分析专有数据格式的工具、方法?

发布于 2024-12-08 22:03:28 字数 317 浏览 1 评论 0原文

我需要分析包含来自科学仪器的原始数据的二进制数据文件。在十六进制查看器中快速查看表明可能没有加密或任何奇特的东西:整数可能会被写为整数(但我不知道字节顺序是什么),谁知道浮点数。

我可以访问一个(闭源)程序,可以查看文件的内容。所以我可以看到某个值是 74078。实际上我不确定搜索该值 - 我是否搜索 00 01 21 5E、其他一些字节顺序等? (Hex Fiend 不支持搜索十进制值)我如何找到浮点数?

生成这些文件的软件在 XP 上运行。如果可能的话,我更喜欢在 OSX 上运行的工具。

(嗯,我写了这个问题,忘了发布,然后解决了问题。我想我会写自己的答案。)

I need to analyse a binary data file containing raw data from a scientific instrument. A quick look in a hex viewer indicates that's probably no encryption or anything fancy: integers will probably be written as integers (but I don't know what byte order), and who knows about floating point.

I have access to a (closed source) program that can view the contents of the file. So I can see that a certain value is 74078. Actually searching for that value I'm not sure about - do I search for 00 01 21 5E, some other byte order, etc? (Hex Fiend doesn't support searching for decimal values) And how would I find a floating point number?

The software that produces these files runs on XP. I'd prefer tools that run on OSX if possible.

(Hmm, I wrote up this question, forgot to post it, then solved the problem. I guess I will write my own answer.)

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

揽月 2024-12-15 22:03:28

最终,Hex Fiend 就足够了。我期望做什么:

  1. 将已知值转换为十六进制
  2. 搜索它

我实际上做了什么:

  1. 随机选择一个看起来可能是有用值的十六进制块
  2. 告诉 Hex Fiend 将其显示为整数或浮点数无论是小端还是大端,直到它给出看起来合理的结果(即 45.000 比某个大整数更合理)。
  3. 在我从闭源程序获得的结果中搜索该结果。
  4. 记录下来,返回到步骤 1。(除了通常情况下下一个块不会是“随机”的,而是会按顺序进行。)

在这种情况下,实际上只有三个(二进制)变量用于如何解释数据:

  1. float 或整数
  2. 2 字节或 4 字节
  3. 小端或大端

变量越多,任务就会变得更加困难。如果 Hex Fiend 能够直接搜索整数/浮点数,或许尝试不同的组合,那就太好了。也许其他十六进制观众会这样做。

为了回答我最初的问题之一,74078 结果被存储为 5E2101。再多一点尝试和错误,我就能到达那里。 :)

更新
如果我重新做一遍,我会使用“Synalyze It!”,这是一个专门为此设计的工具目的。

在此处输入图像描述

In the end, Hex Fiend turned out to be just enough. What I was expecting to do:

  1. Convert a known value into hex
  2. Search for it

What I actually did:

  1. Pick a random chunk of hex that looked like it might be a useful value
  2. Tell Hex Fiend to display it as integer, or as float, in either little endian or big endian, until it gave a plausible looking result (ie, 45.000 is a lot more plausible than some huge integer)
  3. Search for that result in the results I had from the closed source program.
  4. Document it, go back to step 1. (Except that normally the next chunk wouldn't be 'random', but would follow sequentially.)

In this case there were really only three (binary) variables for how to interpret data:

  1. float or integer
  2. 2 bytes or 4 bytes
  3. little or big endian

With more variables the task would be a lot harder. It would have been nice if Hex Fiend could search for integers/floats directly, perhaps trying out the different combinations. Perhaps other hex viewers do.

And to answer one of my original questions, 74078 turned out to be stored as 5E2101. A bit more trial and error and I would have got there. :)

UPDATE
If I was doing this over, I'd use "Synalyze It!", a tool designed for exactly this purpose.

enter image description here

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文