Search code examples
fileanalysisfile-typedecomposition

File structure explorer (sth like Wireshark, but for files)


I am looking for a software which is able to decompose and analyze files. Do you know any?

What I mean is something that, given a file, would tell me for example:

  • here is the magic number telling that it is a PNG, and here starts a colors definition, here goes the compression flag, and then there are the picture data, and so on...

or something like:

  • this is a MP3 file, here is the ID3 definition, here is the flag telling that this is the joint stereo and so on...

I am looking for a software doing with files what Wireshark (Ethereal) is doing with network traffic.

Thanks!


Solution

  • The software HexWorkshop is a commercial hex editor which has a "Data interpretation" mode in which each fields of a data structure is highlighted in the editor. It comes with a (very) few definitions of data structures or file format but you can easily write your own.

    I used to use a very old version (several years ago) and this software has helped me a lot for several reverse engineering projects.