Data Interpreter

WinHex & X-Ways

Data Interpreter

 

The Data Interpreter is a small window that offers possible translations for the data at the current cursor position. Whether it is shown or not can be controlled via the View menu, not with the options of the data interpreter. Contrary to popular belief among some users, it totally disregards any block if selected and always interprets from the byte where the cursor is. The Data Interpreter Options dialog lets you specify the data types to interpret. These are various integer data types (by default in decimal notation, optionally hexadecimal or octal),  the binary format (8, 16 or 32 bits of a byte), four floating-point data types, assembler opcodes (Intel), and date types.

 

The Data Interpreter can interpret UNIX/C, Java/BlackBerry/Android and Mac Absolute timestamps stored as decimal ASCII text instead of in binary. You will find a context menu item for that as well as a checkbox in the options dialog. The Data Interpreter optionally translates timestamps of all formats except MS-DOS date & time to local time (the time zone defined in the General Options). You will find a context menu item for that as well as a checkbox in the option dialog.

 

The Data Interpreter is also capable of translating most data types back into hex values. Make sure a file is open in an edit mode other than read-only mode, enter a new value in the Data Interpreter, and press ENTER. The Data Interpreter will then enter the corresponding hex values into the edit window at the current cursor position.

 

Right-click the data interpreter to bring up a context menu. This will let you switch between big-endian and little-endian translation of integer and floating-point data. You may also choose between decimal, octal, or hexadecimal integer representation. See the Data Interpreter Options for more settings.

 

The decomposition of V1 GUIDs into timestamp, sequence number and MAC address in the Data Interpreter as well as in templates is optional. In the Data Interpreter options you can now choose to force the decomposition (fully checked) or prevent it (to always get the standard GUID notation with braces) or to see the decomposition only if the timestamp is not too implausible (half checked). The latter setting is helpful for example for Apple GPT values that claim to be V1 GUIDs, but contain twisted ASCII text instead of valid timestamps.

 

Hints:

 

Some hex values cannot be translated into floating-point numbers. For these hex values the Data Interpreter displays NAN (not a number).

 

Some hex values cannot be translated into valid dates. The value ranges of different date types are more or less narrow.

 

There are redundancies in the Intel instruction set, which show up in the Data Interpreter as duplication of both hex opcodes and mnemonics. Floating-point instructions are generally displayed as F***. More detailed reference can be found in the Intel Architecture Software Developer’s Manual Volume 2: Instruction Set Reference, available in PDF format on the Internet.