Transformers

Posted | Modified
Author

HexLasso performs the byte coverage analysis through analyzers and transformers.

The transformer is a routine to transform data of the given block to potentially improve the efficiency of the analysis. Transforms have their advantages because the transformed data might fit better into the pattern recognition and prediction models than the original data.

For example, if the match analyzer reports considerably better byte coverage of the given block with matrix transformation versus no transformation at all, then this information allows smartly guessing about the data without the need to manually analyze the actual bytes. Increased match coverage after matrix transformation often indicates an array of fixed-width values where the low bytes of the values are keep changing and the high bytes are fixed. After performing the matrix transformation, the fixed values will be arranged together that they will form better match coverage when running the match analyzer on the transformed data.

The transformation is a reversible process so the original data can be restored without data loss.

The length of the transformed data is the same to the length of the original data.

The transformer is being called by the analyzer and passes the transformed data back to the analyzer.

There are number of transformers but only certain analyzers use transformers.

The transformation might affect the entropy and the match coverage of the block.