[denysvitali]

Next time you find yourself reverse engineering a weird protocol - use ImHex. You can literally define patterns (in a C++ / Rust -like language) so that your binary file gets highlighted and processed.

I can't recommend it enough - it's perfect for the job and it's free and Open Source.

https://imhex.werwolv.net/

[turtledragonfly]

Just piggybacking here to mention a variety of other "interpret structured binary data" tools. Apparently I collect links to these (:

* fq - like jq for binary data: https://github.com/wader/fq

* Kaitai Struct - https://kaitai.io/

** visualizer, for the above: https://github.com/kaitai-io/kaitai_struct_visualizer/

* HexFiend - a hex editor, but with "binary templates" feature : https://github.com/HexFiend/HexFiend

** binary templates, for the above: https://github.com/HexFiend/HexFiend/blob/master/templates/T...

* binspector - https://github.com/binspector/binspector

* binary-parsing - a collection of links to similar such tools : https://github.com/dloss/binary-parsing

* unblob - https://github.com/onekey-sec/unblob

* ImHex, which you mention

[wwader]

Hey! fq author here. I have a bunch of related tools in the readme https://github.com/wader/fq?tab=readme-ov-file#tools two suggestions: gnu poke and wireshark (can decode lots of more things then just network protocols)

[moyix]

Not free, but I have used 010 Editor for years and it's excellent.

[denysvitali]

From experience, this is even better than 010Editor , and free

[declaredapple]

is binwalk still used these days?

[sitzkrieg]

binwalk or even strings as your first steps for shaking down a binary is often still very useful before pulling out the big guns

[denysvitali]

From my experience, yes, it's still quite useful to find embedded formats

[mrmuagi]

Do you know about any protocol deciphering tool?

I'm trying to reverse engineer a kinda simple tcp data stream, and the values are tag-length-value for the most part, and I made a simple mitm proxy that prints known tags and their data values (that I was able to decipher) live, but I am doing the deciphering of known and unknown tags manually, but I was wondering if there is some way to automate this?

I basically would be interested in automatic seen tag tracking, replaying select tags many times to see if they are idempotent, replaying and modifying bytes on a select tag, omitting a select tag and seeing how the client responds.

I guess I could find the socket receive function in the binary and see if the tag values are in a switch or something too but like the original article, it's also new territory for me to read that.

I am just about to expand my mitm proxy with more code to inject/filter packets.

[denysvitali]

Have you tried Wireshark? It does support Lua templates, although for the initial analysis I would still suggested ImHex

[raggles]

Just coming here to say this. I was reversing a license file for some software so I could play with it yesterday, and I could implement the encryption/decryption code direct in the data processor of imhex, such a time saver.

[smlx]

I have never heard of ImHex before. Thanks, I'll take a look!

[devwastaken]

Are there tools that help in identifying structures? For example reverse engineering binary file formats like for bnd4, a save game format.

[username135]

Thanks!