Learning objectives
- Move safely between hex text and raw bytes
- Recognize a file signature as a hypothesis, not proof of safety
- Extract printable strings from binary data
- Identify compression layers
- Read a short disassembly without executing code
Station 1: bytes and signatures
Start with Hexadecimal to text to confirm how displayed byte pairs become raw bytes.
Then install Detect a file type from its header. The sample contains a PNG signature and the beginning of an IHDR chunk. Explain why sixteen bytes can identify a likely format but cannot establish that the complete file is valid.
Station 2: printable strings
Install Extract strings from binary bytes. Change the minimum length and compare the amount of noise.
Station 3: compression layers
Compare:
Both end with Gunzip, but their outer representations require different first operations.
Station 4: static disassembly
Install Disassemble benign x86 bytes. The sample is a tiny synthetic function that returns the value 42. Change the selected bitness and note how the interpretation can change.
Assignment
Given an unfamiliar hex listing, write a triage plan before adding operations. Your plan must include signature detection, strings, entropy or compression hypotheses, and a statement that no bytes will be executed.