← SkillSafe / Wire Desk

Two frames of hex in. A named field map out.

Paste what you captured — xxd, hexdump -C, od, a Wireshark hex stream, a C byte array, a \x-escaped string — one frame per block. The browser diffs the frames offset by offset, brute-forces thirteen checksum algorithms until one reproduces the bytes in every frame, and verifies the length field, before the model is asked anything. Then you get the fields, a Kaitai spec, a Wireshark dissector and a Python parser.

Both examples ship with a saved model run for both lanes, so you can see the whole answer — including the generated dissector — without signing in and without spending a credit.

nothing pasted yet
Drag files in, or Everything is read in your browser. Nothing uploads until you run.
Paste at least two frames to price the run.

What this does, and what it does not

The prescan is arithmetic. When it says crc16-modbus over bytes 0 to 11 reproduces the last two bytes, it means it computed that CRC over every frame you pasted and compared it with the bytes that are actually there — thirteen algorithms, tried at every plausible field position and over every plausible range, reported only on a clean sweep of the whole capture. The same goes for the length field: every offset, width and endianness is tested against both the whole-frame and the bytes-remaining convention, and a single counter-example kills a candidate. Those are facts, and they are handed to the run as facts it must reconcile one by one.

The hex reader deserves a note, because this is where a naive tool quietly corrupts your capture. In an xxd dump the right-hand column is ASCII, and the ASCII of a frame full of 0x5A bytes reads ZZZZ — which is valid hex. So the gutter is not detected by looking at the characters; it is cut using the dump's own offset labels, where the stride between consecutive lines says exactly how many bytes a line really carries.

It reads. It does not send a packet, it does not touch a device, and it does not execute the dissector or the parser it generates — those are text for you to read before you run them, and each one is scanned for a shell-out, a socket and dynamic execution first. It cannot break encryption: where a region is genuinely ciphertext the armour lane says so and names the pivot instead of pretending. Three frames is a hypothesis, not a specification — the map is only as good as the variation you captured, which is why the answer always ends by telling you what to capture next. A credential that arrives inside a frame is named and flagged for rotation, never repeated.

Nothing to hand? Load the , a length-prefixed telemetry protocol with a real CRC-16/MODBUS trailer, or the , whose payload is a block-aligned high-entropy blob behind a readable header. Both replay saved runs for both lanes, for free.