Reply to comment

bindump

Everybody knowns that computers works only with 0 and 1... and a bit of entropy that makes everything bizarre (-:
But when you see a video or an image, when you hear music or surf the net it is strange to think that it's all 0 and 1, isn't it?
Well, now you can see all files in binary mode with bindump.

To show how bindump works I use first a text file and then a bmp image of Lena:

Lena

Text file name is test.txt

eddy22@sophia:~/myprog/bindump$ cat test.txt 
this is a test
questa è una prova
eddy22@sophia:~/myprog/bindump$ ./bindump test.txt 
00000000 01110100 01101000 01101001 01110011 00100000 01101001 01110011 00100000 this is 
00000008 01100001 00100000 01110100 01100101 01110011 01110100 00001010 01110001 a test.q
00000016 01110101 01100101 01110011 01110100 01100001 00100000 11000011 10101000 uesta ..
00000024 00100000 01110101 01101110 01100001 00100000 01110000 01110010 01101111  una pro
00000032 01110110 01100001 00001010                                              va.

I'd like you look at è character (in second line). This character is expressed as 11000011 10101000 (2 bytes) because I use UTF-8... It isn't a mistake (-:

Now I analyse the BMP file:

eddy22@sophia:~/myprog/bindump$ ./bindump lena.bmp
00000000 01000010 01001101 00110110 00000000 00001100 00000000 00000000 00000000 BM6.....
00000008 00000000 00000000 00110110 00000000 00000000 00000000 00101000 00000000 ..6...(.
00000016 00000000 00000000 00000000 00000010 00000000 00000000 00000000 00000010 ........
00000024 00000000 00000000 00000001 00000000 00011000 00000000 00000000 00000000 ........
00000032 00000000 00000000 00000000 00000000 00001100 00000000 11001110 00001110 ........
00000040 00000000 00000000 11011000 00001110 00000000 00000000 00000000 00000000 ........
00000048 00000000 00000000 00000000 00000000 00000000 00000000 00110111 01010001 ......7Q
00000056 10011110 00111110 01011000 10100101 00111110 01011010 10100111 01001010 .>X.>Z.J
00000064 01100110 10110011 01010010 01110000 10111101 01010010 01110010 10111110 f.Rp.Rr.
[...]

What does it means? Take a look at BMP file format. We can see that BMP file header is composed by the first 2 bytes user for magic number, then 4 bytes for BMP file size, 2 bytes + 2 bytes reserved and the last 4 bytes for offset.

I start to analyze the first 2 bytes:

eddy22@sophia:~$ echo 'obase=16; ibase=2; 0100001001001101' | bc
424D

Well, as we can see even in printable character section (the last output's column) the file began with the bitmap format magic number (the 0x42 0x4D hex code points for B and M).

I go on with file size (remember that the integer value is stored in little-endian byte order, contrarily on BMP file format which is in big-endian!!!)

eddy22@sophia:~/myprog/bindump$ echo 'ibase=2; 00000000000011000000000000110110' | bc
786486
eddy22@sophia:~/myprog/bindump$ du -b lena.bmp 
786486	lena.bmp

Oh... it works (-:
Then we have the 2 + 2 reserved bytes (all 0) and the offset:

eddy22@sophia:~/myprog/bindump$ echo 'ibase=2; 00110110' | bc
54

Ok, the bitmap data begans from 54th bytes... but in the middle?
Between bitmap header and bitmap data there is bitmap info header with these fields (from my bmp.h):

[...]
typedef struct _BMPInfoHeader {
        DWord HeaderSize;
        DWord ImageWidth;
        DWord ImageHeight;
        Word NumberOfImagePlanes;
        Word BitsPerPixel;
        DWord CompressionMethod;
        DWord SizeOfBitmap;
        DWord HorizontalResolution;
        DWord VerticalResolution;
        DWord NumberOfColorsUsed;
        DWord NumberOfSignificantColors;
} BMPInfoHeader;
[...]

DWord = 4 bytes and Word = 2 bytes. So it's simple to obtain the width and height for an image:

eddy22@sophia:~/myprog/bindump$ echo 'ibase=2; 00000000000000000000001000000000' | bc
512

and so on...

Just a little check: 14 bytes (for BMP header) + 40 bytes (for BMP Info Header) = 54 bytes that is the value of offset calculated before.

Shortly, I know that all these analysis could be done with hexdump... but it's so c00l to view the file in binary mode (-:

Reply

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Image CAPTCHA
Enter the characters shown in the image.