theviewer 0.4.0

Worksheets, notes, and recipes that work on the next file. Every sheet you make stays open, and steps pass what they make and find to one another, so an analysis saved from the History tab replays on a new file. This release also adds built-in text codecs, packet filter expressions, AES, FAT volumes, PDF and EXIF, checksum verification, and many fixes found by working six CTF-style challenges from start to finish.

Highlights

Worksheets: decompressing, decoding, carving or extracting opens a new sheet that remembers where it came from. A strip under the toolbar shows the trail, and a tree (Shift+Cmd+T) lists every sheet with the step that made it. Back (Cmd+[) keeps the child open, siblings are allowed, and File › Open adds a worksheet rather than closing the others. Tool results are kept per sheet. See the worksheets guide.

Passing values between tools:

• Right-click any result (a string, a key, a finding, a field, a packet, an Inspector reading) and choose Send to a new worksheet, a variable ($serial), or an input of another tool.
• Use as key is one click.
• A field filled this way shows where its value came from, and that origin is recorded with the step.
• An Output choice (in place or a new labelled worksheet) is on the XOR, Crypto, Transform and Decompress actions.

Notes in the History tab: write down what you're doing and why as you work, link a note to a step with #12, give it a kind (observation, hypothesis, decision, fallback, conclusion), and export the notes as Markdown. A Sheets view groups the steps by worksheet.

Recipes that generalise:

• Recipes keep the steps that make sheets.
• They refer to sheets and values by what finds them (pick, then arithmetic, variables) rather than fixed ids and literals, so a recipe recorded on one file finds its keys and offsets again on the next.
• A replay refuses a document it can't place instead of editing the wrong file.
• New replay options: --save-sheets, --allow-writes and --plugins.

Data API and MCP:

• An output parameter (in_place, new, return, file) on every method that produces bytes.
• Anchors work at call time.
• New methods: vars.*, crypto.apply, crypto.decrypt (AES-128/192/256, ECB/CBC/CTR), checksums.verify and compute, documents.activate and close.
• Each MCP client keeps its own default document, and history_note lets a client record its reasoning.

Decoders, packets and forensics:

• Built-in base32, base64, hex text, DEC SIXBIT and AIS 6-bit codecs.
• A packet filter language (&&, ||, not, contains, matches, tcp.port, dns.qry.type==16, template fields), with sorting, de-duplication and HTTP bodies.
• A FAT12/16/32 walker that recovers deleted files.
• Encrypted ZIP members are flagged, and ZipCrypto is decrypted with a password.
• EXIF tags and a PDF parser.

Behaviour changes

• Back keeps a derived sheet open, and File › Open adds a worksheet.
• Over the API, an omitted doc means the caller's focus.
• A replay refuses unknown document ids.
• jobs.status polls are no longer journalled.
• Packets are numbered from 0 in the API.
• bytes.read past the end returns a short read.

The full list is in CHANGELOG.md.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.4.0-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.4.0-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.4.0-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release.

theviewer 0.3.1

Fixes on top of 0.3.0.

• Arrows in labels and buttons ("← Back to the cursor", the recipe preview, the follow-stream legend) draw instead of boxes.
• A decompressed stream's toolbar, Back and the API's document list name the file it came from rather than "untitled".
• A packet picked in the packet list shows its innermost protocol, such as DNS, in the Reference tab rather than its record header.
• The Reference tab no longer adds a format guessed from bytes a packet dissector has already read, such as a DNS name taken for CBOR.
• The recipes guide's finding anchor example uses an id that exists.

The full history is in CHANGELOG.md.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.3.1-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.3.1-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.3.1-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release.

theviewer 0.3.0

A packet viewer, reference notes on about 260 formats and protocols, a data API with a command line and an MCP server, and a history of every step that you can save as a recipe and run on other files. The README is now short, with a user guide for the detail.

Highlights

Layouts: a Layout menu with recommended layouts for each kind of work (Overview, Network capture, File structure, Firmware, Signals, Forensics, Compare, Focus), layouts you save yourself, and Last session. The status bar suggests one for each kind of file.

Packet viewer: a Packets tab for pcap, pcapng, snoop, Network Monitor and ERF captures found anywhere in a file. It has dissectors from Ethernet, 802.11 and IP through DNS, HTTP, SNMP, DHCP, SMB, S7comm, Modbus, MQTT, RTP and TLS records. You can also:

• filter by Wireshark field names;
• see conversations and endpoints, and follow a stream;
• export as pcap;
• edit packets in place;
• split any range into frames, with Decode frames as detecting the protocol;
• optionally decode with tshark.

Reference notes: the protocol or format at the cursor is explained, with its field layout drawn out and the cited RFC section fetched on demand. You can add your own notes in TOML.

Data API: about 170 methods for reading, viewing, editing and analysing data, with JSON schemas. You can reach it from:

• the command line: theviewer api;
• Lua plugins: theviewer.api, plus subscribe, publish and register_method;
• MCP: theviewer mcp, a stdio server for Claude and other clients.

Each client gets its own permission setting (Allow, Ask or Deny). See docs/api.md and docs/mcp.md.

History and recipes: a History tab records every step, from you, plugins, Ask or MCP. You can undo across steps, go back to any step, or play the history back. Save the steps as a recipe and run it on other files with theviewer replay (docs/recipes.md).

And more: column and multi-range selections, a shared Selection menu, numeric heatmaps, Morton curves, and new Structure map, Trigrams, Size map, Characterise and Learn tools. Signature scans are much faster.

Fixes

DNS, HTTP and IP fragment decoding, OS/2 bitmap headers, nudging ranges that touch each other, overflow checks on padding and field offsets, all-or-nothing undo, and no panic when output is piped into head.

The full list is in CHANGELOG.md.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.3.0-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.3.0-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.3.0-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release.

theviewer 0.2.0

About twenty new analysis tools for unknown data, firmware, protocols and crypto, plus a headless mode for scripts.

New tools

Top picks

• Dot plot: the file compared with itself; repeated sections show as diagonals, uniform regions as blocks.
• Images: finds uncompressed pictures, fonts and framebuffers by trying widths and pixel formats, and shows them in the view in one click.
• Firmware: identifies the processor of a raw image, finds the address it was built to load at, and reads ARM Cortex-M vector tables.
• Crypto constants: AES tables, SHA/MD5 constants, CRC tables, Blowfish, DES, ChaCha, curve primes and Base64 alphabets, also shown in Findings.
• Solve a custom CRC (in Checksums): works out width, polynomial, initial value, reflection and final XOR from several messages, and names the standard algorithm.
• Align messages (in Protocol): groups messages into types and aligns them, so fields line up across different lengths.

Bits and encodings: bit-level frame lengths and sync words, bit planes, Manchester / differential Manchester / NRZI / 8b/10b / Gray / BCD decoding, number-type and endianness guessing, and length-prefix / TLV / offset-table discovery.

Crypto and obfuscation: ECB detection from repeated cipher blocks; PEM, DER, OpenSSH and likely raw keys; rolling XOR, ADD, rotation and combined ciphers, and crib dragging with a known plaintext.

Compare: what stays constant, varies or counts up across many files; which fields follow a value you enter per file; and a timeline of a live recording.

Firmware and forensics: SquashFS, CramFS, JFFS2 and UBI images are unpacked (including archives inside them), and every block of a file is classified for carving.

Headless: theviewer FILE --report prints the report as text and --json as JSON, without opening a window.

Fixes

• A malformed DER BIT STRING could crash the scan; and one faulty detector or parser can no longer fail a whole scan.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.2.0-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.2.0-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.2.0-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release.

theviewer 0.1.2

A patch release that makes the file dialogs responsive.

Fixed

• Open, Save as, Extract, Compare and the media and unpack Save buttons no longer freeze the window. The dialogs used to run their own blocking loop in the middle of drawing a frame, which made the macOS panel slow to highlight and pick files. They now open as a sheet on the window while the app keeps running.
• Compare with file… now switches to the Diff tab when you pick a file, so the comparison always finishes and shows.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.1.2-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.1.2-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.1.2-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release.

theviewer 0.1.1

The first published release of theviewer: a fast binary viewer and editor that draws any file as pixels, so its structure shows up as shapes you can recognise.

Highlights

• Raster any file in twelve pixel formats, at any width, with a hex dump and value inspector that follow the cursor.
• Find record sizes automatically, and see counters, timestamps, text, signatures and compressed streams detected for you.
• Field trees for executables, images, archives, captures, certificates, disks and schemaless formats.
• Open embedded images, audio, video and compressed streams where they sit, and extract them.
• Tools for Columns, Protocol, Template, Statistics, Strings, XOR, Disassembly, Unpacking, Checksums, Diff and live sources.
• Optional Ask: questions about the file answered by Claude, with your own API key.
• Dockable panels, a toolbar you can rearrange, and startup defaults in Settings.

Changes since 0.1.0

• The file report no longer lists bare magic-number matches (such as "an ICO of 4 B") as objects.
• Columns profiles from the cursor's record to the end of the table, instead of running into whatever follows it.
• A rewritten README with a quick tour and screenshots.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.1.1-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.1.1-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.1.1-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release. Video playback uses ffmpeg if it is installed.