Andys Binary Folding Editor
Andys Binary Folding Editor is primarily designed for structured browsing,
although it also provides minimal editing facilities.
This program is designed to take in a set of binary files, and with
the aid of an
initialisation file,
decode and display the definitions (structures or unions) within them.
BE is particularly suited to displaying non-variable length definitions
within the files.
This makes examination of known file types easy, and allows rapid and
reliable navigation of memory dumps.
BE is often used as the data navigation half of a debugger.
The Usage page covers invoking the editor,
the Initialisation page covers its
initialisation file, and the Editing page
covers how you interactively use it.
BE has the following features :-
- Ability to decode definitions in (multiple) files.
- Ability to handle either endian multibyte values.
- Ability to handle signed or unsigned numeric values.
- Ability to display fields in definitions
as ASCII, binary, EBCDIC, octal, decimal, hex, seconds since epoch,
via symbol table lookup, or via a mapping table (enumerations and/or
bit-flags).
- Fields can be numeric or buffers or nested definitions.
- Computed fields (whose values may be computed from a numeric expression,
which may include references to other fields and/or memory locations).
- Selectable level of detail of display.
- Ability to suppress fields of structures considered irrelevant.
This includes within nested sub-structures etc..
- Ability to expand sub-definitions or follow absolute or relative
pointers to other definitions.
- Automatic linked-list following.
- Ability to write/append current view of data to a text file.
- Searching over data on display, optionally using
Extended Regular Expressions.
- Include/exclude and sort lines features.
- Refresh data and auto-refresh data.
- Ability to edit data not actually in a file, but supplied by a
(possibly user written) BE memory extension module.
This feature can turn BE into the data-navigation half of a debugger!
- Tagging of lines on display, and rapid stepping between tags.
- Ability to view a text file.
- Ability to bring up online help.
- Ability to bring up initialisation file for user review.
- Shelling out to the operating system.
- Multiple sessions, with copying between sessions.
- Address sliding feature.
- Power address sliding feature, for systematically tracking down
definitions at unknown locations in the file or memory space.
Keeps decoding definition at successive addresses, until patterns match.
This feature is truly awesome!
- Optional display of addresses, offsets, lengths and indices for
fields in a definition.
Indices of arrays displayable in ASCII, EBCDIC, binary, octal, decimal
or hex.
Addresses displayable as hex or symbol+offset.
Ability to set initial display mode on the command line.
- ARM long-jump decoding of symbolic code addresses.
- Ability to use a symbol table file(s), so that addresses may be displayed
symbol+offset, and so the user may refer to symbolic addresses in
numeric expressions.
- Symbol files in a variety of formats are supported.
- User extendable initialisation file, defining definitions within
the files or memory spaces.
- Initialisation file influencable via command line options.
- Macro support in the initialisation file.
- A non-interactive mode, where BE displays data to stdout and quits.
- Support for a plug-in disassembler.
- Support for AIX, Linux, HP-UX, SunOS, Cygwin, MacOSX,
Windows (both NT and 9x), 32 bit OS/2, 32 bit DOS (via a DOS extender),
NetWare and MIPS.
- Support for >32 bit datatypes and address space (upto 64 bit) on
certain systems (subject to compiler support for
long long
,
or __int64
).
These are currently all versions except 32 bit OS/2.
Other binary editors
Most binary or hex editors editors do not decode the data in any way.
As a result, for many years, the data decode capabilities of BE have been
unrivalled.
The closest thing to competition has been the data navigation features
of modern debuggers.
The SweetScape
010 Editor
supports something it calls "binary templates" for doing structured decode of
binary data.
These differ from BE def
s, in that they can be of variable length.
Breakpoint Software has a
Hex Workshop Hex Editor
which understands structures.