Verifiable Binary Inspection Demonstrations

Demo 1: Systems & Firmware — ELF Header Interpretation

Goal: Inspect a 64-bit Little-Endian ELF executable header and explain how EI_CLASS and EI_DATA govern field offsets.

Input Bytes (Hex):

7F 45 4C 46 02 01 01 00 00 00 00 00 00 00 00 00 02 00 3E 00 01 00 00 00 78 00 40 00 00 00 00 00

Findings:

• Byte 0..4: Magic 7F 45 4C 46 confirms ELF format.
• Byte 4 (EI_CLASS): Value 0x02 indicates 64-bit architecture.
• Byte 5 (EI_DATA): Value 0x01 selects 2's complement little-endian byte ordering.
• Offset 0x10..0x12 (e_type): Value 0x0002 identifies an executable object (ET_EXEC).
• Offset 0x12..0x14 (e_machine): Value 0x003E confirms Advanced Micro Devices x86-64.
• Offset 0x18..0x20 (e_entry): Decoded 64-bit entry address is 0x400078.

Demo 2: Format & Security — PNG IHDR Mutation & CRC Mismatch

Goal: Mutate image height in a synthetic PNG header and observe the resulting CRC-32 checksum mismatch.

Baseline IHDR Bytes: 00 00 00 0D 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1F 15 C4 89

Mutation: Change height at offset 0x0F from 0x01 to 0x02.

Observed Result:

• Height field updates from 1 to 2 pixels.
• Chunk CRC check fails: Expected 0x1F15C489, computed 0x8849E2AF.
• Status badge updates from VALID to PARTIAL with explicit CRC warning.

Demo 3: Protocol Debugging — Synthetic Packet Schema Diff

Goal: Compare two network packet headers using a custom declarative JSON schema to detect flipped flag bits.

Schema Definition: Contains a 16-bit magic, 16-bit length, and an 8-bit flags bitfield with syn (bit 0) and ack (bit 1).

Diff Analysis:

• Packet A flags: 0x01 (SYN=1, ACK=0).
• Packet B flags: 0x03 (SYN=1, ACK=1).
• Bit inspector highlights bit 1 toggled from 0 to 1, cleanly demonstrating protocol state progression.

Demo 4: AI Tooling — MCP Evidence Generation & CLI Verification

Goal: An autonomous AI developer agent reads bytes via MCP and produces an audit evidence report verified against the CLI.

Replay Pipeline:

1. Agent calls bitpeek_open with allowed file path, receiving handle sess_a1b2.
2. Agent calls bitpeek_inspect on range [0, 8), extracting SHA-256 and scalar interpretations.
3. Agent formats finding into a Markdown evidence summary with reproduction steps.
4. Engineer runs bitpeek inspect sample.bin --offset 0 --length 8 --json to verify identical semantic output independently.

Local processing and privacy

The Examples workflow opens the same Bitpeek browser workspace. Selected file bytes, file names, pasted input, searches, edits, hashes, and comparison data are processed in local browser memory and are not sent to a Bitpeek server.

The static guide itself can be read without opening a file or creating an account.

Frequently asked questions