tcpflow VS ImHex

> where: timestamp is an optional timestamp of the time that the first packet was seen

https://github.com/simsong/tcpflow/blob/master/doc/tcpflow.1...

.B t

tcpflow

Mentioning tcpflow here b/c it's one of the most useful networking related tools I know of that very few people even know about.

What does it do?

It can reassemble TCP packets back into the FULL body of the original message sent. e.g. if you make a HTTP GET request, it will show you the full text in a file stamped with the time, source and dest ips and port.

Things I've found it REALLY useful for:

- migrating a data center

- for some reason, connection works fine on the old DC but seems to time out in weird ways in the new DC

- No one can figure it out

- I suggest using tcpflow

- Turn out there was a setting in the new DC network hardware that was truncating larger packets and the authorization message was just over the threshold

People always say "yeah, but Wireshark" which is true, that's a good tool too. That being said, there is just something about seeing the "raw" text of a message sent by a machine over the wire and being able to see it in text from the command line.

https://github.com/simsong/tcpflow

There seems to be an issue open for this https://github.com/simsong/tcpflow/issues/58

ImHex

“A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.”

I actually used it not too long ago to inspect why a mp4 file wasn’t valid. The pattern language that they have is quite nice and having sections of the hex highlighted and being able to see what structures they represent and what data was on those structures was very useful!

https://github.com/WerWolv/ImHex

Just one note: Please use UI scaling; it's near impossible to read on a 150% 4k screen (much less on 100%). Unfortunately, young eyes don't last forever.

The UI looks very much like ImHex (https://imhex.werwolv.net/) is this a coincidence, or is it the standard ImGui look and feel?

I wish ImHex had a decompiler for Z80 as well, but this is much better.

I didn't use RemedyBG or Tracy, but I did try ImHex (https://github.com/WerWolv/ImHex) and it loaded 12% of the CPU because everything is being repainted 60 times per second. Heck, it even has an option to limit the FPS, which solves the CPU load a bit, but at the same time results in sluggish input because the event handling is tied to the drawing frequency.

So yes, the experience was not good, and I don't see what these tools would lose by using a proper GUI. I don't want every utility to drain my laptop battery like a decent video game.

ImGui is great if you already have a loop where everything is unconditionally redrawn every frame, but otherwise it's a really odd choice for an end-user application.

I now use ImHex after looking for years for a good one. It has a pattern language to provide highlighting.

https://imhex.werwolv.net/

ImGui is brilliant. I can highly recommend this hex editor built using it: https://github.com/WerWolv/ImHex

Download a hex editor such as ImHex and open it. I'd recommend downloading the portable version of whatever hex editor you are using if it's offered. That way you don't have to install the program and can instantly delete it off your drive when you're done.

Probably https://github.com/WerWolv/ImHex/pull/509

"It seems from reading the post that the scope of the project is already way too large. This a decades-long project (for a single dev). But most (maybe all) of what's being offered already exists." My googling shows them existing as singular (or a few) features but not in a cohesive package; the "closest" one I could find is https://github.com/WerWolv/ImHex.

If you want a true Hex Editor (or better, Hex IDE), I strongly suggest you to take a look ad ImHex [1].

[1]: https://github.com/WerWolv/ImHex