7 ms·

I vaguely remember a reverse engineering tool in the mid-to-late 2000s that displayed a similar (albeit greyscale) visualisation of entropy within large binary

I vaguely remember a reverse engineering tool in the mid-to-late 2000s that displayed a similar (albeit greyscale) visualisation of entropy within large binary files. Anyone know what tool that would have been?

ycombiredd 16d ago
I was surprised by the timing of this post, after recently shipping a similar tool quite similarly named (vizbin as opposed to binviz). A little more surprised to see that so many folks have also developed similar tooling. I don't know the name of the tool that did entropy visualization you're remembering, but this was my cue to mention that vizbin does that using the colorizer of your choosing. https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#projections--the-same-bytes-different-hypotheses https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#... It can also show you a binary diff with colorization (and unlike cmp, an insertion does not make everything after it a "change", which I find useful.) https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#diff--what-changed-between-two-binaries https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#... Another comment mentions using such a tool on source code; the binary strings example shows just that, with the source embedded in a tarball. Text is rendered as an 8x8 glyph font so you can immediately eyeball both. https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#text-mode--a-visual-strings-that-keeps-the-structure https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#... Rendering known pure text as 8x8 bitmap fonts via the tool might be a bit ludicrous, but you can force a different byteclass and see only the colors and not the actual ASCII characters, which I think might be what they are getting atwanting to do. https://github.com/scottvr/vizbin/tree/main#profile-structural-fingerprint https://github.com/scottvr/vizbin/tree/main#profile-structur... Another useful things falls out from combining these concepts, which is that you could run `vizbin` on an entire repo. The example from the README (which assumes binaries) is given: # which files stand out? cluster by their region composition vizbin profile corpus/\*.bin --json | \ jq -r '[(.regions|map(.kind)|unique|join("+")), .source] | @tsv' The github repo has been linked a handful of times above, but you can also just install it from PyPi with `pip install vizbin`

ycombiredd 16d ago

I was surprised by the timing of this post, after recently shipping a similar tool quite similarly named (vizbin as opposed to binviz). A little more surprised to see that so many folks have also developed similar tooling. I don't know the name of the tool that did entropy visualization you're remembering, but this was my cue to mention that vizbin does that using the colorizer of your choosing. https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#projections--the-same-bytes-different-hypotheses https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#... It can also show you a binary diff with colorization (and unlike cmp, an insertion does not make everything after it a "change", which I find useful.) https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#diff--what-changed-between-two-binaries https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#... Another comment mentions using such a tool on source code; the binary strings example shows just that, with the source embedded in a tarball. Text is rendered as an 8x8 glyph font so you can immediately eyeball both. https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#text-mode--a-visual-strings-that-keeps-the-structure https://github.com/scottvr/vizbin/blob/main/docs/GALLERY.md#... Rendering known pure text as 8x8 bitmap fonts via the tool might be a bit ludicrous, but you can force a different byteclass and see only the colors and not the actual ASCII characters, which I think might be what they are getting atwanting to do. https://github.com/scottvr/vizbin/tree/main#profile-structural-fingerprint https://github.com/scottvr/vizbin/tree/main#profile-structur... Another useful things falls out from combining these concepts, which is that you could run `vizbin` on an entire repo. The example from the README (which assumes binaries) is given: # which files stand out? cluster by their region composition vizbin profile corpus/\*.bin --json | \ jq -r '[(.regions|map(.kind)|unique|join("+")), .source] | @tsv' The github repo has been linked a handful of times above, but you can also just install it from PyPi with `pip install vizbin`