Visual Analysis of Binary Files | Hacker News Reader

Visual Analysis of Binary Files

binvis.io

115 pointsvismit200027 comments

I've also built a visualizer into ClickHouse, so we can analyze its binary: https://play.clickhouse.com/binary?user=binary - which code takes more space, what dependencies are too big, or what template instantiations are bloated.

I made my own binary visualizer when I was learning C. I had a for-loop which generated a texture by just setting the pixels based on the bytes in the file.

I had two modes, monochrome (the bits) and grayscale (the bytes).

Anyway funny thing happened, I had a buffer overflow and my program ended up visualizing its own memory.

Actually I had the same error another time, I was trying to make a simple Terraria clone (like 2D Minecraft) and the terrain ended up rendering my mouse coordinates interpreted as booleans or something.

C is fun!

Pretty neat. It tangentially reminds me of when we used to be able to hear HDDs clatter away, or waaaaay back when we used be able to hear EM interference from whatever was going on in a computer.

There was an episode of Cowboy Bebop, where a mechanic held a wrench against an engine cowling to see how much it vibrated (likely a real thing people do with real engines?) and, of course, the computer sounds in the Enterprise-D, along with blinkenlights.

All this seems like the same kind of "translate data into a form humans can perceive." I'm not sure what immediate value this utility has, but I like it.

The wrench thing is real. My approach to a DIY mechanic’s stethoscope is to stick the handle of a screwdriver against my ear and the tip on whatever I want to listen to. Great for figuring out what part of the machine a noise is coming from.

I forget where I read this (maybe PG's blog?) but I read some early 2000s startup had some kind of mechanical device that responded to website visitors, so everyone in the office could hear the traffic in realtime.

I also heard stories of professors who would know a program had a bug based on the sounds the computer was making. (Back when they were slightly slower!)

I’ve heard this about mechanical electronic signage used for team dashboards 30-40 years ago.

You’d sit in the office with your back to it and the clicky clacky sounds would be going every so often when the content updated. but people would know the specific clicky clacky sound that required them to turn around and read the sign based on their job function.

I’ve also heard of day traders mapping stock tickers or other data into sound and having headphones on all day with it

I've heard of people 'walking' old hard drive cabinets by fine manipulation of the read/write heads.

I still have a computer that produces slightly different noise (coil whine?) depending what it's doing. Fascinating behavior.

> There was an episode of Cowboy Bebop, where a mechanic held a wrench against an engine cowling to see how much it vibrated (likely a real thing people do with real engines?)

I was watching a documentary about dirt track racing and they showed one of the mechanics on the team who was blind.

He would put a long screwdriver on the engine and hold the handle to his ear. He could debug timing issues by hearing the vibrations.

There is also the case of the water leak detectors in the UK who use basically a long stick with one end on the ground and the other in their ear. e.g. https://www.youtube.com/watch?v=gVeEoWTsiiw

Love seeing the two example OS binaries side-by-side. Even though I don't know exactly what their differences mean, I feel like I'm getting a good impression of their "Gestalt." Thank you for sharing!

Discussion from a few days ago that had links to more visualization tools: https://news.ycombinator.com/item?id=49423878

This brings back memories! In 93 I wrote something similar (simpler) for MSDOS, to inspect and extract pieces of binary files, GFV (still downloadable from the Hornet archive somewhere in here https://www.hornet.org/cgi-bin/ha_search.cgi?opt_s=5:Iguana). You could set the stride and show 1/n bytes, so it was relatively easy to find textures from game files and memory dumps of running games.

It looks neat but I have no idea how the clustering works or why uniform colors are assigned to large areas, e.g. the color blue in the pdf example.

open one and inspect the two ways to view it, one is horizontal scan, the other is a peano curve which leads to natural square-ish areas.

I can only see the color visualization and the hex view. Maybe I can't see the curve due to lack of WebGL?

Interesting I thought it was a hilbert curve? (I don't know much about either of those though.)

I have been thinking we should do this for code too. I still haven't had time to execute on this plan, but I think there's probably part of the answer to how to use AI as a tool is how it doesn't automatically give us the same kind of window into what it does. In verbose mode, I've caught things earlier that I wouldn't have caught until later. But even beyond that, it speaks to how we draw lines between code and data and what happens if we erase those lines. What if we applied data vis methods to code? Maybe hierarchical semantic clustering colored by class hierarchy. Not just one floating architecture diagram. But different slices of the codebase.

“You get used to it; I don’t even see the code.

“All I see is blonde, brunette, redhead…”

https://youtu.be/fBDifUjNzbQ?is=7d43YcQZ8PVhFX11

Not exactly the same but https://runhexed.com allows you to create binary visualizations online

I vaguely remember a reverse engineering tool in the mid-to-late 2000s that displayed a similar (albeit greyscale) visualisation of entropy within large binary files. Anyone know what tool that would have been?

I was surprised by the timing of this post, after recently shipping a similar tool quite similarly named (vizbin as opposed to binviz). A little more surprised to see that so many folks have also developed similar tooling.

I don't know the name of the tool that did entropy visualization you're remembering, but this was my cue to mention that vizbin does that using the colorizer of your choosing.

https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#...

It can also show you a binary diff with colorization (and unlike cmp, an insertion does not make everything after it a "change", which I find useful.) https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#...

Another comment mentions using such a tool on source code; the binary strings example shows just that, with the source embedded in a tarball. Text is rendered as an 8x8 glyph font so you can immediately eyeball both.

https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#...

Rendering known pure text as 8x8 bitmap fonts via the tool might be a bit ludicrous, but you can force a different byteclass and see only the colors and not the actual ASCII characters, which I think might be what they are getting atwanting to do. https://github.com/scottvr/vizbin/tree/main#profile-structur...

Another useful things falls out from combining these concepts, which is that you could run `vizbin` on an entire repo. The example from the README (which assumes binaries) is given:

  # which files stand out? cluster by their region composition
  vizbin profile corpus/\*.bin --json | \
  jq -r '[(.regions|map(.kind)|unique|join("+")), .source] | @tsv'

The github repo has been linked a handful of times above, but you can also just install it from PyPi with `pip install vizbin`

Humans are so good at pattern recognition it's uncanny. Back in the modem days, most people automatically recognised the most important phases of downloads because of the way they sounded .

Did the same in 2015s with PHP, was so surprised to find an image inside explorer.exe file. It was an embedded BMP picture which I could see without even a picture viewer tool!

Does the uniformity indicate that the files are space-inefficient, and would benefit from compression?

Binvis has different color modes. One of them shows entropy. Compressed or encrypted data shows as very bright in the entropy mode, and repetitive data as dark.

I’m waiting for one of these random pixelized images to start pulsing and spit out a glider

Who remembers seeing PSQR everywhere in .COM files?

Reply on news.ycombinator.com