Quickstart Guide for Binary Inspection

Task 1: Inspecting an Unknown File Header

When investigating an unfamiliar binary blob, determining its signature and initial header fields is the first step:

1. Open the Bitpeek workbench and click Open to select a binary file, or paste hex bytes into the input box.
2. Observe the Interpretation Panel on the right. Bitpeek immediately displays detected file signatures (e.g. ELF, PNG, ZIP).
3. Select the first 4 bytes (offset 0x00..0x04). Review the 32-bit unsigned integer values displayed in both Little-Endian and Big-Endian format.
4. If the file is an ELF or PNG, the Structure panel automatically parses header fields. Click any field (such as e_type or IHDR.width) to highlight its exact byte coordinates in the hex grid.

Task 2: Searching with Hex Wildcards & String Scans

Locating specific opcodes or memory patterns often requires wildcard searches:

1. Press Ctrl+F (or Cmd+F) to focus the byte search input.
2. Select Hex mode and type a wildcard pattern such as DE ?? BE EF. Bitpeek finds matches where the second byte can be any value.
3. Use the navigation arrows to jump between match offsets in the byte table.
4. Click Strings in the toolbar to scan for printable ASCII and UTF-16 strings with their exact file offsets. Selecting any string navigates directly to those bytes.

Task 3: Comparing Two Binaries and Exporting a Verified Patch

Compare an edited file against an original baseline and generate a verifiable patch:

1. Load your current working binary into the workbench.
2. Click Compare in the input toolbar and select the baseline reference binary.
3. The DiffBar displays the count of modified bytes and ranges. Use the arrow buttons to step through each differing offset.
4. Click Download patch to export an atomic .bitpeek.patch.json file containing SHA-256 hashes and byte preconditions.

Local processing and privacy

The Quickstart workflow opens the same Bitpeek browser workspace. Selected file bytes, file names, pasted input, searches, edits, hashes, and comparison data are processed in local browser memory and are not sent to a Bitpeek server.

The static guide itself can be read without opening a file or creating an account.

Frequently asked questions