haypo / hachoir

Hachoir is a Python library that allows to view and edit a binary stream field by field. In other words, Hachoir allows you to "browse" any binary stream just like you browse directories and files. A file is split in a tree of fields, where the smallest field is just one bit.

Clone this repository (size: 2.1 MB): HTTPS / SSH
$ hg clone http://bitbucket.org/haypo/hachoir/

hachoir-urwid is the most sexy user interface based on hachoir-parser to explore a binary file.

Download

Startup options

  • --preload=10: Load 10 fields when loading a new field set
  • --path="/header/bpp": Open the specified path and focus on the field
  • --parser=PARSERID: Force a parser (and skip parser validation)

Usefull keys

Move:

  • up/down: move up/down
  • home: go to parent
  • end: go to the last field of a field set
  • left/right: horizontal scrolling

Setup display:

  • h: most important option :-) switch between human display (default) and raw value
  • v / d / s: show or hide field value / description / size
  • a: switch between relative (default) and absolute address
  • b: switch between address in decimal (default) and hexadecimal

Interaction:

  • enter: on a field set, expand/collaspe the children
  • space: parse a file/stream contained in the current field

Application:

  • q: quit
  • < / >: previous / next tab
  • + / -: move separator vertically
  • esc or CTRL+W: close current tab
  • F1: display help

Help

Command line options: use --help option.

In hachoir-use, use F1 key to get help (keyboard keys).

See also


This revision is from 2010-02-04 12:56