theviewer 0.4.0

Worksheets, notes, and recipes that work on the next file. Every sheet you make stays open, and steps pass what they make and find to one another, so an analysis saved from the History tab replays on a new file. This release also adds built-in text codecs, packet filter expressions, AES, FAT volumes, PDF and EXIF, checksum verification, and many fixes found by working six CTF-style challenges from start to finish.

Highlights

Worksheets: decompressing, decoding, carving or extracting opens a new sheet that remembers where it came from. A strip under the toolbar shows the trail, and a tree (Shift+Cmd+T) lists every sheet with the step that made it. Back (Cmd+[) keeps the child open, siblings are allowed, and File › Open adds a worksheet rather than closing the others. Tool results are kept per sheet. See the worksheets guide.

Passing values between tools:

• Right-click any result (a string, a key, a finding, a field, a packet, an Inspector reading) and choose Send to a new worksheet, a variable ($serial), or an input of another tool.
• Use as key is one click.
• A field filled this way shows where its value came from, and that origin is recorded with the step.
• An Output choice (in place or a new labelled worksheet) is on the XOR, Crypto, Transform and Decompress actions.

Notes in the History tab: write down what you're doing and why as you work, link a note to a step with #12, give it a kind (observation, hypothesis, decision, fallback, conclusion), and export the notes as Markdown. A Sheets view groups the steps by worksheet.

Recipes that generalise:

• Recipes keep the steps that make sheets.
• They refer to sheets and values by what finds them (pick, then arithmetic, variables) rather than fixed ids and literals, so a recipe recorded on one file finds its keys and offsets again on the next.
• A replay refuses a document it can't place instead of editing the wrong file.
• New replay options: --save-sheets, --allow-writes and --plugins.

Data API and MCP:

• An output parameter (in_place, new, return, file) on every method that produces bytes.
• Anchors work at call time.
• New methods: vars.*, crypto.apply, crypto.decrypt (AES-128/192/256, ECB/CBC/CTR), checksums.verify and compute, documents.activate and close.
• Each MCP client keeps its own default document, and history_note lets a client record its reasoning.

Decoders, packets and forensics:

• Built-in base32, base64, hex text, DEC SIXBIT and AIS 6-bit codecs.
• A packet filter language (&&, ||, not, contains, matches, tcp.port, dns.qry.type==16, template fields), with sorting, de-duplication and HTTP bodies.
• A FAT12/16/32 walker that recovers deleted files.
• Encrypted ZIP members are flagged, and ZipCrypto is decrypted with a password.
• EXIF tags and a PDF parser.

Behaviour changes

• Back keeps a derived sheet open, and File › Open adds a worksheet.
• Over the API, an omitted doc means the caller's focus.
• A replay refuses unknown document ids.
• jobs.status polls are no longer journalled.
• Packets are numbered from 0 in the API.
• bytes.read past the end returns a short read.

The full list is in CHANGELOG.md.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.4.0-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.4.0-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.4.0-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release.