Visualizing Binary Files

Christopher Domas gave a nice presentation[0] at DerbyCon 2012 about software that ended up becoming CantorDust[1]. I was pretty jazzed about after the presentation but didn't keep up with where it went.

[0] https://www.irongeek.com/i.php?page=videos/derbycon2/4-2-1-c...

[1] https://github.com/Battelle/cantordust

A different approach I’ve been working on: https://github.com/ufex/Ufex Detect the file format and display a detailed view of the structures within. Also has the hex editor with coloring based on bytes and sequences.

Rizin[1][2] has the byte-level highlight (enter visual mode with `V` key then rotate through modes using `p` or `P`)[3], and there is an issue[4] for Cutter to add binary visualization as a plugin, if anyone is up to the task.

[1] https://rizin.re

[2] https://github.com/rizinorg/rizin

[3] https://book.rizin.re/src/visual_mode/intro.html

[4] https://github.com/rizinorg/cutter-plugins/issues/3

surprised to not see hilbert curve mentioned here https://corte.si/posts/visualisation/binvis/

I always liked the 3D visualization in Veles[0]. It's very intuitive to make out structured ASCII or other non-compressed sections in binary data.

[0] https://github.com/codilime/veles

I would like to see the CFG visualized for executable files. I imagine a recursive descent parser would resemble a spiral?

Very nice, I did something similar a while back and was going to make a poster of interesting ones to hang in my office: https://www.telkins.com/blog/visualizing-file-formats

Never got around to that poster though. :(

If anyone is interested we open-sourced https://github.com/getsentry/launchpad which can produce a treemap visualization for Mach-O. I've been working on ELF support in my free time too but it's not finished.

Related: "Your hex editor should color-code bytes" (simonomi.dev)

614 points | 4 months ago | 159 comments

https://news.ycombinator.com/item?id=47846688

And binwalk if you want to find the juice within the file.

https://github.com/ReFirmLabs/binwalk/wiki/Supported-Signatu...

You might be interested in GNU poke[1][2], a hex-editor type program that can actually parse and visualize the structure of binary data (using a DSL for describing formats).

[1] https://jemarch.net/poke

[2] https://news.ycombinator.com/item?id=34986042

ClickHouse can read and visualize its own binary: https://play.clickhouse.com/binary?user=binary

It is useful to understand which dependencies, libraries, and template instantiations contribute to the size.

https://github.com/wader/fq

I have really liked fq for binary visualization.

arcan [1] has senseye [2][3].

[1] https://arcan-fe.com

[2] youtu.be/WBsv9IJpkDw

[3] youtu.be/ALA1W-BL8fA

I've been using https://binvis.io for this when I just want quick-and-dirty color coding to see what the heck I'm looking at.