Viewing and Interpreting Binary Data

Peter Bubestinger-Steindl
(pb @ ArkThis.com)

Hexadecimal

Decimal: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 ...
Hex:     0 1 2 3 4 5 6 7 8 9 A  B  C  D  E  F  10 11 12 13 ...

Hexadecimal

Why is it useful to use the base 16?

  • 0-15 = 16 possibilities.
  • 8 Bit = 1 Byte
  • 4 Bit = 1/2 Byte
  • 4 Bit = 2^4 = 16 possibilities

Character encoding

ASCII Table

Text as Data?

Hex View

Data as Text?

PNG in a text editor

Hex editing!

Hex View of a PNG

“Magic bytes”

  • .PNG
  • RIFF
  • PK..
  • JFIF
  • AIFF
  • .Eߣ
  • %PDF-
  • 8BPS
  • …

See: List of File Signatures (Wikipedia)

Exercise

Identify the file types in the given set, using a Hexeditor and the “Magic Byte” list on Wikipedia.

See: List of File Signatures (Wikipedia)

Unix “file” command

Identifying mixed file types

See Wikipedia: File (command)

MIME Type

“Multipurpose Internet Mail Extensions (MIME) is an Internet standard that extends the format of email messages to support text in character sets other than ASCII, as well attachments of audio, video, images, and application programs.”

– Wikipedia: Media Type

MIME Type Examples

  • application/zip
  • application/pdf
  • text/html
  • text/xml
  • text/csv
  • text/plain
  • image/png
  • image/jpeg
  • image/gif
  • audio/aac
  • audio/mpeg
  • video/DV
  • video/H264
  • video/mp4

Complete List (IANA), 2019-10-16

Remember our “no suffix” file set?

“UNIX file” can show the MIME type

Binary Data?

Hex view of WAV file

Data Structure

Hex view of WAV header (annotated)

Header? Payload?

“header refers to supplemental data placed at the beginning of a block of data being stored or transmitted. In data transmission, the data following the header is sometimes called the payload or body.”

– Wikipedia: Header (computing)

Examples

BMP Image

GIF Image

JPEG Image

PNG Image

WAV Audio

WAV Header

Comments?

Questions?