Oh, glory of glories ("http://www.snpp.com/episodes/3F04.html"). Oh heavenly testament to the eternal majesty of God’s creation.

ridiculous_fish ("http://ridiculousfish.com/hexfiend/") opened the code for HexFiend, our favorite OS X hex editor ("http://www.matasano.com/log/445/hallelujah-hexfiend-11-ends-my-os-x-hex-editor-grail-quest/"). HexFiend is fast, well-designed, and handles hugefiles. There’s a developer wiki ("http://ridiculousfish.com/hexfiend/docs/wiki/Developers/Overview"); the page on how HexFiend saves large files ("http://ridiculousfish.com/hexfiend/docs/wiki/Developers/FileSaving")is good reading even if you don’t plan on hacking on OS X hexeditors.

Several weeks ago I posted my wish list for an ideal hex editor ("http://www.matasano.com/log/455/in-which-i-dream-of-the-perfect-hex-editor/"). Now that the “writing a hex editor” obstacle has been cleared from ourpath, less talk, more action!

The feature I want most: show me the IP address that corresponds tothe bytes I’ve got selected in the editor. HexFiend already has aninspector that shows the 32 bit LE/BE value I’ve selected, so thatshould be easy. Let’s open the Xcode project and see how far I can getbecore the vendor I’m waiting on calls me back.

Uh, I’m somewhere where I don’t know where I am!

Yeah, so, I’m really not a Cocoa developer. Constructive criticismwould be peachy. That said, here’s what I did:

Find the model code for the Inspector widget. It loops over a list of fields defined in the header file on a “reloadFields”event thingy. Add a field, and an IBOutlet instance member,for IPv4 address.

http://www.matasano.com/log/wp-content/uploads/2006/12/scr-fbrowse.png
Find the NIB file that includes the Inspector. It’s in MainMenu. Crack it open. Click aimlessly around the Inspector trying to find how widgets connect to model classes. Copy the “32 bit integer” fields to create an “IPv4 address” field.

http://www.matasano.com/log/wp-content/uploads/2006/12/scr-inspect.png
Find the top-secret “outline view” for class instances thatshows outlets and connections. This took me more time thanany other step. Control-drag from my new IPv4 field in theInspector to the model class. Connect the outlet.

http://www.matasano.com/log/wp-content/uploads/2006/12/scr-connect.png
Write the 15 lines of C code to turn a 32 bit integer into a string IP address. I lost more time trying to figure out how to make a C-string into an NSString than anything else.
“Build and go”. Oops, got the endianness wrong; addressesare backwards. Fix. “Build and go”. Yay, HexFiend printsIP addresses now! I’m a real Cocoa developer.

http://www.matasano.com/log/wp-content/uploads/2006/12/scr-final.png

What have we learned?

HexFiend’s code is clean, simple, and straightforward enough for a Cocoa novice to add features to it while on telephone hold.
HexFiend uses a dependency graph and topological sort to savebyte ranges to files. I don’t know that you care about that, but it’s fun to say.
To connect UI widgets you draw in Interface Builder to Objective C classes, locate the secret “outline view” buttonunder “Instances”, and control-drag from your UI element to a class with an appropriate Outlet.
To convert a c-string to NSString, use NSString::stringWithCString:encoding.
Objective C is incredibly verbose.

You can download my (trivial) patches here ("http://rapidshare.com/files/6204442/HexFiend-ipv4.tar.gz.html"). More to come. We need toembed an interpreter into HexFiend and make it Emacs for Reversing.



http://www.matasano.com/log/637/ridiculous_fish-open-sources-hexfiend/