Skip to content

ByteRipperWeb 0.9.3-1 — annotations, a way back, and an agent on Windows

Choose a tag to compare

View all tags
@maxshevelev maxshevelev released this 16 Oct 16:03
· 134 commits to main since this release
v0.9.3-1
ba17558

This release lets you leave notes on a dump and find your way back: annotations on bytes and on UEFI nodes, kept with the file and listed as cards, and Back and Forward through the places you have been. The UEFI tree is searched by content, inside compressed sections too, Lenovo's DMI store is read and edited, and the Windows build lets an AI agent work on the dumps you have open.

Annotations

  • Add Annotation… on a selection or on a node of the UEFI tree: a title and a note, drawn over the bytes as a dashed outline wherever the file is on screen, the note shown when the pointer rests on it. Yours are green, an agent's violet.
  • An annotation belongs to the file: it comes back when the file is opened again, and a node inside a compressed section or an encoded LENV block is annotated in the bytes it decodes to.
  • The Annotations panel in the dock lists them all as cards, open files or not: the newest first and tagged New, any card dragged to where you want it, the order kept between visits.
  • A double click on a card goes to its place, opening the file again if it has to, decompressing the way to it, and opening UEFI Structure down to the node. Open Annotation “…” on the dump's menu does the same from the bytes.

Finding your way back

  • Back and Forward step through the places you went to — bookmarks, search matches, a tool's rows, annotations — and a tool's choice is a step of its own.
  • The UEFI tree is searched by content: a pattern, text or GUID, inside compressed sections in what they decompress to. The matches are listed under the tree, and a match opens the tree down to its node, or opens the decompressed part with the match selected.
  • The Find bar and the tree's search share one set of pattern controls.

Parts of a dump

  • Every part opens through what it is: a node, a decompressed body, a decoded block opens as a panel over the dump and goes back through Update in Parent the same way — compressed again, encoded again, its checksum written.
  • A pill is named after what was opened — the node, its body, the zone — with the codec beside it when the bytes went through one (LZMA, XOR 58, bzip2), a part opened out of a decompressed one included. A part saved for the first time is offered as a .bin.
  • A double click on a node with rows — a volume, a DMI store — opens it whole, with its tree.

More of the image read

  • Lenovo's DMI store is read into the UEFI tree: the LDBG change log, both LENV blocks and the block the firmware uses, each entry decoded. A block opens decoded and goes back encoded with its checksum recomputed; Show DMI Area finds the store.
  • Acer's DMI area is read.
  • FIT microcode names every processor an update serves, and a second update for the same processor is refused.
  • The ME analysis says what the file system state rests on.

The agent (Windows build)

  • Settings ▸ Agent lets in Claude Code, Claude Desktop, Cursor or any MCP client, with the text its configuration needs. It reads what you are looking at — the caret, the selection, the UEFI tree, the FIT table, the ME analysis — and brings forward the place it wants you to see.
  • Across many dumps: it opens a folder of dumps without putting them on screen, asks one question of each (each file named by its path from the folder), compares them byte by byte, by NVRAM variable or by ME file, and leaves its findings as annotations.
  • Edits only when you allow it: a second switch lets it write bytes, fix checksums and change FIT microcode, each change one undo step. Every call is listed in the Agent panel. Nothing of the agent exists in the browser.

Smaller things

  • Appearance, layout and language are on one View tab in Settings.
  • The bookmark command says Add or Delete rather than Toggle.
  • A quick second Ctrl/⌘ Z takes back the rest of a typed run.
  • The minimap's overview draws the content over a difference, and a modified row in red.
  • A click on the empty part of the Annotations panel clears the selection, and the panel's empty view says how to make an annotation.

Fixes

  • A recent file that was moved or deleted stayed in the list, and opening it said only "This file could not be opened". It now says the file is no longer there and leaves the list; a refused permission says so too.
  • The ✕ of the open panel's pill could not be seen under the pointer.
  • The hosted page no longer offers an update: its next load is the newest release.

The page (ByteRipperWeb-0.9.3-1.html) is the whole app in one file:
open it in Chrome or Edge from disk, no installation and no server. Files
never leave the machine. Opened from disk, a page has no private storage, so
File ▸ Duplicate needs the hosted page or the Windows build.

Windows (ByteRipper-0.9.3-1-setup.exe installs it for the current user
and starts fastest; -portable.exe and the .zip need no installation): the
same app in a window of its own, x64. Help ▸ Check for Update… installs the
next release from the setup. Not code-signed, so SmartScreen warns on the
first launch: choose More info ▸ Run anyway.

In the browser, the same release: https://maxshevelev.github.io/ByteRipperWeb/ —
and on a Mac, the native app: https://github.com/maxshevelev/ByteRipper/releases/latest

Assets 8
Loading