This new version of format-bytes.py (a tool to decompose structured binary data with format strings) brings a couple of new features.
Format strings can now be stored in libraries: you can store often used format strings (option -f) in text files and refer to them for using with format-bytes.py. A library file has the name of the program (format-bytes) and extension .library. Library files can be placed in the same directory as the program, and/or the current directory.
A library file is a text file. Each format string has a name and takes one line: name=formatstring.
Example:
eqn=<HIHIIIIIBBBBBBBBBB40sIIBB*:XXXXXXXXXXXXXXXXXXsXXXX
This defines format string eqn. It can be retrieved with option -f name=eqn.
This format string can be followed by annotations (use a space character to separate the format string and the annotations):
Example:
eqn=<HIHIIIIIBBBBBBBBBB40sIIBB*:XXXXXXXXXXXXXXXXXXsXXXX 1: size of EQNOLEFILEHDR 9: Start MTEF header 14: Full size record 15: Line record 16: Font record 19: Shellcode (fontname)
A line in a library file that starts with # is a comment and is ignored.
Format strings inside a library can be used with option -f. For example, to use format string eqn1, you use option -f name=eqn1. You prefix the format string name with “name=”, like in this example:
Option -s can also take value r now, to select the remainder: -s r. Like this:
The FILETIME format has been added. To use it explicitly, use representation format T.
And finally, with option -F (Find), you can search for values inside a binary file. For the moment, only integers can be searched. Start the option value with #i# followed by the decimal number to search for.
Example:
format-bytes_V0_0_8.zip (https)
MD5: 22F216C2304434A302B0904A9D4AF1FE
SHA256: A38D9B57DDB23543E2D462CD0AF51A4DCEDA1814CF9EAD315716D471EAACEF19
[…] Update: format-bytes.py Version 0.0.8 […]
Pingback by Week 17 – 2019 – This Week In 4n6 — Sunday 28 April 2019 @ 7:58
[…] Update: format-bytes.py Version 0.0.8 […]
Pingback by Overview of Content Published in April | Didier Stevens — Sunday 19 May 2019 @ 7:55