Structured Binary Inspection: ELF, PNG, & Schemas

ELF32 & ELF64 Inspection

The Bitpeek ELF engine parses Executable and Linkable Format binaries according to the System V ABI specification without running external tools like readelf:

• Class & Data Detection: Reads EI_CLASS (ELF32 vs ELF64) and EI_DATA (Little-Endian vs Big-Endian) from the 16-byte e_ident array.
• ELF Header: Parses object type (e_type), machine architecture (e_machine), entry point (e_entry), and table offsets.
• Section Header Table: Resolves section offsets, sizes, flags, and reads section names directly from the string table (.shstrtab).
• Program Header Table: Parses segments, memory permissions, virtual addresses, and alignment constraints.
• Boundary Safety: Bounds-checks all offsets, arithmetic multiplications, and table counts. Truncated headers trigger structured warnings rather than crashes.

PNG Chunks & CRC-32 Validation

The PNG inspector validates Portable Network Graphics files according to the W3C PNG 3rd Edition specification:

• Signature Verification: Confirms the 8-byte magic sequence: 89 50 4E 47 0D 0A 1A 0A.
• Chunk Hierarchy: Iterates through chunks (IHDR, PLTE, IDAT, IEND, and ancillary chunks), extracting length, type, and data bounds.
• CRC-32 Integrity Checks: Computes the IEEE 802.3 CRC-32 over chunk type and data bytes, comparing it against the stored CRC. Any altered byte triggers an immediate CRC mismatch alert.
• IHDR Field Breakdown: Maps image width, height, bit depth, color type, compression method, filter method, and interlace method to exact byte slices.

Declarative Custom Structure Schemas

Define proprietary binary protocols and file headers using declarative JSON schemas (schema-definition-v1.json):

• Scalar Types: u8, i8, u16, i16, u32, i32, u64, i64, f32, f64.
• Bitfields: Extract specific bit ranges from container integers by defining containerType, lsb, and width.
• Arrays & Strings: Fixed-count arrays, ASCII strings, and raw byte buffers.
• Zero Eval / Safe Execution: Schemas are purely declarative data definitions. No JavaScript code or external network resources are evaluated.

Local processing and privacy

The Structures workflow opens the same Bitpeek browser workspace. Selected file bytes, file names, pasted input, searches, edits, hashes, and comparison data are processed in local browser memory and are not sent to a Bitpeek server.

The static guide itself can be read without opening a file or creating an account.

Frequently asked questions