Inspecting Binary Files

This guide takes you through a binary file you know little about: you identify its format from its first bytes, read values from its header, find the readable text and the compressed parts inside it, and check that the file is the one you expect.

Before you start: have a binary file to inspect. The steps use a PNG image, photo.png, 1920 × 1080 pixels, because its layout is simple and published: it starts with an 8-byte signature, followed by a header chunk named IHDR that holds the image size. The byte values below come from the PNG specification, so you can follow them with any PNG file. Only the size values differ.

Identify the file

1. Open the file

   Open photo.png. Because the file contains NUL bytes, Vaste opens it in Hex view, and the status bar shows the file type BIN. See Hex view.

2. Read the first row

   The first row, at offset 00000000, shows the signature and the start of the header:

   00000000  89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52  .PNG........IHDR

   The ASCII pane shows .PNG at the start: the byte 89 is not printable, and 50 4E 47 are the letters PNG. With Colour bytes by class on, 89 has the high-byte tint, and 0D 0A the whitespace tint.

3. Compare the signature

   Vaste does not name file formats from their content. Compare the first bytes with a list of file signatures, such as Wikipedia’s List of file signatures. 89 50 4E 47 0D 0A 1A 0A is the PNG signature.

To find a signature elsewhere in a file, for example an image embedded in a document, search for its bytes: press Ctrl + F, select 0x, and type 89 50 4E 47. See Search modes.

Read values from the header

In a PNG file, the image width and height are 4-byte numbers at offsets 0x10 and 0x14, stored with the most significant byte first: big endian.

1. Open the data inspector

   Press Alt + I, or select Inspector in the toolbar. The panel shows Click a byte to inspect it.

2. Read the width

   Click the first byte of the row at offset 00000010. With 16 bytes per row, that is offset 0x10. The row starts with 00 00 07 80. In the inspector, the Offset shows 0x10 · 16 · 0o20, and the uint32 row shows 1920 under Big endian and 2147942400 under Little endian. The PNG format is big endian, so the width is 1920.

3. Read the height

   Press Right four times to move the cursor to offset 0x14, where the bytes are 00 00 04 38. The uint32 row shows 1080 under Big endian: the height.

4. Mark the header

   Press m, then h, to set a bookmark named h on the byte. Later, press ', then h, to return to it from anywhere in the file. See Bookmarks.

The two columns differ because the same bytes give different numbers in each byte order. When a value looks wrong, read the other column: file formats document which byte order they use.

Find text and structure

1. List the readable text

   Press Alt + S to open the search panel in Str mode, and press Enter with the search box empty. The results list each run of at least 4 printable characters with its offset, such as IHDR at 0x0000000C. In a PNG file, the chunk names IDAT and IEND also appear, and so do text chunks such as tEXt with the name of the program that made the image. Select a result to place the byte cursor on it. See Find strings.

2. See where the data is compressed

   Press Alt + E to show the entropy strip beside the scrollbar. Most of a PNG file is compressed image data, which shows as long, high-entropy bars. The header and the text chunks near the start show as short bars. Click a part of the strip to jump there. See Entropy strip.

Verify the file

When a download page publishes a checksum, compare it with the file’s checksum to check that the file is complete and unchanged.

1. Compute the checksums

   Press Ctrl + Shift + K, keep Whole file selected, and select Compute.

2. Compare the value

   Find the algorithm the download page names, usually SHA-256, and compare the two values. Select Copy to copy a value and paste it next to the published one. Vaste shows the values in lowercase hexadecimal: if the published value is in uppercase, it is still the same value.

If you downloaded a compressed file, such as a .zip that contains the image, check the archive itself with your system’s tool, not in Vaste: Vaste computes checksums of the decompressed content. See Checksums.

Tips

• Copy bytes: to copy a range of bytes as hexadecimal, click the first byte, hold Shift and click the last, and press Ctrl + C. See Select and copy bytes.
• Count chunks: a hex byte search for a chunk name, such as 49 44 41 54 for IDAT, lists every occurrence, and the result count tells you how many there are.
• Summarize a part of the file: select a range of bytes before you open More actions (…) → Byte histogram or Checksums, then choose Selection.

Next steps

• Hex view: rows, byte classes, the cursor, and the data inspector
• Hex analysis tools: strings, entropy, histogram, and checksums