Creating Annotated Hexdump

Posted | Modified
Author

Annotated hexdump

HexLasso can create an annotated hexdump using the analyzers.

In the example above, there are 6 columns which indicate the followings from left to right: (1) file offset, (2) hexdump, (3) analysis result on 16 bytes granularity, (4) analysis result on 32 bytes granularity, (5) analysis results on 128 bytes granularity, (6) analysis result on 256 bytes granularity.

HexLasso tags the block of bytes with the analyzer name or names with a dash in between. If the block can be 100% described by a single analyzer HexLasso tags that block with the analyzer name. Otherwise HexLasso tags that block with the two analyzers that have the highest byte coverage, which is not necessarily 100% coverage.

If the researcher needs precision they may look at the analysis result on 16 bytes granularity, if less precision is needed because the layout of a larger data is more important than the tiny details, the researcher may look at the analysis result on 256 bytes (or more as this can be set-up arbitrarily) granularity.