parse_binary

Function

ArgDescriptionType
filenameBinary file to open.OSPath (required)
accessorThe accessor to usestring
profileProfile to use (see https://github.com/Velocidex/vtypes).string
structName of the struct in the profile to instantiate.string (required)
offsetStart parsing from this offsetint64

Description

Parse a binary file into a data structure using a profile.

This plugin extract binary data from strings. It works by applying a profile to the binary string and generating an object from that. Profiles are a json structure describing the binary format. For example a profile might be:

[
  ["StructName", 10, [
     ["field1", 2, "unsigned int"],
     ["field2", 6, "unsigned long long"],
   ]]]
]

The profile is compiled and overlaid on top of the offset specified, then the object is emitted with its required fields.

You can read more about profiles here https://github.com/Velocidex/vtypes

comments powered by Disqus