ABOUT
Home
 What is it?
Struct-A-File User Guide
File-A-Nyzer User Guide
 DEVELOPMENT
Current Status
The next step
 DOWNLOAD
Requirements
Download package
Installing
SourceForge.net Logo
 

 

Contents

Contents *

Introduction *

Basic application concepts *

Nodes and more nodes *

The need for speed *

Moving around the application GUI *

The Main Screen *

Inspecting a simple binary file *

Design a BBF and export its respective DNF file *

Opening a binary file *

Visualising it *

Analysing it *

Glossary *

 

 

Introduction

File-A-Nyzer is a "Binary File Analyzer Application". In other words, allows for the user to visualise analyse the contents of a complete binary file format using a friendly GUI.

In this document we’ll start by specifying the main application concepts. This allows the user to visualise how he will strip down his binary file components. The next step is to fully explain the application GUI that is obviously proceeded by a visualisation and analyse example.

 Also, the example files used in this document can be found on the project under the "./doc/examples" directory.

 

Basic application concepts

 

Nodes and more nodes

Everything is a Node! Well… almost… the application itself is not. Each application is based in the very simple concepts of modularity and scalability. To achieve this it was imperative to separate the main application from the node configuration.

 

Basically, the application provides the context to work in which can be either configuration or visualisation. On the other hand, the node visitor provides the information in how to configure it and in how it should be rendered for visualisation. In this case, File-A-Nyzer provides the application visualisation context.

Currently there are a small number of different node types that can be found in the "pool" subdirectory of each application.

The following table shows the currently available nodes under its type.

Literal

Description

Size in bytes

ByteNode

Signed 1 Byte Node

1

UbyteNode

Unsigned 1 Byte Node

1

IntegerNode

Signed Integer Node

System dependent

(norm. 4)

Integer2Node

Signed 2 Byte Integer Node

2

Integer4Node

Signed 4 Byte Integer Node

4

Integer8Node

Signed 8 Byte Integer Node

8

UintegerNode

Unsigned Integer Node

System dependent

(norm. 4)

UInteger2Node

Unsigned 2 Byte Integer Node

2

UInteger4Node

Unsigned 4 Byte Integer Node

4

UInteger8Node

Unsigned 8 Byte Integer Node

8

FloatNode

Single Precision Node

4

DoubleNode

Double Precision Node

8

StringNode

Character Array Node

User defined

     

Grouping

   

Class

Groups common elements.

0

     

Collection

   

Collection

Maintains a list of several elements of the same Node type.

0

     

Switching

   

Switch

Depending on a previously read Node value selects which node is to be used to continue reading the binary file.

0

     

 

Literal: The most basic type of node that normally does not depend from any other and his fully autonomous on its own.

Grouping: Classifies the nodes under a common context in the same way that a C "struct" classifies a group of int, char arrays or float types under a common name.

Collection: Maintains a collection or list of elements of the same node type.

Switching: Selects one of the child nodes depending on the value of a dependent node.

 

The need for speed

Another important thing was to implement a reading scheme that would not need to read the all binary file contents while trying to keep it fast to access for file inspection. So, the only solution I could come up with was to develop a scheme that would keep track of the file offsets at points that could interfere with the file reading. After analysing the basic nodes, one is able to understand that the main points of interests to keep a file offset are either in the ClassNode, SwitchNode or mainly at the CollectionNode. In the majority of the times, this is a quite good solution, although some specific configurations maintaining the offset or the literal value itself would cost the same.

 

Moving around the application GUI

Ho no! More Screen Dumps! :-)

 

The Main Screen

The application GUI is divided in two main areas. The Left one, shown on white, and the right one with two different tabs.

The left panel is where the information read from the DNF file is shown. This information is the DataNode format and it is displayed in a tree. The Root DataNode element is shown at the root of the tree and the related nodes in the subsequent level of the tree. This tree only shows the DataNode name.

The right panel has two standard tabs that can’t be removed. The "Visualizer "pane shows to the user the data stored in each literal node field and allows the user to browse through the binary file. The "Node Info" pane is where information related to a node is displayed. Currently, the only other pane that can be added and have multiple instances is the "2D Plot". We’ll see how pretty soon.

 

Inspecting a simple binary file

Visualisation and analysis of the desired binary file compose the inspection process.

Design a BBF and export its respective DNF file

The following image shows the example BBF diagram to be used in this example.

Therefore, the binary file is composed by:

- A ClassNode named Series that contain four literal nodes comprising a total of 34 bytes.

SERIES Type Size in bytes
X Double Precision

8

TEST_1 Character Array

10

SIN Double Precision

8

COS Double Precision

8

Total:

34

- A CollectionNode names SERIES_LIST that comprises 100 SERIES ClassNodes.

SERIES_LIST Type Size in bytes
SERIES Class

34

Collection Size 100

0

Total:

100 * 34

3400

- And finally, the last group is set by a ClassNode named CLASS_TEST_DATA that contains the SERIES_LIST and one extra StringNode named TEXT.

CLASS_TEST_DATA Type Size in bytes
SERIES_LIST Collection

3400

TEXT Character Array

10

Total:

3410

If, you still don’t have the DNF file for this diagram, then now would be a great time to do so. ;-)

 

Opening a binary file

Left-Click on the "File->Open" and one window requesting for both the DataNode Format File and Binary File to inspect should pop-up in the middle of the screen. Browse for both files in your file system and, if your binary was generated in a PC (e.g. x86 Linux or Windows), then select Little-Endian., if it was, and for example, in a PowerPC based machine (e.g. AIX or MAC then select Big-Endian.

 

Visualising it

When ready left-click on "Load Format" button and the following screen should come up.

Try to browse and expand in the Tree panel that appears on the left. If you left-click twice in a tree item that is not a literal then the visualizer is set to start from that point onwards.

Also, if you right-lick on any of the tree nodes a menu will pop-up. If you select "Show Node Info" then all data related to that node will be serialised into the "Node Info" panel on the right side of the GUI.

 

Analysing it

Analysis can be made either by simply visualising it and checking out if the field values are the expected ones. Sometimes though, only this is not enough. One might also have the need to verify if the behaviour of some field value is the expected one and, it might be hard to just simply visualise its value. That’s when plotting becomes a great tool.

So, left-click on "Plot->New 2D Plot" menu item and a new plot window should come up on the right of the "Node Info" pane. Right-click on the "X " node in the tree and select "Set as X Series". Then right-click on the "SIN" node and select "Set as Y Series" and do the same for the "COS" node.

If, you now left-click on the "Plot" button, then a graph similar to the one bellow must has been draw.

Try to play around for a little bit in order to change the colour and style of graph lines. Remove a series by checking its line and left-clicking the "Clear" button, etc.

 

That’s all folks!

 

 
 

© Copyright 2004 File-Spector Team   
Distributed under the GNU General Public Licence