Setting file endianness based on magic number

0 votes
asked Sep 30, 2016 in Hexinator by twotriads (140 points)
retagged Sep 30, 2016 by twotriads
Hi,

The file format I'm analysing indicates the endianness of the system used to write the file using the magic number (byte order of magic number indicates the endianness of the rest of the file).

How do I ensure that all numerical values in the rest of the file are automatically decoded using the correct endianness? The format contains a lot of offsets and substructures, and I've only managed to get them working on big-endian format files so far - it would be great to be able to derive the values automatically for little endian files too.

I'm assuming I'd need to use the 'derive' functionality, however I'm new to Hexinator and not 100% certain how to go about this.

Any help would be greatly appreciated!

1 Answer

0 votes
answered Sep 30, 2016 by andreas (3,160 points)
You can do this like in the TIFF grammar available on https://www.synalysis.net/formats.xml

The script executed after the magic number is parsed sets the "dynamic endianness". All numbers depending on this should have set their endianness to "dynamic".
commented Sep 30, 2016 by twotriads (140 points)
That's fantastic - thanks Andreas. Are the scripts executed as soon as the file is parsed? I'll plug the script in after the magic number and play around with it. Thanks again!
...