1. Introduction

Binary Viewer is a free windows utility that allows to view contents of any file. It can display the file in hexadecimal, binary, octal, decimal and text formats, therefore letting you to peek into binary files, usually not viewable by standard Windows viewers/editors like Notepad or Microsoft Word.
There is no limit for file size besides maximum size allowed by operating system. NTFS allows maximum file size to approximately 16TB (16, 000 GB)

With Binary Viewer you can also open physical drive for examination and view its contents the same way as you would see the file. Again, only limitation for maximum drive size is system limit which is approximately 256TB in NTFS.

Since Binary Viewer uses memory mapping technique to view large files or disks, there is no decrease of performance or memory usage, even it file you view is extremely large.

2. GUI overview

Binary viewer has rich, customizable GUI. It comprises of several panes each allowing for different ways of viewing file contents or enhancing way user interacts with the displayed data.

Main screen contains seven distinct areas marked on the screen with number tags. Most of main window panels are defined as dockable dialog windows. User can simply drag them from one part of the main application screen to another or move it out of main screen altogether and display as separate dialog window. You can also hide panels if you are not planning to use them and get more window space for the rest.

Below screen shows main components of Binary Viewer screen:

Main screen areas:

	Data Panel. This panel occupied most central portion of the screen and its purpose is to sequentially display all data from open file or physical drive. This panel usually displays data in two columns. Each column can show data in format selected by the user. Please go to Data display modes to see how to change format of data displayed in Data Panel.
	Data Inspector. Since Data Panel can display data only in two columns, at the same time, only two different formats of viewing data are available. Data Inspector allows you quickly see contents of selected address location using multiple formats at once, without need to switch display mode of the entire column of Data Panel.
	File Properties panel displays basic information about the currently open file or physical drive.
	Structures panel. Left-hand side of Structures panel contains list of all User Defined Structures (UDS) available for mapping (binding). Right-hand side of Structures panel contains list (tabbed GUI) of all structures bound to specific addresses of currently open file or physical drive. See User Defined Structures for more details.
	Bookmarks panel allows managing all defined bookmarks (edit, delete) and quick navigation to highlighted bookmark. See Bookmarking for more details.
	Visualizer panel allows to see the file in graphical mode. Visualizer can use different color schemas: each color schema defines mapping between each possible byte value (255 possible values) to the chosen color. Predefined default color schema assigns distinct colors to hex:00, hex:FF, printable ASCII characters and non printable characters.
	Histogram panel shows open file histogram (frequencies of each byte value within the file).

3. Open the file to view

To open the file, click on "Open" toolbar item or select from main menu File/Open File....

From displayed dialog select file you wish to open. File will be shown in main Data Panel instantaneously.

4. Open physical drive to view

To open physical drive, select main menu item File/Open Physical Drive. Then, from displayed dialog select drive you wish to open. Drive contents will be displayed instantaneously.

Note:

In order to view contents of the physical drive you have to have Administrator privileges. If application didn't start with Administrator rights you will be presented with the dialog shown below, providing you with opportunity to restart Binary Viewer with elevated privileges.

5. Data display modes

Binary Viewer shows data in two panels (data columns). Each panel might present data in different format.

Binary Viewer offers many other formats to choose from. Data can be displayed as Hexadecimal (1, 2 or 4 bytes long), Binary, Unsigned Integer (1, 2 or 4 bytes long), Octal (1 or 2 bytes long), Text ASCII o Text Unicode. If data format requires 2 or 4 bytes, you can also choose endianness (Big or Little Endian).

You can change data display mode using one of the following methods:

• Click on column header of the panel you want to see in different mode as many times as needed till mode name you want to use is displayed in the header (clicking on the header rotates column's display mode)

• From the context menu of the main data area (right-click on the body of main screen) select 1^st (or 2^nd) Column View Mode menu item and then select desired view mode from sub-menu (see the image below).

• From the main program menu select View menu item, then desired column 1^st (or 2^nd) Column View Mode and then select desired view mode from sub-menu (see the image below).

6. Search within file

Binary Viewer allows you to easy locate any binary sequence, text or binary pattern within open file or physical disk. Simply click Ctrl/F or click Search toolbar icon, or from the main program menu select Search/Find menu item.

You will be presented with the dialog shown below.

To search for text within open file or physical drive simply select Text tab, enter text to search for, provide desired options (text encoding, case sensitiveness) and search start address, and press Find Next or Find All button.

If Find Next button is pressed, only the first occurrence of searched text will be found (you can always search for next again).

If Find All button is pressed, list of all addresses containing searched text will be presented. You can navigate to every found location by double-clicking on address from the list.

To search for hexadecimal sequence within open file or disk, click on Hexadecimal Sequence tab, then enter sequence of hexadecimal numbers you want to search in open file or physical disk, and finally Find Next or Find All.

To search for Binary Pattern select Binary Pattern tab. Binary Pattern search is the most flexible way to search in Binary Viewer. It allows entering bit mask to search within open file or disk.

Example shown below will search for every occurrence of four bytes where first byte starts from one and ends with 0, next two bytes hold any values and fourth byte has all position set (0xFF value).>

7. Search in files

In similar manner to Search within file, you can search for text, hexadecimal sequence or binary pattern within any file in selected directory.

Simply click Ctrl/Alt/F or from the main menu select Search/Find in Files menu item. From the dialog shown below select file search options: path, mask, whether include subdirectories and whether include Alternate Data Streams in the scan.

Other options are identical toSearch within file functionality.

8. Moving around

Binary Viewer allows you to easy move to any location within open file or physical disk. You can navigate using vertical scrollbar of data panel or if you want to navigate with the greatest precision you can use GoTo function. Simply click Ctrl/G or from the main menu select Search/GoTo menu item.

This will display dialog shown below. With its help you can navigate precisely to location you want to view.

9. Copy formatted text to clipboard or to the file

Binary Viewer allows copying selected portion of data in formatted manner either to the Clipboard or to the text file. To start:

1. On the main data panel select (highlight) portion of data you want to copy

2. From the data panel context menu select Copy Selection as Formatted Text and then depending where you want to copy to select To File or To Clipboard.

   

3. Next you will be presented with the following dialog box allowing you to preview formatted text and change many formatting options. Most options are self-explanatory or easy discoverable with some experimenting.

   

4. If you are copying into file you will be presented with additional dialog box prompting you to selects file name you want to copy formatted text to.

Note:

Be careful what you are saving into clipboard. Clipboard is memory based storage. Obviously you cannot save entire disk into the clipboard (unless your disk is very small in capacity). So if you want to save large portions of big file or disk rather pick file than clipboard. Make sure that you have enough disk space. Formatted data might occupy several time of the size of its binary equivalent.

10. Save selection to file (binary)

Binary Viewer allows you to save selection to the file for further references or analysis. In order to save selection to the file click Save Selection to File form the context menu. Selection will be saved using document original (binary) format.

11. Switch GUI Language

Binary Viewer user interface language is customizable. Currently the following four languages are supported: English, Chinese, Italian and Polish. If you speed other language you can help to translate Binary Viewer. We are always looking for volunteers. If you are interested please send a note to [email protected]

To switch GUI language, select Tools/Select Language from the main menu and then name of desired language.

If you are curious how it works and want to experiment with the GUI language, look into contents of directory C:\Program Files\Binary Viewer\Resources\Language. You will see files containing translation to Chinese, Italian and Polish. They are text files. Their format is very simple you can guess everything - no explanation needed. Make copy of one of files. Change its name to Resources.<cultureName>.txt where <cultureName> defines language and country.

Few examples of valid names with GUI language definitions:

• Resources.da-DK.txt - if you want to translate to Danish/dansk(Denmark)

• Resources.es-ES.txt - if you want to translate to Spanish/espanol(Espana)

• Resources.ru-RU.txt - if you want to translate to Russian

You can find full list of possible <cultureName> values at http://msdn.microsoft.com/en-us/goglobal/bb896001.aspx

12. Bookmarking

Bookmarking allows tagging selected areas or single addresses within open file or physical disk for easier reference while analyzing file contents. Bookmark is a named address area within open file or physical disk. Bookmarked area is highlighted in data view with different color.

In order to bookmark:

• Select address or area in data panel you want to bookmark

• Click Ctrl/B (alternatively you can select Bookmark item from the context menu)

  Selected area will be highlighted with different color.

  

Bookmarks panel lists all currently defined bookmarks and shows their properties (name, address, length and color used for highlighting) allowing the following operations:

• Navigating to selected bookmark address (Go To)

• Editing bookmark properties (Edit)

• Deleting selected bookmark (Delete)

You can edit bookmark by highlighting bookmark line in Bookmarks panel and selecting Edit from the Bookmarks panel context menu. The following dialog will be displayed:

You can edit the following bookmark properties:

• Bookmark name (by default, when creating new bookmark, its name is derived from bookmark address)

• Comment (any text further describing bookmark)

• Bookmark displayed color with transparency (alpha)

Note:

Bookmark location (Start Address) and Length are not editable. They are assigned when new bookmark is defined. If you want to change one of them, you have to delete bookmark and create new one.

13. User Defined Structures

One of most fascinating features of Binary Viewer is the ability to view selected areas as user defined structures. Standard viewer modes allow for displaying entire file data in uniform format. You can chose from many formats (binary, hexadecimal, decimal, text of different sizes and endianness) but this cannot possibly show complex structures of data that are stored in many files.

That's why User Defined Structures (UDS) were introduced.

1. UDS are defined in text files containing UDS definition written in C#

2. Every file can contain one or more UDS

3. Every UDS is C# public class, struct or enum.

4. If UDS is a class or struct it has to have defined public method with the following signature:

           public void Reserved_PopulateWithData(
                       Func<long, long, byte[]> getData, 
                       long streamSize, 
                       long address);
   

   This method is called when user binds structure to the address within open file or physical disk. The following parameters are passed when method is called:

   • getData reference to the method that can read contents of the open file or disk. This method has following parameters:

     • Offset from binding address (long) ; it is 0 if you want to read data starting exactly from the binding address, but it can be negative if you want to read data before of binding address, or positive if you want to read data ahead of binding address.

     • Second parameter of the getData is the long integer indicating how many bytes has to be read and returned. Return value of getData method is array of bytes (byte[]) containing bytes read.

   • streamSize if currently viewed stream is Alternate Data Stream - size of the Alternate Data Stream, otherwise size of main data stream (the same as size of the file or physical disk as displayed in windows GUI).

   • address = an address to which UDS is bind.

5. All public properties and fields of the class or enum define elements of User Defined Structure and will be shown in GUI when structure will be bind to file address.

6. Every public field or property can be decorated with [Description] attribute. Provided description will be used by Binary Viewer GUI when showing mapped area. This attribute is optional.

7. Every public filed or property should be decorated with [Order] attribute. Physical order of methods and fields in class definition file doesn't necessary define order fields will be displayed in Binary Viewer GUI. [Order] attribute can remediate this issue by reinforcing display order to the desired one (usually display order corresponds memory location order). Index value of order property should start from number one (1).

8. Every public filed or property can be decorated with [Size] attribute. Size defines length of filed or property in bytes. This attribute is optional. In most cases Binary Viewer can properly calculate size of filed. For example if class defines public filed as public Int32 X; Binary Viewer can easily deduct that X occupies 4 byte. Sometimes you might want to define fields or properties with [Size(0)]. Typically you will do it when you will be defining filed that doesn't correspond to any physical location in the UDS.

For example:

You might have UDS defining Rectangle with four Int32 fields representing rectangle position, width and height. All 4 fields have physical memory associated witch every field so their corresponding sizes will be 4 bytes and total size of UDS is 16 bytes. But you can define additional properties derived from Rectangle 4 physical fields that will be displayed in GUI. For example, additionally to position, width and height you can define area property (width* height) or diagonal property (Sqrt(width*width + height*height)). Both properties din't have corresponding physical location within UDS so they should be decorated with [Size(0)].

Example 1:

The following example defines structure that interprets sequence of 8 bytes as FILETIME.

    [StructLayout(LayoutKind.Sequential)]
    [Description("Contains a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).")]
    public class FILETIME
    {
        [Description("The low-order part of the file time.")]
        [Order(1)]  //This filed will be displayed first
        public UInt32 DateTimeLow;
        [Description("The high-order part of the file time.")]
        [Order(2)]  //This field will be displayed as the second
        public UInt32 DateTimeHigh;

        [Order(3)]   //This property will be displayed third
        [Size(0)]    //It doesn't occupy any space since this is alternate view of previous 8 bytes
        public DateTime Value
        {
            get
            {
                long FileTimeAsLong = ((long) UInt32.MaxValue +1) * DateTimeHigh + DateTimeLow; 
                return DateTime.FromFileTime(FileTimeAsLong);
            }
 
        }
        public void Reserved_PopulateWithData(Func<long, long, byte[]> getData, long streamSize, long address)
        {
            //Read all data needed to populate DateTimeLow and DateTimeLow 
            byte[] data = getData(0, 8);
            //Populate DateTimeLow
            DateTimeLow = BitConverter.ToUInt32(data, 0);
            //Populate DateTimeLow
            DateTimeHigh = BitConverter.ToUInt32(data, 4);
        }

Example 2:

The following example defines Rectangle structure with two zero-length properties: Diagonal and Area

[StructLayout(LayoutKind.Sequential)]
   [Description("RECT structure mapping")]
   public class RECT
   {
       [Description("Left (Int32)")]
       [Order(1)]
       public Int32 Left;
       [Description("Top (Int32)")]
       [Order(2)]
       public Int32 Top;
       [Description("Right (Int32)")]
       [Order(3)]
       public Int32 Right;
       [Description("Bottom (Int32)")]
       [Order(4)]
       public Int32 Bottom;
 
       [Description("Diagonal")]
       [Order(5)]
       [Size(0)]
       public double Diagonal
       {
           get 
           {
               return Math.Sqrt(((double)Right-Left)*(Right-Left)+((double)Bottom -Top)*(Bottom-Top));
           }
       }

       [Description("Area")]
       [Order(6)]
       [Size(0)]
       public double Area
       {
           get
           {
               return Math.Abs((Right-Left)*(Bottom -Top));
           }
        }

		

14. Changing Default Settings

With settings dialog you can change some aspects of GUI display.

To start, select Settings... from main toolbar (the wrench icon) or from main menu Tools/Settings.... Meaning of all settings is self-explanatory or could be easy discovered with little experimenting.