http://www.openrce.org/rss/feeds/blog OpenRCE: The Open Reverse Code Engineering Community Tue, 27 Jun 2006 11:38:28 -0500 https://www.openrce.org/blog/view/346/messing_around_with_file_format_structure deft <email-suppressed@example.com> Thought it might be useful to visualize what a file format would look like as an image to identify blocks of similar data. <br /> <br /> Could be useful for more effective file format fuzzing and whatnot. Here's the output when run on putty.exe:<br /> <br /> <code><br /> bash-2.03$ python.exe image_gen.py putty.exe<br /> Aaron Portnoy - Binary2Image<br /> -----------------------------<br /> [*] Attempting to identify blocks...<br /> [+] Block found from 2 to 53.<br /> [+] Block found from 5 to 56.<br /> [+] Block found from 6 to 57.<br /> [+] Block found from 32 to 83.<br /> [+] Block found from 47 to 98.<br /> [+] Block found from 69 to 120.<br /> [+] Block found from 71 to 122.<br /> [+] Block found from 75 to 126.<br /> [+] Block found from 77 to 128.<br /> [+] Block found from 115 to 166.<br /> [+] Block found from 117 to 168.<br /> [+] Block found from 120 to 171.<br /> [+] Block found from 123 to 174<br /> ...<br /> [+] Block found from 8942 to 9008.<br /> [+] Block found from 8944 to 9010.<br /> [+] Block found from 8950 to 9015.<br /> [+] Block found from 8971 to 9045.<br /> [+] Block found from 8990 to 9089.<br /> [+] Block found from 9069 to 9173.<br /> [+] Block found from 9073 to 9175.<br /> [*] Creating image...<br /> [*] 25% complete...<br /> [*] 50% complete...<br /> [*] 75% complete...<br /> [*] 100% complete...<br /> [*] Resizing image...<br /> [*] Saving image...<br /> [*] Image saved successfully as output.png<br /> bash-2.03$ <br /> </code><br /> <br /> Results in:<br /> <br /> <img src="http://deft.thunkers.net/priv/putty.png" border=0 align=""><br /> <br /> The yellow are 0x00, dark blue are within ASCII, light blue is 0x20, and gray are everything else.<br /> <br /> The code is very basic at the moment, and I've done a lot of development since this, but here's the source used to create that image: <a href="http://deft.thunkers.net/code/image_gen.py_">http://deft.thunkers.net/code/image_gen.py_</a><br />