File structure explorer (sth like Wireshark, but for files)

Question

Hi

I am looking for a software which is able to decompose and analyze files. Do you know any?

What I mean is something that, given a file, would tell me for example:

• here is the magic number telling that it is a PNG, and here starts a colors definition, here goes the compression flag, and then there are the picture data, and so on...

or something like:

• this is a MP3 file, here is the ID3 definition, here is the flag telling that this is the joint stereo and so on...

I am looking for a software doing with files what Wireshark (Ethereal) is doing with network traffic.

Thanks!

Answer 1

You can use the 'file' command on unix boxes (or else under mingw or cygwin) to determine the type of a file. This will look up the magic numbers for the types that are known. But no extra information will be provided.

I don't know of any software that has the whole knowledge of all the file formats as to provide further insights (sections in the file).

Answer 2

The software HexWorkshop is a commercial hex editor which has a "Data interpretation" mode in which each fields of a data structure is highlighted in the editor. It comes with a (very) few definitions of data structures or file format but you can easily write your own.

I used to use a very old version (several years ago) and this software has helped me a lot for several reverse engineering projects.