Synalysis Q&A - Recent questions

How to do Bitwise AND Operation

Sat, 31 Aug 2024 14:07:49 +0000

7 (MSB)	6	5	4	3	2	1	0 (LSB)
langcode	copyrightb	origbs	dialnorm
1 or 0	1 or 0	1 or 0	0-31 (0 represents 31)

Sorry for the probably basic question. How would I extract the 4 fields values above using the mask feature? I'm using a hex mask successfully in another part of the file, but that is a simple mask on the whole byte value not at the bit level. From what I understand, if I took e.g. 'origbs' as an example, it will have a true/false value of 1/0. The byte has a value of 0x60 so...

origbs (Bit 5):

Mask: 0x20 (which is 00100000 in binary)

Extraction: (0x60 & 0x20) >> 5

Result: (0x60 & 0x20) >> 5 = (01100000 & 00100000) >> 5 = 00100000 >> 5 = 0x1 (or 1 in decimal)

Is this possible please and if so how do I set it up? Thank you.

Add a new checksum?

Wed, 28 Aug 2024 23:52:52 +0000

Hi there, exploring the software but I'm missing a basic CheckSum8 2s Complement. Is it possible to add one in a config/script somewhere?

Regards

How to process encoded offsets

Tue, 09 Jul 2024 14:14:13 +0000

I am currently greatly expanding the OpenType grammar. The CFF table uses a complex encoding scheme for number values in order to save space. Some of these encoded values represent offsets to other internal data structures. My questions: How can I either use regular offset elements and feed them decoded values, or how can I programmatically create and configure offset elements? They do not seem to be documented much at all. Thank you!

How can I re-analyze a file during script development?

Fri, 05 Jul 2024 19:35:02 +0000

I’m working on a custom data type in Synalyze It!. It seems that I have to close and re-open the file I want to analyze in order to apply the changes to the script. This makes development and debugging extremely slow. Is there a way to force re-analysis more easily?

Synalyze It! v1.32: I want to diff 2 binary files, but the option "New diff" is greyed out

Fri, 17 May 2024 17:55:39 +0000

Hi!

I purchased Synalyze It! from the Mac App Store, v1.32.

I want to diff 2 binary files, but the option "New diff" is greyed out. Is there something I'm missing?

Thanks!

Getting started with grammars--a file of simple variable-length records

Thu, 25 Apr 2024 20:15:24 +0000

I'd like to get started learning and using Synalyze It and Hexinator, but I could use a little more help than the docs offer to get me onto the learning curve.

So I'm hoping someone can provide an example grammar to get me started on a simplified version of a file format I'm interested in.

A file in this format consists of a sequence of records, where each record consists of:

An initial 8-bit type value type from a set of predefined values (with a symbolic name for each, but that detail can be left for later).
A 16-bit little endian byteCount of data bytes to follow
A series of byteCount dataBytes
An 8-bit checksum, the two's complement of the sum across type, byteCount, and dataBytes

The full details are much more complex, essentially what you'll see in Intel's OMF-51 object file format specification which you can find at https://www.keil.com/download/files/omf51.zip, but I'm happy to put off all of that until I know how to write a suitable grammar for the basic format.

A script to check a record's checksum would also be helpful but can be left for later.

Hexinator for Ubuntu system lacking Internet access

Thu, 25 Apr 2024 13:10:38 +0000

I'd like to make Hexinator available to install via apt for some Ubuntu systems that have no access to the Internet and so can't download the necessary material from https://hexinator.com/downloads/. If this can be done, please tell me what I need to do, including any prerequisites I might also need.

How to create grammar file that highlight occurrences of specific bytes ?

Fri, 22 Mar 2024 07:09:16 +0000

Hello,

I am using Hexinator and I have a binary file which I would like to highlight byte occurrences (eg: 0x11, 0x22). How can I do that ?

Trying to install on Ubuntu, but there is a dependency to python2.7

Fri, 06 Oct 2023 07:21:41 +0000

Python2 has been dead for a while, does this mean that hexinator also is dead?

how can i put the "remaining length"-element not at the end of a structure, but between fixed-length-elements?

Sat, 05 Aug 2023 12:48:55 +0000

i have a fixed-length-chunk at the end of every section of my file,
but i don't know the length of the variable-length-binary.
how can i put the variable size between fixed-length-elements?
it only works if the remaining length element is at the end.

the structure looks like this:
chunk_1 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary
chunk_2 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary
chunk_3 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary

How to display bytes (non-printing control codes) as Unicode control pictures?

Fri, 04 Aug 2023 12:42:35 +0000

I use Hexinator to select byte range freuently. with default font Courier New, non-printing control codes are displayed as dots, which is not so intuitive/distinguishable, thus affacts productivity.

So are there any monospace fonts which display non-printing control codes as Unicode control pictures? or as 2-digit hex glyphs?

If no such font found, how do I make a such font?

how do i reject a zero length string - or alternatively how do i terminate parsing an element from a script?

Wed, 24 May 2023 02:39:39 +0000

Hi,

I am trying to write a grammar for EXR files. These have a header with a list of attributes. each attribute consists of an attribute name (string), type (another string), size (int) and then some data (dependent on the size). There are various predefined attribute types that I can write grammars to parse, and can fall back to a base-case undefined attribute for any unknown attribute types. This seems to be mostly working.

The problem is that this list of attributes is null terminated. So I need to know when there is a zero at the start of the next structure, and then move on to parsing the next bit of the file. Since the grammar is trying to parse another attribute, this shows up as a zero length attribute name (attribute names are zero-terminated). As far as I can tell there is no way to reject a zero-length string. And no direct way to detect the null terminator. I have written a script that detects the zero-length string, but then I don't know how to control the parser to tell it to move on. Any ideas?

thanks

What does the "Consists of" box do exactly?

Thu, 27 Apr 2023 15:37:58 +0000

I've been trying to figure what this actually does. In experimenting with it, I irrecoverably lost a whole grammar I was working on, so I'll just ask you.

Is there a way to pass parameters to custom types?

Mon, 24 Apr 2023 12:45:29 +0000

I would like to make a custom type that represents a fixed-point number with a variable binary scaling. Ideally, I'd like to make a custom type that I can input a parameter in to for that scaling factor. Is such a thing possible?

Question about scripts and grammars

Wed, 08 Mar 2023 05:12:48 +0000

My file has value in one structure that is used to compute the length of the next structure.

The structure with that information is at a fixed location in the file.

So I need to take that value and use to set length of following structure.

Grammer Editor

Tue, 07 Mar 2023 06:30:08 +0000

I have a file the first block starts at 0 and is 512 bytes long

The 2nd block starts at 512 and is 512 bytes long.

I cannot figure out how to set the offset for the 2nd block

Volume

LBN 1

LBN 2

I not having a problem defining the structure for LBN2

How do I start using grammar?

Thu, 16 Feb 2023 06:48:56 +0000

I recently discovered Hexinator and I would like to try out the grammar feature, just to see how it works. I downloaded the WAV file grammar from the grammars page (https://www.synalysis.net/formats.xml) and now I have wav.grammar file with some XML code. I also opened a small wav file in Hexinator and I believe the program is supposed to show the different parts of the WAV header and the data sections in different colours. But I have no idea how to get started. Could someone please link me to a tutorial or a how to guide with screenshots? Or is this a paid only feature? I am using the free version in Windows 10.

Can the number of repetitions of a structure be set by a number from within another structure?

Wed, 23 Nov 2022 05:15:21 +0000

Specifically, I've got a structure that's a fixed size data block, that's meant to repeat exactly the number of times specified by a number from another structure earlier in the file. There's the repeat dropdown, that seems like it might be intended for this sort of purpose, but the only option in it is "<none>", and the min and max values don't seem to have any way to fill in a variable either.

SynalyzeIt for Monterey

Thu, 12 May 2022 17:38:34 +0000

I only dropped in to ask, if there exists a vague prediction, when SynalyzeIt for Monterey will be released?

Kind regards, Kuulest

Anyone using OSX Monterey v 12.3 with SynalyseIT?

Tue, 15 Mar 2022 21:14:49 +0000

Heads up:

Just Installed Monterey v 12.3. Instant crash with SynalyseIT v 1.23.4

Have raised a support Ticket.

Cheers

David

(wyattd)

custom type for data panel

Thu, 24 Feb 2022 20:24:54 +0000

The data panel shows the selection interpreted by different types (as 8 bit unsigned integer, 8 bit signed integer, ...). Is there a way to add a custom type (by using a script)

e.g. I want to see 4 selected byte interpreted as "signed int(selection) / 2^32 * 360)

Anyway to do that?

How to cast a data type?

Wed, 09 Feb 2022 17:04:51 +0000

The file format I'm working with (NITF) stores the record count as ASCII to represent a 3-digit number between 000-999. Is there a way to transform that value to the corresponding integer so I can use it to repeat the record structure?

Import from Base64?

Tue, 21 Dec 2021 04:31:41 +0000

Hi!

Is it possible to import Base64 encoded binary directly into the editor? If not, that would be an awesome feature!

Has someone generated a grammar for m-bus (meter bus) yet?

Thu, 02 Dec 2021 16:31:43 +0000

I'd like to parse a hex file with a dump of a m-bus protocol. Has someone prepared the grammar for analyzing m-bus protocols? That would be very nice.

Thank's a lot.

Powerman

can I scan the entire hard drive (not just a file) for a name and change it with Synalyze It?

Fri, 06 Aug 2021 19:39:37 +0000

Is there a way to get nibble arrays to obey endianness?

Wed, 04 Aug 2021 14:00:53 +0000

I'm working on a grammar where there is an array of 4-bit bitfields. There are 1000 entries, where each entry has 4 single-bit flags. They are stored in a little-endian fashion: each byte stores a pair of entries, where the four least significant bits are the first entry and the most significant bits are the second.

Since it is an array, there are two structs involved: an inner struct representing a single 4-bit entry, and an outer struct containing the 1000 repetitions of the inner struct.

The problem is, even if I set both of these structs to little endian, each pair of nibbles is parsing out of order. That is, entries 0 and 1 are swapped, 2 and 3 are swapped, 4 and 5 are swapped, etc.

Is there a way to make Hexinator handle this properly?

Looks amazing, is it still maintained?

Thu, 29 Jul 2021 16:13:57 +0000

I just happened across this app and it looks amazing. Would really help with some work I'm doing, but before I buy, I just wanted to check to make sure it's still maintained. I'm running macOS 15 beta and got an alert that the app needs to be updated and won't work on a future version of macOS. I believe this has to do with the python2 to python3 transition. Anyway... Is this still maintained? I really hope so because this looks very useful.

How do I tell if I have the pro upgrade on the original Synalyze It from the App Store?

Fri, 23 Jul 2021 05:45:00 +0000

I purchased the Pro upgrade from the menu using the original Synalyze It! from the App Store, how do I use it after a reinstall? How to I check if it's already used?

Variable document structure

Sun, 14 Feb 2021 22:07:00 +0000

Hello,

I have a file encoded for AS400(IBM870). File contains x structures, structures can be in file more than one (n), but the order and count is not known. The file always contain at least one structure defined in grammar.

File content sample Axxxxxxxxxx..........Czzzzz...............Bxxxxxaa.............Aznmopaaas...........Cxxddd...............

File structure example

Grammar

--bof--
Record A
   ID = A
   Value 1 = xxxxx
   Value 2 = xxxxx
   Filler 10
Record C
   ID = C
   Value 1 = zzzzz
   Filler 15
Record B
   ID = B
   Value 1 = xxxxx
   Value 2 = aa
   Filler 13
Record A
   ID = A
   Value 1 = znmop
   Value 2 = aaas
   Filler 11
Record C
   ID = C
   Value 1 = xxddd
   Filler 15
--eof--

Records have a fixed length 21
ID is always present
Values are different
Record order is unknown
Record repeat is unknown
Grammar contains definition for
record ID (A,B,C,D,E ,F ...)
The the file may not contain
all the records

How to automatically parse a file based on existing grammar definition ?

Can a grammar reference another grammar?

Thu, 03 Sep 2020 00:12:27 +0000

For instance I would like to create a grammar for ID3 tags which could be used in both flac and mp3 grammars

How can I change the calendar dates of my CPAP data?

Sun, 23 Aug 2020 14:01:34 +0000

I have a few years of CPAP data, from 2016 - 2019. I want to change the 2016 data dates to 2020. I have no idea how to do this.

Length information comes after the usage of the actual length. Is it even possible to use it in Grammar?

Fri, 14 Aug 2020 09:50:39 +0000

The image format is the following:
data0 | fillerbytes | header | data1 | fillerbytes

The data is of variable length and the information how long it is can be found in the header. The header is at a fixed position so it can be read. I can use the extracted length for data1 but it does not seem to work for data0. Any ideas?

Don't ask why it is like that. I guess the engineers in TW had a good reason for that.

How to match 1 of several child structures

Thu, 13 Aug 2020 21:12:29 +0000

I have a file format that is divided into sections identified by guids. Each section has a header and then some data. The data can be one of several formats. If a 16 byte guid matches one of a few structures, then I want to present the data as that structure. If it matches none of them, I want to represent it as just bytes.

i got it partially work. For the data element, I added a structure with a size and then used structure references under that structure to define the possible matches. I set the top level structure to have a variable data element order, then added 2 references under it that were set from 0 to unlimited in counts. Those structures that are referenced each have 1 field at at the start that is a guid that has a must match attribute set.

I expected that the data element would match the appropriate structure, but it only matches if it matches the first child structure. It doesn't appear to be matching the second despite the binary data showing that it matches the second.

What am I missing?

Data panel & strings

Mon, 10 Aug 2020 01:42:47 +0000

Currently the data panel shows a list of possible interpretation values starting with the selected byte.

Is there a way to also do the same and try to interpret the byte as the start of a string, ASCII, UTF-8, UTF-16..... ??

Conditional grammar structures

Mon, 13 Jul 2020 23:09:41 +0000

I'm writing a grammar for MPLS files.

One of the elements is StreamType (1 byte numeric), and if StreamType is 1 it is followed by by the A structure only. If StreamType is 2 it is followed by the B, C, and A structures in that order, and if StreamType is 3 it is followed by the B and A structures in that order.

How do I accomplish this?

I don't have the pro-version, so no scripting as I understand it unfortunately.

Add mask via bitshift?

Sun, 31 May 2020 19:06:46 +0000

I'd like to use the Number type and something like in the Value field: "this.value >> 4"

I don't see an option for bit shifting in masks either.

Find regex/wildcard?

Mon, 18 May 2020 17:31:26 +0000

Am I being stupid here? I can't seem to find how to use regexes or even basic wildcards in the Find function in Synalze It! Pro. It seems like such a basic feature I must have overlooked something but I can't see it anywhere. Closest I got was masks, but then blocks of FF FF FF FF in a file make that almost entirely useless.

Value field of a structure

Fri, 28 Feb 2020 05:56:58 +0000

Short version:

Can "Value," on a structure, only be the name of a field inside?

Long version:

I've got some bytes that are essentially a keypath. As an example:

81 A4 74 68 69 73 A2 69 73 A2 6D 79 A7 6B 65 79 70 61 74 68 | ..this.is.my.keypath

Byte 0 is just a type specifier, indicating what kind of binary value would be found after this keypath. Bytes 1, 6, 9, and 12 are length indicators of the form A<length>. Byte 1 is A4, so the first word (this) is 4 bytes long. My grammar is (simplified):

<structure name="keypath" valueexpression="key">
    <structure name="key" valueexpression="value">
        <binary name="magic" length="4" lengthunit="bit"/>
        <binary name="length" length="4" lengthunit="bit"/>
        <string name="value" type="fixed-length" length="length"/>
    </structure>
</structure>

The value of keypath shows as the first instance of value, or this. I want the value of keypath to show something like this|is|my|keypath but all I get is this. Is there something I can set the value expression to that will do this for me, or am I stuck writing a script?

Decode small Nokia full dump of a mobile phone

Fri, 24 Jan 2020 19:36:25 +0000

Hello,

Would like to extract the contact and messages off a full dump that was extracted directly via chip off. Can see the SMS messages and contacts together with numbers but there is no order. Would like to view the receiver of the messages and the dates these were sent for instance. The whole bin file is 8mb.

Thanks for any help or advice

Synalize It only recognizes first instance of element in custom grammar?

Tue, 26 Nov 2019 05:47:14 +0000

Hi, I'm trying to use Synalize It to help me design a file format for a college project, but have the issue that it only recognizes the first instance of the data, and concludes the rest of the file is just padding. I have repeat settings set correctly (I think), but can't figure out the cause of the problem! Any help or suggestions are appreciated, Thanks!

Here's the contents of the grammar file:
"<?xml version="1.0" encoding="UTF-8"?>
<ufwb version="1.17">
   <grammar name="SmartShelf Metadata" start="id:197" author="Patrick L">
       <description>Grammar for the Mech 90 SmartShelf Metadata</description>
       <structure name="BinContainer" id="213" encoding="ISO_8859-1:1987" endian="big" signed="no" order="variable">
           <structure name="Bin" id="197" length="64" alignment="1" repeatmax="-1" encoding="ISO_8859-1:1987" endian="big" signed="no">
               <binary name="Magic_Number" mustmatch="yes" id="198" strokecolor="FF0000" length="1">
                   <fixedvalues>
                       <fixedvalue name="Magic Number" value="B1"/>
                   </fixedvalues>
               </binary>
               <number name="Bin_ID" id="199" fillcolor="0000FF" type="integer" length="1"/>
               <number name="Offset_Steps" id="200" strokecolor="0000FF" type="integer" length="1"/>
               <number name="Steps_From_Home" id="201" strokecolor="00F1FF" type="integer" length="2"/>
               <number name="Protocol_Version" id="202" type="integer" length="1">
                   <fixedvalues>
                       <fixedvalue name="V1" value="1"/>
                   </fixedvalues>
               </number>
               <number name="<reserved>" id="203" strokecolor="999999" repeatmin="4" repeatmax="4" type="integer" length="1"/>
               <string name="Bin_Name" id="204" fillcolor="21D2C4" type="fixed-length" length="20"/>
               <string name="Bin_Description" id="205" fillcolor="A2FFFF" type="fixed-length" length="30"/>
               <binary name="Padding" mustmatch="yes" id="206" repeatmin="0" repeatmax="-1" length="1">
                   <fixedvalues>
                       <fixedvalue name="Padding" value="77"/>
                   </fixedvalues>
               </binary>
           </structure>
           <structure name="ExtendedBinData" id="208" length="64" disabled="yes" alignment="0" repeatmax="-1" encoding="ISO_8859-1:1987" endian="big" signed="no">
               <binary name="Magic_Number" id="209" length="remaining">
                   <fixedvalues>
                       <fixedvalue name="Magic_Number" value="B3"/>
                   </fixedvalues>
               </binary>
               <number name="Bin_ID" id="210" type="integer" length="1"/>
               <number name="<reserved>" id="211" repeatmax="-1" type="integer" length="1"/>
           </structure>
       </structure>
   </grammar>
</ufwb>
",
and here's enough my test file, consisting of two identical "Bin" Elements, and padded with 0xFFs:
"B1012000200100000000534D4420636F6D706F6E656E74732E000000000053757266616365204D6F756E74205265736973746F72732C20657463000077777777B1012000200100000000534D4420636F6D706F6E656E74732E000000000053757266616365204D6F756E74205265736973746F72732C20657463000077777777FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"

How to export parsed results to a file

Sat, 16 Nov 2019 16:06:07 +0000

I'd like a way to export the parsed results to an external file to verify the parsing is correct using a separate data analysis tool . It seems the python script is executed in a restricted mode, which is good when running third party scripts that may be a security threat, but stops my script doing IO.

I notice a method on the Results class called exportToFile but I can't find any documentation on what it does or an example of using it. I'd be interested in what it does.

Is there a way to either run my own script without the restricted mode, allowing me to do any IO I need. Otherwise is there a method available from within the scripting that allows me to save the parsed values to file.

I can always write python separately but it would seem like a pity if the parsed values couldn't easily be exported from a Hexinator script.

Thanks, +Paul

Read structure another value within script

Wed, 13 Nov 2019 10:49:56 +0000

Hi,

I have a structure with name "TLLV", that splits on 2 substructures: "Header" and "Payload".

Payload has "Value" and "padding", that is very depends on the length of the "Value", specified in Header. And I want to calculate "padding" length in the custom datatype with writing the script:

   currentGrammar = currentMapper.getCurrentGrammar()
   headerStruct = currentGrammar.getStructureByName("TLLV_Header")
   offset = currentMapper.getCurrentOffset()
   bytesProcessed = currentMapper.mapStructureAtPosition(headerStruct, offset, 16)
   length = headerStruct.getElementByName("valueLength")

So, currently, I am able to reach out length, as an element.

But how to convert element to a "Number" type to be able to use it?

Is it possible to write an advanced script, like decrypting?

Tue, 12 Nov 2019 14:13:23 +0000

Hello,

I am wondering, before I will start, is it possible to adopt python decrypting code to the Synalysis?

I want to try to write AES-128-CBC decryptor, to be able to read the data directly in Synalysis instead of jumping with exporting/importing + bash scripts.

Which limitations should I consider? Have I access to the files on the disk to read the key? Can I directly invoke openssl or import some of useful python libraries?

Sincerely,

Vladimir.

I have no clue where to start. Help??

Sat, 19 Oct 2019 22:59:24 +0000

To start from the beginning, my Solid State External Hard drive somehow went up on me and quite a few of my wav files got corrupted in the "Recover" process. The weird thing is, even tho the durations of the files are saying zero, they are still the same sizes they were before the drive went up, which gives me hope that the actual audio is still in the file and salvageable but I just can't get to em because I think the headers are jacked up. I've downloaded the app but have NO CLUE where to start to try to repair the headers of the files. Help!!!

How to find differences between two Binary files?

Fri, 11 Oct 2019 00:36:02 +0000

Looking for a way to Compare 2 similar binary files (only a few bytes different) - so the differences either show up in different colours, or the program generates a list of differences with their location. I seem to recall having a procedure to do this, but have forgotten how...

Thanks!

Little Endian BIT Ordering

Thu, 10 Oct 2019 14:31:23 +0000

Hey there,

I have a one byte long field that is in little endian bit ordering. Unfortunately, no matter what endianness I select, it is still treated as big endian bit ordering. Is there any way to fix this? Thanks.

Grammers for Unreal files?

Thu, 10 Oct 2019 03:52:52 +0000

Hi all, I'm trying to figure out where to obtain and or make a grammar script for unreal asset files.
I know someone else who build a grammar script for the 010 editor, however they can no longer be contacted.
Does anyone have any insights into this?
Cheers!

Display Floating point value

Fri, 04 Oct 2019 12:02:49 +0000

I am wondering if the Pro or lite version is able to display a floating point value from a calculation, when the original value is an integer value?

Many serial streams in the embedded world have a more precise fixed point number, but you want the displayed value to be more human readable.

e.g.

0x14: 0x000B90: Total grid power output * 100 = 29.60 kWh

So I want to convert the integer to float, divide by 100 and display the result as 29.60, instead of 29

I now have the Value "TotalPower / 100", which discards the number behind the decimal point.

Is this possible in Synalyse It! or do I have to start writing a python script?

audio file shows 32:36 but only play 7:46 help!

Wed, 31 Jul 2019 23:28:31 +0000

I have a wav file that was recorded on an H4N but only plays a part of the file. The file is 135mb and in iTunes, I can see the 32:36 time, but when it plays in iTunes, Audition, VLC it only plays 7:46 seconds. Can your tool fix the file issue? I opened it, but honestly, have no idea what I'm looking at.

Thanks for any pointers.

Automate file reading and parsing

Thu, 18 Jul 2019 07:02:52 +0000

I need to write a test script in Python that checks for specific values in a binary file. Can I run Hexinator from my script, and have it return a specific field back to my script?