It's quite easy to create a grammar for a binary file interactively. Simply follow these steps to decode the contents of a PNG image file. (Refer to http://www.w3.org/TR/PNG/ for details)
First, Synalyze It! welcomes you like this:
In most cases you'll first want to open the file to analyze - click Open File and select for example /System/Library/WidgetResources/resize.png. If you didn't disable the suggestion of grammars in the preferences, you're asked if you want to download the existing PNG grammar from the Synalyze It! website:
For this tutorial, say No because you want to create your own PNG grammar. You'll get an ordinary hex view:
You could press Cmd-Shift-N to create a new grammar, but it’s easier to click the Grammar listbox in the toolbar and choose Create Grammar…. A new grammar document will show up and if you click the Grammar Info button in its toolbar you see that all fields are filled for you automatically:
Hint: you can also use this dialog to do translations of UTI, MIME Type, File extension and OSType. Just edit the value you want to translate.
Hit Enter or press OK. If you go back now to your reference document, the hex view should look like this:
The header of PNG files consists of 8 bytes. To add these bytes to your grammar simply select the first 8 bytes in the hex view, Ctrl-click (or right click) the selection and choose Insert/Binary.
The next step is to name and color the new binary structure element you are adding:
The hex view will reflect these changes:
Each chunk of a PNG file consists of a 4-byte length field, a 4-byte chunk name, the data of the chunk and a 4-byte CRC check sum. To add the chunk structure to the grammar, select the 25 (19h) bytes behind the header bytes (8-32), Ctrl-Click the selection and choose Insert/Structure:
Hint: To display the selection start, end and length in decimal numbers, ctrl-click in the table below the hex view and choose All columns / Decimal.
Not to get confused, name the new structure "Chunk" and - if you like - color it using the Color field. Now you can add the elements of the Chunk structure: select the first 4 bytes in the chunk (Length field, bytes 8-11), add them as a Number, the next 4 bytes (chunk Type, 12-15) as a String, bytes 16-28 (chunk Data) as a Structure, and the last 4 bytes (CRC, 29-32) as a Number.
Your grammar should look now like this:
According to the PNG specification the length field takes the number of bytes in the data section of a chunk. As you created the structure elements from the first chunk, the length is set to 13.
To use the value of the length field in the Chunk structure, enter prev.Length in the length field of the Data element:
The length field of the Chunk structure should be cleared now so it will be considered to have variable size. Additionally the Repeat max count should be set to some high number. Now the chunk structure is complete and we can apply it repeatedly to the file:
The whole file should be decoded now:
Wasn't this easy? Even better: the grammar you created can be applied to any PNG file! Check out the sample grammar files to see how the different PNG chunks can be analyzed in detail.