The controls on this page let you define fields in specific groups of binary files.
The list contains all the fields for a file type. In the Binary Comparisons options panel, you will be able to enable or disable them by role using checkboxes. The New and Edit buttons open the Field details dialog box. Use the Remove button to delete a field from the list.
Each field contains the following information:
Dynamic field are defined in a script you can edit just
below the fields list. The PE File format is provided in
the factory-file-types directory of the installation (as
ms-executable.ecmft), this is a good sample of how to write
such a script to define dynamic fields ranges.
The target of the script is to fill a collection
dynamic_fields
from the
content
object which represents the content of the
dinary file. Here is a basic example of what is
expected:
var timestamp_field = new BinaryDocument.Field;
timestamp_field.name = "Header Time";
timestamp_field.role = "Timestamp";
// let's imagine the location of
the timestamp field is stored at offset 16
// in the file as a 32 bit offset itself (in a
little endian unsigned int)
timestamp_field.start = content.read_number (16,
4, 'little', 'uint');
timestamp_field.length = 8; // 8 bytes for a 64
bits timestamp
dynamic_fields.push (timestamp_field);
See also