Skip to content

theviewer 0.2.0

Choose a tag to compare

View all tags
@benjaminr benjaminr released this 05 Oct 21:36
· 396 commits to main since this release
v0.2.0
7eeff26

About twenty new analysis tools for unknown data, firmware, protocols and crypto, plus a headless mode for scripts.

New tools

Top picks

  • Dot plot: the file compared with itself; repeated sections show as diagonals, uniform regions as blocks.
  • Images: finds uncompressed pictures, fonts and framebuffers by trying widths and pixel formats, and shows them in the view in one click.
  • Firmware: identifies the processor of a raw image, finds the address it was built to load at, and reads ARM Cortex-M vector tables.
  • Crypto constants: AES tables, SHA/MD5 constants, CRC tables, Blowfish, DES, ChaCha, curve primes and Base64 alphabets, also shown in Findings.
  • Solve a custom CRC (in Checksums): works out width, polynomial, initial value, reflection and final XOR from several messages, and names the standard algorithm.
  • Align messages (in Protocol): groups messages into types and aligns them, so fields line up across different lengths.

Bits and encodings: bit-level frame lengths and sync words, bit planes, Manchester / differential Manchester / NRZI / 8b/10b / Gray / BCD decoding, number-type and endianness guessing, and length-prefix / TLV / offset-table discovery.

Crypto and obfuscation: ECB detection from repeated cipher blocks; PEM, DER, OpenSSH and likely raw keys; rolling XOR, ADD, rotation and combined ciphers, and crib dragging with a known plaintext.

Compare: what stays constant, varies or counts up across many files; which fields follow a value you enter per file; and a timeline of a live recording.

Firmware and forensics: SquashFS, CramFS, JFFS2 and UBI images are unpacked (including archives inside them), and every block of a file is classified for carving.

Headless: theviewer FILE --report prints the report as text and --json as JSON, without opening a window.

Fixes

  • A malformed DER BIT STRING could crash the scan; and one faulty detector or parser can no longer fail a whole scan.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.2.0-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.2.0-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.2.0-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release.

Assets 4
Loading