binview

Tool tools/triage/binview.py (program, Triage). Draw a file as a picture, one pixel per byte (or per block of bytes), to see its structure at a glance: headers, tables of records, text, code, compressed or encrypted parts, padding.

Run it with ./gameframe run binview ARGS or python3 tools/triage/binview.py. Source on GitHub.

Its own help

This is the help text in the tool itself, as ./gameframe tool binview prints it.

Draw a file as a picture, one pixel per byte (or per block of bytes), to see its structure at
a glance: headers, tables of records, text, code, compressed or encrypted parts, padding.

Usage: binview.py FILE OUT.png [--colour class|entropy] [--layout rows|hilbert]
                  [--width N] [--offset N] [--length N] [--pixels N]

  --colour class    each byte by its kind (default):
                      black  0x00          white  0xFF
                      blue   printable ASCII
                      green  control bytes 0x01 to 0x1F, 0x7F
                      red    bytes 0x80 to 0xFE
  --colour entropy  each pixel by the entropy of the 1,024 bytes around it: dark blue for
                    ordered data, through green and yellow, to red for compressed or
                    encrypted data
  --layout rows     left to right, top to bottom, --width pixels per row (default 256)
  --layout hilbert  along a Hilbert curve, which keeps neighbouring bytes close in the
                    picture, so a region of the file is a patch instead of a band
  --pixels N        the most pixels to draw (default 1,048,576); a longer file gets one
                    pixel per block of bytes, coloured by the block's most common kind

What to look for: a run of red speckle is compressed or encrypted; regular stripes are a table
of fixed-size records (the stripe's period is the record size, best seen with --width set to a
multiple of it); blue is text; black is empty space or padding; an executable shows its
header, a dense code section, then tables and strings. Compare two versions of a file side by
side to see which parts changed. Writes PNG with the standard library only.

Named by

Skills: re-inventory, re-format.