The problem

Binary analysis and forensics work usually means switching between a dozen single-purpose tools: a hex editor here, a hashing utility there, a separate cipher cracker, a separate structure parser, often on a machine with no installation rights and definitely no network access. Nothing shares state, so bookmarks, notes and intermediate findings live in a scattered mess of scratch files, and every handoff to a colleague means re-explaining what you found and where.

What I built

A single-page workbench with a real hex editor at its core: virtualised rendering so multi-hundred-megabyte files stay smooth, configurable row width and endianness, in-place patching with reversible history, and a live entropy minimap that pins every search hit, bookmark and diff region. Over twenty tools sit in a side dock around that core, all sharing the same bookmarks, evidence log and hex view, so starting from any one of them (a hash, a suspicious string, an embedded certificate) leads naturally into the others.

It runs entirely client-side: no upload, no telemetry, no account, which matters as much for air-gapped incident response as it does for not wanting a case's raw bytes to leave the building. Every panel is marked solid, partial or heuristic, because a forensics tool that doesn't say when it's guessing is worse than useless.

Engineering decisions

• Shared state over isolated tools: bookmarks, evidence and hashes are visible from every panel, so context never has to be rebuilt when switching tools.
• Virtualised rendering: only what's on screen is rendered, so a 500 MB firmware dump scrolls as smoothly as a 5 KB file.
• Truthful confidence labelling: structural parsers report solid matches, heuristic scanners (like the timestamp finder) are labelled as guesses.
• Portable case export: everything a session produces bundles into one file, so handing a case to a colleague doesn't mean re-explaining it from scratch.

What it demonstrates

Taking a domain full of separate, well-understood single-purpose tools and unifying them around a genuinely shared data model, in the browser, without sacrificing the performance a hex editor needs on large files. It's also a reasonable proxy for how I approach most engineering: find the point where twenty disconnected tools should really have been one connected workbench, then build that instead.

Twenty-plus tools, one workbench