Binary Graph

This program provides a simple way of visualizing the different regions of a binary file.

These are some references that inspired this project:

• Christopher Domas - The future of RE Dynamic Binary Visualization (YouTube).
• Sergey Bratus and Greg Conti - Voyage of the reverser (YouTube).
• Aldo Cortesi - Visualizing binaries with space-filling curves.
• Aldo Cortesi - Visualizing entropy in binary files.

If you are interested in more professional approaches, check out the following links:

• The binvis.io online tool by Aldo Cortesi.
• The mewbak/binary_viewer repository, which also includes some other links.
• The wapiflapi/veles repository, which is no longer maintained.

Building

The program depends on =libpng= for exporting the image. Install it from your package manager.

# Arch-based distros
pacman -S libpng

# Gentoo
emerge media-libs/libpng

Once all the dependencies are installed, compile the program.

git clone https://github.com/8dcc/bin-graph
cd bin-graph
make

If you want to install it on your system, run the following command.

sudo make install

• Usage and modes

There are various different graph modes that determine how the input binary is represented in the output image. The full mode list with their descriptions can be found with the program's =help= command.

bin-graph --help
# Usage:
#   ./bin-graph [OPTION...] INPUT OUTPUT.png
#
# ...

This project also includes a [[file:bin-graph-section.sh][bin-graph-section.sh]] script. It uses =readelf= and =grep= to find the offset and size of the specified region, and uses that as the =--offset-*= arguments for =bin-graph=. Additional options after the section name will be passed to =bin-graph=.

./bin-graph-section.sh SECTION [OPTION...] INPUT OUTPUT.png
# ...

Overview of the code

I tried to make each part of the program as modular and independent as possible, for more maintainability and for easier expansion.

This is the basic process for generating an image from a binary.

1. The arguments are parsed, and the necessary global variables in args.c are overwritten. These will be used from all the sources.
2. The data is read from the input file as a byte array, using the read_file function, defined in read_file.c.
3. The array of bytes is converted into an Image structure, which is just an array of RGB Color structures, along with its dimensions. The program mode (which might have been overwritten with the --mode parameter) determines what image_* function is used. These image_* functions are defined in image.c. For more information on the available modes, see Usage and modes.
4. The Image structure is converted into a PNG file with the image2png function, defined in image.c.