Synalysis Q&A - Recent questions without answers

Can I create a grammar for a compressed file type?

Sun, 31 May 2026 01:05:02 +0000

Is there a way to analyze a compressed file type? For example, I've encountered a file type that has a custom header then an embedded zlib-compressed file. That file decompresses into another format that I can make a grammar for easily But I have to split the file into two parts outside of Synalyze It! and decompress the second part before loading.

Scripting is pretty powerful and I can slice and decompress the data just fine in the program's python host, but once it's there, I can't use grammar features on the result. I guess I'm asking if there is a way to re-insert or alter data from scripting that is then can then be matched with a grammar? I maybe

How to do Bitwise AND Operation

Sat, 31 Aug 2024 14:07:49 +0000

7 (MSB)	6	5	4	3	2	1	0 (LSB)
langcode	copyrightb	origbs	dialnorm
1 or 0	1 or 0	1 or 0	0-31 (0 represents 31)

Sorry for the probably basic question. How would I extract the 4 fields values above using the mask feature? I'm using a hex mask successfully in another part of the file, but that is a simple mask on the whole byte value not at the bit level. From what I understand, if I took e.g. 'origbs' as an example, it will have a true/false value of 1/0. The byte has a value of 0x60 so...

origbs (Bit 5):

Mask: 0x20 (which is 00100000 in binary)

Extraction: (0x60 & 0x20) >> 5

Result: (0x60 & 0x20) >> 5 = (01100000 & 00100000) >> 5 = 00100000 >> 5 = 0x1 (or 1 in decimal)

Is this possible please and if so how do I set it up? Thank you.

Hexinator for Ubuntu system lacking Internet access

Thu, 25 Apr 2024 13:10:38 +0000

I'd like to make Hexinator available to install via apt for some Ubuntu systems that have no access to the Internet and so can't download the necessary material from https://hexinator.com/downloads/. If this can be done, please tell me what I need to do, including any prerequisites I might also need.

Trying to install on Ubuntu, but there is a dependency to python2.7

Fri, 06 Oct 2023 07:21:41 +0000

Python2 has been dead for a while, does this mean that hexinator also is dead?

how can i put the "remaining length"-element not at the end of a structure, but between fixed-length-elements?

Sat, 05 Aug 2023 12:48:55 +0000

i have a fixed-length-chunk at the end of every section of my file,
but i don't know the length of the variable-length-binary.
how can i put the variable size between fixed-length-elements?
it only works if the remaining length element is at the end.

the structure looks like this:
chunk_1 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary
chunk_2 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary
chunk_3 (fixed length)
fixed length binary
variable length binary (remaining)
fixed length binary

How to display bytes (non-printing control codes) as Unicode control pictures?

Fri, 04 Aug 2023 12:42:35 +0000

I use Hexinator to select byte range freuently. with default font Courier New, non-printing control codes are displayed as dots, which is not so intuitive/distinguishable, thus affacts productivity.

So are there any monospace fonts which display non-printing control codes as Unicode control pictures? or as 2-digit hex glyphs?

If no such font found, how do I make a such font?

Has someone generated a grammar for m-bus (meter bus) yet?

Thu, 02 Dec 2021 16:31:43 +0000

I'd like to parse a hex file with a dump of a m-bus protocol. Has someone prepared the grammar for analyzing m-bus protocols? That would be very nice.

Thank's a lot.

Powerman

Read structure another value within script

Wed, 13 Nov 2019 10:49:56 +0000

Hi,

I have a structure with name "TLLV", that splits on 2 substructures: "Header" and "Payload".

Payload has "Value" and "padding", that is very depends on the length of the "Value", specified in Header. And I want to calculate "padding" length in the custom datatype with writing the script:

   currentGrammar = currentMapper.getCurrentGrammar()
   headerStruct = currentGrammar.getStructureByName("TLLV_Header")
   offset = currentMapper.getCurrentOffset()
   bytesProcessed = currentMapper.mapStructureAtPosition(headerStruct, offset, 16)
   length = headerStruct.getElementByName("valueLength")

So, currently, I am able to reach out length, as an element.

But how to convert element to a "Number" type to be able to use it?

Is it possible to write an advanced script, like decrypting?

Tue, 12 Nov 2019 14:13:23 +0000

Hello,

I am wondering, before I will start, is it possible to adopt python decrypting code to the Synalysis?

I want to try to write AES-128-CBC decryptor, to be able to read the data directly in Synalysis instead of jumping with exporting/importing + bash scripts.

Which limitations should I consider? Have I access to the files on the disk to read the key? Can I directly invoke openssl or import some of useful python libraries?

Sincerely,

Vladimir.

What is the best way to add a binary coded decimal (BCD) number to a grammar?

Tue, 27 Nov 2018 06:14:43 +0000

What would be the best way to add a binary coded decimal number to a grammar? The best way I can come up with is to create a 4-bit number that's limited to a max value of 9 and repeat it. Is there a better way? Would I have to resort to scripting if I want the multi-digit number to appear as one element?

How to use the ByteView.findByteSequence method? Not sure what to pass for the buffer parameter.

Thu, 11 Oct 2018 11:53:09 +0000

How do I use Find in Selection?

Thu, 04 Oct 2018 08:33:09 +0000

Where is find and replace .... find next etc. How do I use 'Find using Selection'. I get the popup window which shows the tabs .... 'text, numbers, mask and string..... and it is always on top of the editor which I find very disturbing. But what I don't understand is 'How or Where do I use this window to edit the file in the editor. I just don't see the connection.....especially with the Find Window always on top of the editor.

This is my First week using Synalysis Pro,

Thank you..

Dave