Two frames of hex in. A named field map out.
Paste what you captured — xxd, hexdump -C, od, a
Wireshark hex stream, a C byte array, a \x-escaped string — one frame per block.
The browser diffs the frames offset by offset, brute-forces thirteen checksum algorithms until
one reproduces the bytes in every frame, and verifies the length field, before the
model is asked anything. Then you get the fields, a Kaitai spec, a Wireshark dissector and a
Python parser.
Both examples ship with a saved model run for both lanes, so you can see the whole answer — including the generated dissector — without signing in and without spending a credit.
What this does, and what it does not
The prescan is arithmetic. When it says crc16-modbus over bytes 0 to 11 reproduces
the last two bytes, it means it computed that CRC over every frame you pasted and compared it
with the bytes that are actually there — thirteen algorithms, tried at every plausible field
position and over every plausible range, reported only on a clean sweep of the whole capture.
The same goes for the length field: every offset, width and endianness is tested against both
the whole-frame and the bytes-remaining convention, and a single counter-example kills a
candidate. Those are facts, and they are handed to the run as facts it must reconcile one by one.
The hex reader deserves a note, because this is where a naive tool quietly corrupts your
capture. In an xxd dump the right-hand column is ASCII, and the ASCII of a frame
full of 0x5A bytes reads ZZZZ — which is valid hex. So the gutter is
not detected by looking at the characters; it is cut using the dump's own offset labels, where
the stride between consecutive lines says exactly how many bytes a line really carries.
It reads. It does not send a packet, it does not touch a device, and it does not execute the dissector or the parser it generates — those are text for you to read before you run them, and each one is scanned for a shell-out, a socket and dynamic execution first. It cannot break encryption: where a region is genuinely ciphertext the armour lane says so and names the pivot instead of pretending. Three frames is a hypothesis, not a specification — the map is only as good as the variation you captured, which is why the answer always ends by telling you what to capture next. A credential that arrives inside a frame is named and flagged for rotation, never repeated.
Nothing to hand? Load the , a length-prefixed telemetry protocol with a real CRC-16/MODBUS trailer, or the , whose payload is a block-aligned high-entropy blob behind a readable header. Both replay saved runs for both lanes, for free.