Visualizing Binary Files

(movq.de)

92 points

by zdw1 days ago |

17 comments

by EvanAnderson11 hours ago|

[-]

Christopher Domas gave a nice presentation[0] at DerbyCon 2012 about software that ended up becoming CantorDust[1]. I was pretty jazzed about after the presentation but didn't keep up with where it went.

[0] https://www.irongeek.com/i.php?page=videos/derbycon2/4-2-1-c...

[1] https://github.com/Battelle/cantordust

by edpot11 hours ago|

prev|

[-]

A different approach I’ve been working on: https://github.com/ufex/Ufex Detect the file format and display a detailed view of the structures within. Also has the hex editor with coloring based on bytes and sequences.

by xvilka10 hours ago|

prev|

[-]

Rizin[1][2] has the byte-level highlight (enter visual mode with `V` key then rotate through modes using `p` or `P`)[3], and there is an issue[4] for Cutter to add binary visualization as a plugin, if anyone is up to the task.

[1] https://rizin.re

[2] https://github.com/rizinorg/rizin

[3] https://book.rizin.re/src/visual_mode/intro.html

[4] https://github.com/rizinorg/cutter-plugins/issues/3

by yeehawjared8 hours ago|

prev|

[-]

surprised to not see hilbert curve mentioned here https://corte.si/posts/visualisation/binvis/

by fussylogic7 hours ago|

parent|

[-]

Cool tool from the above blog post. Worth a look.

https://binvis.io/

Ps: I had the exact same thought!

Also: can programs be encoded into lossy image formats? Would be cool to see what image compression does to program functionality

by Retr0id5 hours ago|

parent|

[-]

I use binvis quite a lot for getting a quick overview of an unknown file format, using the entropy mode in particular.

However, I almost always switch it into the linear view. Hilbert curves are cool but I've never really found any benefit, and it makes it harder to intuit things like how far a particular feature is into the file, or whether two features are actually nearby (while near things in linear-space are typically near in hilbert-space, there are discontinuities).

by nvalis12 hours ago|

prev|

[-]

I always liked the 3D visualization in Veles[0]. It's very intuitive to make out structured ASCII or other non-compressed sections in binary data.

[0] https://github.com/codilime/veles

by wseqyrku2 hours ago|

prev|

[-]

I would like to see the CFG visualized for executable files. I imagine a recursive descent parser would resemble a spiral?

by trevor-e9 hours ago|

prev|

[-]

Very nice, I did something similar a while back and was going to make a poster of interesting ones to hang in my office: https://www.telkins.com/blog/visualizing-file-formats

Never got around to that poster though. :(

If anyone is interested we open-sourced https://github.com/getsentry/launchpad which can produce a treemap visualization for Mach-O. I've been working on ELF support in my free time too but it's not finished.

by WalterGR9 hours ago|

prev|

[-]

Related: "Your hex editor should color-code bytes" (simonomi.dev)

614 points | 4 months ago | 159 comments

https://news.ycombinator.com/item?id=47846688

by 1970-01-0111 hours ago|

prev|

[-]

And binwalk if you want to find the juice within the file.

https://github.com/ReFirmLabs/binwalk/wiki/Supported-Signatu...

by st_goliath11 hours ago|

prev|

[-]

You might be interested in GNU poke[1][2], a hex-editor type program that can actually parse and visualize the structure of binary data (using a DSL for describing formats).

[1] https://jemarch.net/poke

[2] https://news.ycombinator.com/item?id=34986042

by pdpi11 hours ago|

parent|

[-]

I've been using ImHex[0] for this purpose, to pretty good effect.

[0]: https://github.com/werwolv/imhex

by zX41ZdbW9 hours ago|

prev|

[-]

ClickHouse can read and visualize its own binary: https://play.clickhouse.com/binary?user=binary

It is useful to understand which dependencies, libraries, and template instantiations contribute to the size.