Just piggybacking here to mention a variety of other "interpret structured binary data" tools. Apparently I collect links to these (:

* fq - like jq for binary data: https://github.com/wader/fq

* Kaitai Struct - https://kaitai.io/

** visualizer, for the above: https://github.com/kaitai-io/kaitai_struct_visualizer/

* HexFiend - a hex editor, but with "binary templates" feature : https://github.com/HexFiend/HexFiend

** binary templates, for the above: https://github.com/HexFiend/HexFiend/blob/master/templates/T...

* binspector - https://github.com/binspector/binspector

* binary-parsing - a collection of links to similar such tools : https://github.com/dloss/binary-parsing

* unblob - https://github.com/onekey-sec/unblob

* ImHex, which you mention

Hey! fq author here. I have a bunch of related tools in the readme https://github.com/wader/fq?tab=readme-ov-file#tools two suggestions: gnu poke and wireshark (can decode lots of more things then just network protocols)

Not free, but I have used 010 Editor for years and it's excellent.

From experience, this is even better than 010Editor , and free

is binwalk still used these days?

binwalk or even strings as your first steps for shaking down a binary is often still very useful before pulling out the big guns

From my experience, yes, it's still quite useful to find embedded formats

Do you know about any protocol deciphering tool?

I'm trying to reverse engineer a kinda simple tcp data stream, and the values are tag-length-value for the most part, and I made a simple mitm proxy that prints known tags and their data values (that I was able to decipher) live, but I am doing the deciphering of known and unknown tags manually, but I was wondering if there is some way to automate this?

I basically would be interested in automatic seen tag tracking, replaying select tags many times to see if they are idempotent, replaying and modifying bytes on a select tag, omitting a select tag and seeing how the client responds.

I guess I could find the socket receive function in the binary and see if the tag values are in a switch or something too but like the original article, it's also new territory for me to read that.

I am just about to expand my mitm proxy with more code to inject/filter packets.

Have you tried Wireshark? It does support Lua templates, although for the initial analysis I would still suggested ImHex

Just coming here to say this. I was reversing a license file for some software so I could play with it yesterday, and I could implement the encryption/decryption code direct in the data processor of imhex, such a time saver.

I have never heard of ImHex before. Thanks, I'll take a look!

Are there tools that help in identifying structures? For example reverse engineering binary file formats like for bnd4, a save game format.

Thanks!