Synalysis Q&A - Recent questions and answers

How to do Bitwise AND Operation

Sat, 31 Aug 2024 14:07:49 +0000

7 (MSB)	6	5	4	3	2	1	0 (LSB)
langcode	copyrightb	origbs	dialnorm
1 or 0	1 or 0	1 or 0	0-31 (0 represents 31)

Sorry for the probably basic question. How would I extract the 4 fields values above using the mask feature? I'm using a hex mask successfully in another part of the file, but that is a simple mask on the whole byte value not at the bit level. From what I understand, if I took e.g. 'origbs' as an example, it will have a true/false value of 1/0. The byte has a value of 0x60 so...

origbs (Bit 5):

Mask: 0x20 (which is 00100000 in binary)

Extraction: (0x60 & 0x20) >> 5

Result: (0x60 & 0x20) >> 5 = (01100000 & 00100000) >> 5 = 00100000 >> 5 = 0x1 (or 1 in decimal)

Is this possible please and if so how do I set it up? Thank you.

Answered: Add a new checksum?

Fri, 30 Aug 2024 19:58:24 +0000

Unfortunately not yet possible to add it in a config or script however I've implemented a minute ago for the next version.

Answered: How to process encoded offsets

Thu, 18 Jul 2024 21:01:25 +0000

Never mind, I figured it out myself. I ended up writing a custom data type script for the entire dictionary, which includes functions for decoding the offsets. I then mapped the structures using `currentMapper.mapStructureAtPosition`.

Answered: How can I re-analyze a file during script development?

Tue, 09 Jul 2024 10:57:12 +0000

To force re-analysis in Synalyze It! without closing and re-opening the file, you can try the following steps:

Use the "Reanalyze" option from the "Analyze" menu if available.
Reload the script or data type in the application's settings.
Consult the official documentation or support for any shortcuts or tools to streamline this process.

For professional help with technical projects and more, check out Syscorp, the Best Local SEO company in Chennai. Visit their website for top-notch services to boost your online presence.

Answered: how to find duplicates in html files?

Fri, 28 Jun 2024 10:06:00 +0000

To identify duplicate content in HTML files, especially for web development projects like those handled by SysCorp, a systematic approach is crucial. Duplicates can negatively impact search engine rankings and user experience, For best web design company in chennai.

Answered: How to create grammar file that highlight occurrences of specific bytes ?

Sun, 26 May 2024 01:14:42 +0000

Currently there's not such a (grammar) feature.

However, when you use the search all findings are highlighted.

Answered: Synalyze It! v1.32: I want to diff 2 binary files, but the option "New diff" is greyed out

Sun, 26 May 2024 01:12:51 +0000

The binary diff feature is only part of the Pro version.
There's a possibility to upgrade to Pro in the menu Synalyze It!/Upgrade to Pro...

Answered: Getting started with grammars--a file of simple variable-length records

Thu, 25 Apr 2024 20:37:27 +0000

This sounds very similar to PNG, have you had a look at this tutorial?

https://www.synalysis.net/tutorials/decode-png-file

Hexinator for Ubuntu system lacking Internet access

Thu, 25 Apr 2024 13:10:38 +0000

I'd like to make Hexinator available to install via apt for some Ubuntu systems that have no access to the Internet and so can't download the necessary material from https://hexinator.com/downloads/. If this can be done, please tell me what I need to do, including any prerequisites I might also need.

Trying to install on Ubuntu, but there is a dependency to python2.7

Fri, 06 Oct 2023 07:21:41 +0000

Python2 has been dead for a while, does this mean that hexinator also is dead?

how can i put the "remaining length"-element not at the end of a structure, but between fixed-length-elements?

Sat, 05 Aug 2023 12:48:55 +0000

i have a fixed-length-chunk at the end of every section of my file,
but i don't know the length of the variable-length-binary.
how can i put the variable size between fixed-length-elements?
it only works if the remaining length element is at the end.

the structure looks like this:
chunk_1 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary
chunk_2 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary
chunk_3 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary

How to display bytes (non-printing control codes) as Unicode control pictures?

Fri, 04 Aug 2023 12:42:35 +0000

I use Hexinator to select byte range freuently. with default font Courier New, non-printing control codes are displayed as dots, which is not so intuitive/distinguishable, thus affacts productivity.

So are there any monospace fonts which display non-printing control codes as Unicode control pictures? or as 2-digit hex glyphs?

If no such font found, how do I make a such font?

Answered: What does the "Consists of" box do exactly?

Thu, 25 May 2023 13:43:00 +0000

Sorry for the loss, is actually the whole XML file unusable?

The consists-of was initially used for the automatic selection of one of multiple structures. It's only used in the AFP grammar.

The generic way to select one of many structures is to reference them in a structure with order "variable" and min repeat count of 0.

Please send me an email to andreas@synalysis.com in case you need further assistance with your grammar.

Answered: how do i reject a zero length string - or alternatively how do i terminate parsing an element from a script?

Thu, 25 May 2023 13:37:14 +0000

This is probably best made with a scripting element - see some examples here: https://www.synalysis.net/scripting/

Let it read the byte at the current position with byteView.readByte(), then map the structure that selects one of the attributes.

If you need further assistance please send me an email to andreas@synalysis.com.

Answered: Is there a way to pass parameters to custom types?

Mon, 24 Apr 2023 19:55:26 +0000

So you want to provide for each usage in the Grammar a parameter to the script of the custom type?
And the parameter doesn't depend on any other element parsed previously?

Answered: Question about scripts and grammars

Wed, 08 Mar 2023 17:22:26 +0000

In general you can use the name of the element that holds the length in the Length field of the following structure.

Have you tried this?

Answered: Grammer Editor

Wed, 08 Mar 2023 05:08:55 +0000

I figured it out.

Answered: Automate file reading and parsing

Sat, 18 Feb 2023 08:41:57 +0000

So far that's not possible. However, you can run the whole script within Hexinator.

Answered: Decode small Nokia full dump of a mobile phone

Sat, 18 Feb 2023 08:22:10 +0000

First step is to check if the file format is documented somewhere. If not, it probably makes sense to check if you can spot patterns in the file. For example, every SMS message or contact very likely follows a similar pattern. Dates/time values for example are stored in many formats as 4-byte integers with seconds since 1970.

Answered: Value field of a structure

Sat, 18 Feb 2023 07:49:01 +0000

Here you probably have to use a script that collects the single strings.

Answered: Find regex/wildcard?

Sat, 18 Feb 2023 07:43:39 +0000

As regexes or wildcards are usually operated on text data it's not that common in hex editors.

However, it should be possible to use grep (with regexes) if your file consists mainly of text.

Answered: How can I change the calendar dates of my CPAP data?

Sat, 18 Feb 2023 07:40:06 +0000

The first step is to look closer about the data (file) format as the manufacturers of devices producing CPAP data use different formats.

Is your data readable with this software? https://www.sleepfiles.com/OSCAR/

Answered: Data panel & strings

Fri, 17 Feb 2023 17:22:48 +0000

You can use the codepage comparison panel for this. It lists the same bytes with all available codepages.

It doesn't update with the cursor but I guess usually you see in the text part of the hex editor what could be a text.

Does this help?

Answered: Add mask via bitshift?

Fri, 17 Feb 2023 17:19:59 +0000

I'd suggest to do it with division. In case your number element is named BigNumber, set the Value field to

BigNumber / 16

Answered: Length information comes after the usage of the actual length. Is it even possible to use it in Grammar?

Fri, 17 Feb 2023 17:02:02 +0000

Probably something like in the ZIP grammar could work: a simple script continues parsing at header, then another script let data0 be parsed.

Answered: Is there a way to get nibble arrays to obey endianness?

Fri, 17 Feb 2023 16:49:16 +0000

As this is currently not possible with the standard grammar means it could be done with a custom (scripted) data type. I you need support for such a script, please write a message to grammars@synalysis.com.

Answered: custom type for data panel

Fri, 17 Feb 2023 16:46:06 +0000

So far this is not implemented but it's a very good suggestion, thank you!

Answered: How to match 1 of several child structures

Fri, 17 Feb 2023 16:45:05 +0000

Could you please send the grammar with a sample file to grammars@synalysis.com? It's hard to solve such issues without having the actual grammar.

Answered: Variable document structure

Fri, 17 Feb 2023 15:56:53 +0000

This looks very similar to how the PNG grammar works.

You create a (separate) "parent" structure that contains only one field for ID with "must match" checked.

Then you create (separate) structures that inherit from the parent structure and contain the record specific fields. For the ID field you add one fixed value with the record specific ID.

In the main structure (named like the file) you create a structure with variable element order, then add references to all the record structures.

Answered: can I scan the entire hard drive (not just a file) for a name and change it with Synalyze It?

Fri, 17 Feb 2023 15:38:22 +0000

Honestly this is not within it's intended use. It could be achieved with a Python script running in Synalyze It! however you could run the same script separately.

I'd suggest a solution as described here: https://unix.stackexchange.com/questions/227662/how-to-rename-multiple-files-using-find

Answered: How to cast a data type?

Fri, 17 Feb 2023 15:34:40 +0000

This is actually a hidden feature: simply create a string element (name without spaces!) for the number, then use its name as Repeat/max count. The string is treated as a decimal number.

Answered: Import from Base64?

Fri, 17 Feb 2023 15:20:31 +0000

Thank you for the suggestion, this can be solved with a script. Simply but the code below in the script editor in a new script of type selection. This means that you first select the bytes that are part of the BASE64 string (in the hex editor), then run the script via the script menu.

~~~~~~~~~~~~~~~~~8<~~~~~~~~~~~~~~~~~
import base64

def processByteRange(byteView, byteArray, bytePos, byteLength):
# this method processes a sequence of bytes
"""parseByteRange method"""

data_string = byteView.readString(bytePos, byteLength, "ISO_8859-1")
data_bytes = data_string.encode('ascii')
decoded = base64.b64decode(data_bytes)

byteArray.deleteRange(bytePos, byteLength)

index = 0
for base64_char in decoded:
byteArray.insertByte(bytePos + index, base64_char)
index += 1

~~~~~~~~~~~~~~~~~8<~~~~~~~~~~~~~~~~~

Answered: How do I start using grammar?

Fri, 17 Feb 2023 09:27:15 +0000

The easiest workflow is that you open a file with a known file extension / grammar and the grammar suggests to download and apply that grammar. This is possible because the application loads the formats.xml when starting. When you open wav.grammar with Hexinator it should be opened in the grammar editor (not as XML in the hex editor).

Once the grammar is loaded in the grammar editor, opened data files (in the hex editor) should have the grammar available in the "Grammar" toolbar selection. After you selected there "Windows Wave" the file should be decoded and the results shown in the tree view right next to the hex editor.

Is this explanation sufficient?

Answered: Can the number of repetitions of a structure be set by a number from within another structure?

Fri, 17 Feb 2023 09:21:40 +0000

You can reference a number element parsed previously by name (if it doesn't have spaces in the name).

Simply put the name of that element in the "Repeat max" field.

The "Repeat" field only works for number elements being in the same structure. The advantage of the Repeat field is that it allows to reference a field that's not yet parsed.

Answered: Can a grammar reference another grammar?

Mon, 26 Sep 2022 11:03:16 +0000

Yes, this is possible. Use the "Grammar Reference" element in order to continue parsing with another grammar.

Simply right-click (or ctrl click) on the element after which you want to reference the grammar, then select Append/Grammar Reference.

Answered: Anyone using OSX Monterey v 12.3 with SynalyseIT?

Sun, 21 Aug 2022 19:55:38 +0000

Please have a look at this (beta) version:

https://www.synalyze-it.com/Downloads/SynalyzeItProTA_1.24.zip

Be aware that now Python 3.10 is included so some existing scripts may have to be adapted.

Especially make sure that function calls are written like this:

print(“abc”)

And that // must be used for integer division instead of /

Any feedback is appreciated!

P.S.: There will also be an App Store version, of course

Answered: SynalyzeIt for Monterey

Sun, 21 Aug 2022 19:37:59 +0000

Please have a look at this (beta) version:

https://www.synalyze-it.com/Downloads/SynalyzeItProTA_1.24.zip

Be aware that now Python 3.10 is included so some existing scripts may have to be adapted.

Especially make sure that function calls are written like this:

print(“abc”)

And that // must be used for integer division instead of /

Any feedback is appreciated!

P.S.: There will also be an App Store version, of course

Answered: Looks amazing, is it still maintained?

Fri, 18 Feb 2022 13:19:54 +0000

MacOS 12.2.1 with SynalizeitPro 1.23.4 and still getting the warning. Hoping to get confirmation that this will be upgraded. This is my go-to hex-editor.

Has someone generated a grammar for m-bus (meter bus) yet?

Thu, 02 Dec 2021 16:31:43 +0000

I'd like to parse a hex file with a dump of a m-bus protocol. Has someone prepared the grammar for analyzing m-bus protocols? That would be very nice.

Thank's a lot.

Powerman

Answered: How do I tell if I have the pro upgrade on the original Synalyze It from the App Store?

Wed, 28 Jul 2021 07:27:29 +0000

The standard way to restore the upgrade is via the menu "Synalyze It!"/"Upgrade to Pro...", then click "Restore Purchases".

Please make sure that you are logged in iCloud with the same account you used for doing the purchase. The most common problem to restore purchases is using another Apple ID.

Answered: Conditional grammar structures

Wed, 09 Sep 2020 12:36:16 +0000

Hi,

I've just purchased the software and had a similar problem. I've tried to put it together for you quickly.

The method I used:

- create new grammar

- add structure

  name it MPLS file: this is going to be your root element which will contain all the others

- add structure:

  name it type or StreamType: this is going to contain the numeric value which you will use for your condition.

  Right-click on it and append it with a number, call it type and make sure its length is 1 byte.

- add structures: A, B, C. I don't know the actual content of these but you will use them in your particular structures.

- add structure:

  name it StreamType 1: on the right in Properties: Set Extends entry to StreamType (or type depending how you called your type structure)

click on StreamType 1/type element and in Fixed values: press '+' icon to add a value, give it a name and set its value to 1. I think this will make sure that this structure will be used when type = 1. Right-click on StreamType 1 element and append a structure reference to 'A'.

- Go back to MPLS file element and right-click and append a structure reference to StreamType 1.

  I'm guessing your MPLS file can contain any number of structures in any order so set MPLS file Properties on the right to have Element order: Variable and Repeat: min: 0 and max: Unlimited.

Click on Stream Type 1 within MPLS file and in Properties set Repeat: min: 0 and max:1. I guess this sets it to be optional.

Repeat everything you've done for StreamType 1 for your StreamType 2 and StreamType 3.

I'm hoping it is going to be easy once you tried it on the interface.

Best regards,

Janos

Here is the result I've got:

<?xml version="1.0" encoding="UTF-8"?>
<ufwb version="1.17">
    <grammar name="New grammar" start="id:36" author="JanosVaczi">
        <structure name="MPLS file" id="36" repeatmin="0" repeatmax="-1" encoding="ISO_8859-1:1987" endian="big" signed="no" order="variable">
            <structref name="<Stream Type 1>" id="50" repeatmin="0" structure="id:47"/>
            <structref name="<Stream Type 2>" id="68" repeatmin="0" structure="id:58"/>
            <structref name="<Stream Type 3>" id="69" repeatmin="0" structure="id:63"/>
        </structure>
        <structure name="StreamType" id="44" encoding="ISO_8859-1:1987" endian="big" signed="no">
            <number name="type" id="46" type="integer" length="1"/>
        </structure>
        <structure name="Stream Type 1" id="47" extends="id:44">
            <number name="type" mustmatch="yes" id="49" type="integer">
                <fixedvalues>
                    <fixedvalue name="One" value="1"/>
                </fixedvalues>
            </number>
            <structref name="<A>" id="57" structure="id:51"/>
        </structure>
        <structure name="Stream Type 2" id="58" extends="id:44">
            <number name="type" mustmatch="yes" id="60" type="integer">
                <fixedvalues>
                    <fixedvalue name="Two" value="2"/>
                </fixedvalues>
            </number>
            <structref name="<B>" id="61" structure="id:53"/>
            <structref name="<C>" id="62" structure="id:55"/>
        </structure>
        <structure name="Stream Type 3" id="63" extends="id:44">
            <number name="type" mustmatch="yes" id="65" type="integer">
                <fixedvalues>
                    <fixedvalue name="Three" value="3"/>
                </fixedvalues>
            </number>
            <structref name="<B>" id="66" structure="id:53"/>
            <structref name="<A>" id="67" structure="id:51"/>
        </structure>
        <structure name="A" id="51" encoding="ISO_8859-1:1987" endian="big" signed="no"/>
        <structure name="B" id="53" encoding="ISO_8859-1:1987" endian="big" signed="no"/>
        <structure name="C" id="55" encoding="ISO_8859-1:1987" endian="big" signed="no"/>
    </grammar>
</ufwb>

Answered: How to export parsed results to a file

Sun, 01 Mar 2020 22:42:29 +0000

Hello,

I'm not sure if I understand, but maybe you want the same as me.

I would like to be able save selected part of (parsed) file as new file.

For example:

Yamaha keyboard style file consists of 2 parts: MIDI + CASM data

I want to save the first (MIDI) part as a new MIDI file.

Answered: I have no clue where to start. Help??

Fri, 28 Feb 2020 05:29:40 +0000

First, just look at each WAV file, just in the hex editor. If everything shows up as 00s, your data really is lost. Assuming these aren't some special structure, the first 44 bytes describe the file. Everything after that is sound samples that are literally amplitude (loudness) values. A file that is 44.1 khz, 16 bit, stereo, each second of audio will be 176,400 bytes. A full minute would add up to 10 MB.

There's an existing grammar but, before you look at that, I'd recommend reading up a little on how a WAV file is structured:

http://soundfile.sapp.org/doc/WaveFormat/

The grammar for Hexinator / Synalize It! is called "Windows Wave" because the format was introduced by Microsoft. It's a slightly complex grammar but you could try using that and see if it can tell you anything useful. Of course, if you're bored or drunk and want to see something really complex. take a look at the MP3 grammar. You'll start to wonder how humanity has made it this far.

Answered: Synalize It only recognizes first instance of element in custom grammar?

Fri, 28 Feb 2020 05:07:44 +0000

I know you're probably well-past the due date for your project, but I gave an answer in case somebody else had a similar question.

A couple of things:

The grammar tag shows start="id:197", which is the ID of the Bin structure. You want this to point at the BinContainer. Replace the preceding with start="id:213".

Your Padding piece has repeatmax="-1". I believe only structures support unlimited repeating. There are several things you could do here. Each of these has its own pros and cons:

Change repeatmax. Either match the Bin structure (set max to 64) or set it at a very large value (e.g. 65535, the decimal version of 0xFFFF).
Change length. Set repeatmax="1", length="remaining", and uncheck Must match (or remove the fixed value). This will repeat to the end of the size of Bin (64).
Embed the binary value inside a structure and set repeatmax="64". If you choose this method, you can leave your Must match with the 77 value.
Remove Padding. The parser will automatically skip to the end of the 64 bytes used by Bin.

Answered: Does there exist a simple grammar for CSV files?

Wed, 13 Nov 2019 10:54:41 +0000

I believe this will help you:

https://github.com/synalysis/Grammars/blob/master/csv.grammar

Read structure another value within script

Wed, 13 Nov 2019 10:49:56 +0000

Hi,

I have a structure with name "TLLV", that splits on 2 substructures: "Header" and "Payload".

Payload has "Value" and "padding", that is very depends on the length of the "Value", specified in Header. And I want to calculate "padding" length in the custom datatype with writing the script:

   currentGrammar = currentMapper.getCurrentGrammar()
   headerStruct = currentGrammar.getStructureByName("TLLV_Header")
   offset = currentMapper.getCurrentOffset()
   bytesProcessed = currentMapper.mapStructureAtPosition(headerStruct, offset, 16)
   length = headerStruct.getElementByName("valueLength")

So, currently, I am able to reach out length, as an element.

But how to convert element to a "Number" type to be able to use it?

Is it possible to write an advanced script, like decrypting?

Tue, 12 Nov 2019 14:13:23 +0000

Hello,

I am wondering, before I will start, is it possible to adopt python decrypting code to the Synalysis?

I want to try to write AES-128-CBC decryptor, to be able to read the data directly in Synalysis instead of jumping with exporting/importing + bash scripts.

Which limitations should I consider? Have I access to the files on the disk to read the key? Can I directly invoke openssl or import some of useful python libraries?

Sincerely,

Vladimir.

Answered: How to find differences between two Binary files?

Fri, 11 Oct 2019 01:03:22 +0000

Well, should have looked a bit longer I guess...

There it was, under the Files drop-down menu - you call it "New Diff", and yes, you load two files in and the differences show up as another colour.

May I suggest that you have this info in the Help file?

'New Diff' works exactly as I wanted, just a bit more buried than I could casually find 'casue I was looking for "Compare'!.

Great program!

Answered: Grammers for Unreal files?

Thu, 10 Oct 2019 15:06:59 +0000

Since you probably don't want to reverse engineer the file formats the first step is to obtain a description of the file format.

Do you have the binary template for 010 Editor?

Answered: Will dark mode support be added to Synalyze It! on macOS?

Thu, 10 Oct 2019 14:59:08 +0000

Dark mode is supported now with the latest version (1.23).