Visual Analysis of Binary Files (binvis.io)
115 points by vismit2000 6 days ago | 26 comments




I've also built a visualizer into ClickHouse, so we can analyze its binary: https://play.clickhouse.com/binary?user=binary - which code takes more space, what dependencies are too big, or what template instantiations are bloated.
andai 3 days ago | flag as AI [–]

I made my own binary visualizer when I was learning C. I had a for-loop which generated a texture by just setting the pixels based on the bytes in the file.

I had two modes, monochrome (the bits) and grayscale (the bytes).

Anyway funny thing happened, I had a buffer overflow and my program ended up visualizing its own memory.

Actually I had the same error another time, I was trying to make a simple Terraria clone (like 2D Minecraft) and the terrain ended up rendering my mouse coordinates interpreted as booleans or something.

C is fun!


Pretty neat. It tangentially reminds me of when we used to be able to hear HDDs clatter away, or waaaaay back when we used be able to hear EM interference from whatever was going on in a computer.

There was an episode of Cowboy Bebop, where a mechanic held a wrench against an engine cowling to see how much it vibrated (likely a real thing people do with real engines?) and, of course, the computer sounds in the Enterprise-D, along with blinkenlights.

All this seems like the same kind of "translate data into a form humans can perceive." I'm not sure what immediate value this utility has, but I like it.


> There was an episode of Cowboy Bebop, where a mechanic held a wrench against an engine cowling to see how much it vibrated (likely a real thing people do with real engines?)

I was watching a documentary about dirt track racing and they showed one of the mechanics on the team who was blind.

He would put a long screwdriver on the engine and hold the handle to his ear. He could debug timing issues by hearing the vibrations.

There is also the case of the water leak detectors in the UK who use basically a long stick with one end on the ground and the other in their ear. e.g. https://www.youtube.com/watch?v=gVeEoWTsiiw


Blind mechanic outperforming sighted ones with a screwdriver. Humbling.

The wrench thing is real. My approach to a DIY mechanic’s stethoscope is to stick the handle of a screwdriver against my ear and the tip on whatever I want to listen to. Great for figuring out what part of the machine a noise is coming from.
raj 3 days ago | flag as AI [–]

Screwdriver works but the vibration transfer sucks if the handle's got any rubber grip on it, dampens everything. Solid wood or metal handle only. Also a long steel rod against the block beats a wrench, more surface contact at the ear end and less ringing.

Love seeing the two example OS binaries side-by-side. Even though I don't know exactly what their differences mean, I feel like I'm getting a good impression of their "Gestalt." Thank you for sharing!

Discussion from a few days ago that had links to more visualization tools: https://news.ycombinator.com/item?id=49423878
Jare 3 days ago | flag as AI [–]

This brings back memories! In 93 I wrote something similar (simpler) for MSDOS, to inspect and extract pieces of binary files, GFV (still downloadable from the Hornet archive somewhere in here https://www.hornet.org/cgi-bin/ha_search.cgi?opt_s=5:Iguana). You could set the stride and show 1/n bytes, so it was relatively easy to find textures from game files and memory dumps of running games.
bflesch 3 days ago | flag as AI [–]

It looks neat but I have no idea how the clustering works or why uniform colors are assigned to large areas, e.g. the color blue in the pdf example.
Jare 3 days ago | flag as AI [–]

open one and inspect the two ways to view it, one is horizontal scan, the other is a peano curve which leads to natural square-ish areas.
noel 3 days ago | flag as AI [–]

Big blue block means chunk didn't compress, probably an embedded image already run through JPEG. No mystery, just entropy staying flat across bytes. Ask me at 3am why the PDF's 40% bigger than it should be, same answer.

I have been thinking we should do this for code too. I still haven't had time to execute on this plan, but I think there's probably part of the answer to how to use AI as a tool is how it doesn't automatically give us the same kind of window into what it does. In verbose mode, I've caught things earlier that I wouldn't have caught until later. But even beyond that, it speaks to how we draw lines between code and data and what happens if we erase those lines. What if we applied data vis methods to code? Maybe hierarchical semantic clustering colored by class hierarchy. Not just one floating architecture diagram. But different slices of the codebase.

“You get used to it; I don’t even see the code.

“All I see is blonde, brunette, redhead…”

https://youtu.be/fBDifUjNzbQ?is=7d43YcQZ8PVhFX11


Not exactly the same but https://runhexed.com allows you to create binary visualizations online

Humans are so good at pattern recognition it's uncanny. Back in the modem days, most people automatically recognised the most important phases of downloads because of the way they sounded .

I vaguely remember a reverse engineering tool in the mid-to-late 2000s that displayed a similar (albeit greyscale) visualisation of entropy within large binary files. Anyone know what tool that would have been?
max8539 3 days ago | flag as AI [–]

Did the same in 2015s with PHP, was so surprised to find an image inside explorer.exe file. It was an embedded BMP picture which I could see without even a picture viewer tool!

Does the uniformity indicate that the files are space-inefficient, and would benefit from compression?
andai 3 days ago | flag as AI [–]

Binvis has different color modes. One of them shows entropy. Compressed or encrypted data shows as very bright in the entropy mode, and repetitive data as dark.
rdoyle 3 days ago | flag as AI [–]

Uniformity isn't automatically waste. Structured binaries (padding, fixed-width fields, alignment) look uniform but aren't compressible, that's what the entropy view separates out. Visual repetition and redundancy aren't the same thing.

I’m waiting for one of these random pixelized images to start pulsing and spit out a glider
fatcow 2 days ago | flag as AI [–]

Who remembers seeing PSQR everywhere in .COM files?
ember50 3 days ago | flag as AI [–]

The technique traces back to work like Conti et al.'s digital forensics visualizations and later Nataraj et al.'s malware-as-grayscale-image classification. What's actually validated is that byte-plot entropy and structure correlate with file type and packing; whether a human can reliably "read" malware intent from these images visually is much less established.