polprog, 23.10.2021

Back to homepage

RomView binary image viewer

RomView is a python3 tool that allows you to look at a binary files as images. Example use includes examination of ROM contents, media images, bitmap files etc. Currently only 1bpp depth is supported. The script is targeted mainly at viewing ROM dumps of various kinds as well as media images. RomView can be used both for qualitative (entropy.py) or quantitative (romimage.py) analysis.

These scripts are a must have for anyone doing data preservation of old media or EPROMs

Download

romimage.py v1.0 - this script plots the binary file as 1bpp bitmap to show data patterns like fonts and bitmaps

entropy.py v1.0 - plots a heat map of file's entropy in sectors. Good for qualitative analysis of file contents

Dependencies: matplotlib, numpy, argparse

pip install matplotlib numpy argparse

Run with -h for a summary of options and usage

Examples

romimage

romimage can show bitmap data inside files. It can also be used to quickly verify ROM dumps and image file copies.

For example, here is an image of an EGA card font ROM (left):

The right imahe shows a different video card ROM. You can see that a large part at the end is not used (filled with 1's)

romimage also supports wider word sizes. Below are two screenshots of a video card driver floppy image (showing roughly the same area). These contain two bitmap fonts next to each other - one font is 8 bit wide (left), the other 16 (right). You can set the width (in bytes) with the -w WIDTH option. Notice how the 16-bit font looks when viewed in 8-bit mode.

romimage automatically picks the number of slices (heatmap columns) to make a square image. You can change that behavior by using the -l SLICESB option to specify the number of columns

Use the -g option to enable grid showing where the bytes end. In most cases it's not necesary. Most data meaningfully aligns with byte boundaries as you can see in the previous examples.

Entropy analysis

The entropy script allows for qualitative judgement of file's contents. It shows a heatmap of each sector's entropy. Originally designed to look at floppy disk images, it uses 18 sectors per track to show one track as one heatmap column, and calculates the entropy in 512-byte sectors. Both parameters can be changed from the defaults with command line options.

Entropy of a sector is defined as the number of unique byte values in that sector (or to be preicse, the base-2 logarhitm of that number). The value is expressed in bits per byte. Different kinds of data have different entropy. Empty files (filled with uniform bytes, like 00 or FF) have a near zero entropy - there's only one value in the entire sector. Text files have a slightly higher entropy, as there will be about 110-ish unique values - printable ASCII characters. The highest entropy is for files that contain many unique values. This is typical for compressed, encrypted or random data.

    ** Ballpark entropy values (bits per byte) **
    
    Value        Data type
    -----------------------
    0            Uniform byte fill (empty sector)
    5 - 6        ASCII Text
    6 - 7        Machine code
    close to 8   Compressed or encrypted data
    8            Maximum theoretical value (random data)
  

Below you can see annotated the entropy chart of the Microsoft Office 95 install disk along with the contents of the disk.

Unusual entropy patterns can indicate that a disk has bad sectors or otherwise corrupted data

The entropy script can also be used to look at files other than floppy images. The below image of a x86 Single Board Computer ROM was created by passing -s 32 option to make the heatmap 32 sectors high. You can also pass -z to display files which size is not a multiple of block size and -c BYTES to change the default block size

You can clearly see that this ROM contains a large block of compressed data and then some machine code at the end.

Here's an image of a ROM chip contents that were read as a ROM twice the size. You can see where the data ends and how the entropy reflects that

Summary

Graphical representation is a powerful tool which allows you to quickly analyze large amounts of data. Some information is lost - for example, you cannot read the contents of a text file by looking at it's bitmap image. But you can tell where a repetitive pattern is in such file far quicker than by scrolling in a text editor.

In a similar manner, looking at a ROM hexdump will tell you what kind of program is stored there (if there are any strings). But by looking at an entropy map you will be able to spot regions where there is machine code, strings or other data within several seconds.

A floppy disk image with a corrupted partition table is not readable using standard OS tools, but an entropy map will show if, and where, there is any data.

RomView is not the ultimate tool to solve all problems, but can be a good addition to your toolkit.

Back to homepage