoI discovered this project recently and used it for Himawari Standard Data format and it made it so much easier. Definitely recommend using this if you need to create binary readers for uncommon formats.
- okanat 1y agoEven if you don't want to use it since it is not as efficient as a hand-written specialized parser, Kaitai Struct gives a perfect way of documenting file formats. I love the idea and every bit of the project!
- jonstewart 1y agoI like using it for parsing structs but then intersperse procedural code in it for loops/containers, so not everything gets read into RAM all at once.
- sitkack 1y agoWhat was the Python based binary parsing library from around 2010? Hachoir? https://hachoir.readthedocs.io/en/latest/index.html https://hachoir.readthedocs.io/en/latest/index.html
- ctoth 1y agoConstruct?
- jonstewart 1y agoHachoir was rad, just not very fast.
- ginko 1y agoNo pure C backend?
- dhsysusbsjsi 1y agoThis would be great for most projects as Swift for example is abandoned & 6+ years since last commit.
- vendiddy 1y agoIt's not C but we have sponsored a Zig target for Kaitai. If anyone reading this knows Zig well, please comment because would love to get a code review of the generated code!
- vitalnodo 1y agoCan you share the link? I wonder also whether it uses comptine features.
- vendiddy 1y agoIt is not yet ready but the master branch has an initial draft. https://github.com/kaitai-io/kaitai_struct_compiler/commits/master/ https://github.com/kaitai-io/kaitai_struct_compiler/commits/... It would be premature to review now because there are some missing features and stuff that has to be cleaned up. But I am interested in finding someone experienced in Zig to help the maintainer with a sanity check to make best practices are being followed. (Would be willing to pay for their time.) If comptime is used, it would be minimal. This is because code-generation is being done anyway so that can be an explicit alternative to comptime. But we have considered using it in a few places to simplify the code-generation.
- imtringued 1y agohttps://en.wikipedia.org/wiki/Data_Format_Description_Language https://en.wikipedia.org/wiki/Data_Format_Description_Langua... DFDL is heavily encroaching on Kaitai structs territory.
- dgan 1y agoWow this is good. My only complaint is annoyingly verbose yaml. What if I would like to use Kaitai instead of protobuffs, my .proto file is already a thousand lines, splitting each od these lines into 3-4 yaml indented lines is hurting readability
- indrora 1y agoYou're using it for the wrong thing, then. KS isn't for general data mangling, it's for "I have this format and I need a de novo parser for it that works under explicit rules" and you're willing to do the work of fully implementing it from the bytes up.
- dgan 1y agoOk. What if I want a general, polyglot data mangling tool, which doesnt produces metrics tons of bloat like protobuf does?
- Everdred2dx 1y agoI had a ton of fun using Kaitai to write an unpacking script for a video game's proprietary pack file format. Super cool project. I did NOT have fun trying to use Kaitai to pack the files back together. Not sure if this has improved at all but a year or so ago you had to build dependencies yourself and the process was so cumbersome it ended up being easier to just write imperative code to do it myself.
- kodachi 1y agoIt hasn't improved that much, you need to know the final size and fill all attributes, there are no defaults, at least in Python.
- bburky 1y agoKaitai is pretty nice. Hex editors with structure parsing support used to be more rare than they are now, so I've used https://ide.kaitai.io/ https://ide.kaitai.io/ instead a few times. Also, the newest Kaitai release added (long awaited) serialization support! I haven't had a chance to try it out. https://kaitai.io/news/2025/09/07/kaitai-struct-v0.11-released.html https://kaitai.io/news/2025/09/07/kaitai-struct-v0.11-releas...
- unit149 1y ago[dead]
- lzcdhr 1y agoDoes it support incremental parsing? For example, when I am parsing a network protocol, can it still consume some data from the head of the buffer even if the data is incomplete? This would not only avoid multiple attempts to restart parsing from the beginning but also prevent the buffer from growing excessively.
- carom 1y agoMy dream for a parsing library / language is that it would be able to read, manipulate, and then re-serialize the data. I'm sure there are a ton of edge cases there, but the round trip would be so useful for fuzzing and program analysis.
- jaxefayo 1y agoFrom what I’ve read, kaitai does that now. For the longest time it could only parse, but I believe now it can generate/serialize.
- whitten 1y agoTo quote from the page: id: flags type: u1 This seems to say flags is a sort of unsigned integer. Is there a way to break the flags into big endiaN bits where the first two bits are either 01 or 10 but not 00 or 11 with 01 meaning DATA and 01 meaning POINTER with the next five bits as a counter of segments and the next bit is 1 if the default is BLACK and 1 if the default is WHITE ?
- CGamesPlay 1y agoAppears so: https://doc.kaitai.io/user_guide.html#_bit_sized_integers https://doc.kaitai.io/user_guide.html#_bit_sized_integers
- pabs3 1y agoKaitai is one of many different tools that do this, there is a list of them here: https://github.com/dloss/binary-parsing https://github.com/dloss/binary-parsing Personally I like GNU Poke.
- dhx 1y agoIs anyone aware of a project that provides simplified declaration of constraint checking? For example: structures: struct a { strz b, strz c, int d, str[d] e } constraints: len(b) > len(c) d > 6 d <= 10 e ~ /^ABC\d+/
- kodachi 1y agoThe recent release of 0.11 marks the inclusion of the long awaited serialization feature. Python and Java only for now. I've been using it for a while for Python and although it has some rough edges, it works pretty well and I'm super excited for the project.
- somethingsome 1y agoI didn't check exactly what Kaitai does but, MPEG uses a custom SDL for it's binary syntax: https://mpeggroup.github.io/mpeg-sdl-editor/ https://mpeggroup.github.io/mpeg-sdl-editor/ Just sharing, in case someone is interested :)
- Locutus_ 1y agoHow is the write support now-adays, is it production quality now? I used Kaitai in a IoT project for building data ingress parsers and it was great. But not having write support was a bummer.
- Rucadi 1y agoThe most success I had so far on doing a project where I had to work with binary data parsing is Deku in rust, I would give this a try if I have the opportunity
- depierre 1y agoOne of my personal favorites. I've used it for parsing SAP's RPC network protocol, reverse-engineering Garmin apps [0], and more recently in a CTF challenge that involved an unknown file format, among others. It's surprisingly quick to pick up once you get the hang of the syntax. The serialization branch for Python [1] (I haven't tried the Java one) has generally done the job for me, though I've had to patch a few edge cases. One feature I've often wished for is access to physical offsets within the file being parsed (e.g. being able to tell that a field foo that you just parsed starts at offset 0x100 from the beginning of the file). As far as I know, you only get relative offsets to the parent structure. 0: https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/ciq.ksy https://github.com/anvilsecure/garmin-ciq-app-research/blob/... 1: https://doc.kaitai.io/serialization.html https://doc.kaitai.io/serialization.html
- metaPushkin 1y agoEnjoyable tool. When I developed my text RPG game, I prepared a Kaitai specification for the save file data format so that it would be easy to create third-party software for viewing and modifying it =)
- casey2 1y agohttps://www.erlang.org/doc/system/bit_syntax.html https://www.erlang.org/doc/system/bit_syntax.html highly recommended if you like functional languages
- karhuton 1y agoWow. Looking at the schema for gif, it’s so readable, I can’t help to wonder why something like this hasn’t become the standard way to work with binary formats over the decades already! Seems like eveything has to be JSON and text based these days, because binary is more difficult DX. When reading articles discussing binary formats, I usually see them using box diagrams of packets, description tables or hexdumps. This neatly describes nested structure, names and ”types” - just enough. I wonder if there’s a hexdump like viewer in IDEs that can present binary files like this? I can also imagine a simple UI to make the files editable using this.