fq

Tool, language and decoders for working with binary data.

fq is inspired by the well known jq tool and language and allows you to work with binary formats the same way you would using jq. In addition it can present data like a hex viewer, transform, slice and concatenate binary data. It also supports nested formats and has an interactive REPL with auto-completion.

It was originally designed to query, inspect and debug media codecs and containers like mp4, flac, mp3, jpeg. Since then it has been extended to support a variety of formats like executables, packet captures (including TCP reassembly) and serialization formats like JSON, YAML, XML, ASN1 BER, Avro, CBOR, protobuf.

In summary it aims to be jq, hexdump, dd and gdb for files combined into one.

NOTE: fq is still early in development so things might change, be broken or do not make sense. That also means that there is a great opportunity to help out!

Name

The "f" in fq originate from file(1) and format in FFmpeg terminology. I pronounce jq /‘dʒei’kju:/ so I usually pronounce fq /‘ef’kju:/.

Goals

• Make binaries accessible, queryable and sliceable.
• Nested formats and bit-oriented decoding.
• Quick and comfortable CLI tool.
• Bits and bytes transformations.

Hopes

• Make it useful enough that people want to help improve it.
• Inspire people to create similar tools.

Supported formats

aac_frame, adts, adts_frame, amf0, apev2, ar, asn1_ber, av1_ccr, av1_frame, av1_obu, avc_annexb, avc_au, avc_dcr, avc_nalu, avc_pps, avc_sei, avc_sps, avro_ocf, bencode, bitcoin_blkdat, bitcoin_block, bitcoin_script, bitcoin_transaction, bsd_loopback_frame, bson, bzip2, cbor, dns, dns_tcp, elf, ether8023_frame, exif, fairplay_spc, flac, flac_frame, flac_metadatablock, flac_metadatablocks, flac_picture, flac_streaminfo, gif, gzip, hevc_annexb, hevc_au, hevc_dcr, hevc_nalu, hevc_pps, hevc_sps, hevc_vps, icc_profile, icmp, icmpv6, id3v1, id3v11, id3v2, ipv4_packet, ipv6_packet, jpeg, json, macho, matroska, mp3, mp3_frame, mp4, mpeg_asc, mpeg_es, mpeg_pes, mpeg_pes_packet, mpeg_spu, mpeg_ts, msgpack, ogg, ogg_page, opus_packet, pcap, pcapng, png, protobuf, protobuf_widevine, pssh_playready, raw, rtmp, sll2_packet, sll_packet, tar, tcp_segment, tiff, udp_datagram, vorbis_comment, vorbis_packet, vp8_frame, vp9_cfm, vp9_frame, vpx_ccr, wav, webp, xing, zip

Other non-binary formats

Can go to/from XML, JSON, jq-flavored JSON, YAML, TOML, CSV, URLs, hex string, base64, string encodings etc.

For details see formats.md and usage.md.

Usage

Basic usage is fq . file.

For details see usage.md

Presentations

• "fq - jq for binary formats" at Binary Tools Summit 2022 - video - slides

Install

Use one of the methods listed below or download release for your platform. Unarchive it and move the executable to PATH etc.

On macOS if you don't install using a method below you might have to manually allow the binary to run. This can be done by trying to run the binary, ignore the warning and then go into security preference and allow it. Or you can run this command:

xattr -d com.apple.quarantine fq && spctl --add fq

Homebrew

# install latest release
brew install wader/tap/fq

MacPorts

On macOS, fq can also be installed via MacPorts. More details here.

sudo port install fq

Windows

fq can be installed via scoop.

scoop install fq

Arch Linux

fq can be installed from the community repository using pacman:

pacman -S fq

You can also build and install the development (VCS) package using an AUR helper:

paru -S fq-git

Nix

nix-shell -p fq

FreeBSD

Use the fq port.

Alpine

Currently in edge testing but should work fine in stable also.

apk add -X http://dl-cdn.alpinelinux.org/alpine/edge/testing fq

Build from source

Make sure you have go 1.18 or later installed.

To install directly from git repository do:

# build and install latest release
go install github.com/wader/fq@latest

# or build and install latest master
go install github.com/wader/fq@master

# copy binary to $PATH if needed
cp "$(go env GOPATH)/bin/fq" /usr/local/bin

To run and run tests from source directory:

# run all tests and build binary
make test fq
# it's also possible to use go run
go run fq.go

TODO and ideas

See TODO.md

Development and adding a new decoder

See dev.md

Thanks and related projects

This project would not have been possible without itchyny's jq implementation gojq. I also want to thank HexFiend for inspiration and ideas and stedolan for inventing the jq language.

Similar or related projects

• HexFiend Hex editor for macOS with format template support.
• binspector Binary format analysis tool with query langauge and REPL.
• kaitai Declarative binary format parsing.
• Wireshark Decodes network traffic (tip: tshark -T json).
• MediaInfo Analyze media files (tip mediainfo --Output=JSON and mediainfo --Details=1).
• GNU poke The extensible editor for structured binary data.
• ffmpeg/ffprobe Powerful media libraries and tools.
• hexdump Hex viewer tool.
• hex Interactive hex viewer with format support via lua.
• hachoir General python library for working binary data.
• scapy Decode/Encode formats, focus on network protocols.

License

fq is distributed under the terms of the MIT License.

See the LICENSE file for license details.

Licenses of direct dependencies:

• Forked version of gojq https://github.com/itchyny/gojq/blob/main/LICENSE (MIT)
• Forked version of readline https://github.com/chzyer/readline/blob/master/LICENSE (MIT)
• gopacket https://github.com/google/gopacket/blob/master/LICENSE (BSD)
• mapstructure https://github.com/mitchellh/mapstructure/blob/master/LICENSE (MIT)
• copystructure https://github.com/mitchellh/copystructure/blob/master/LICENSE (MIT)
• go-difflib https://github.com/pmezard/go-difflib/blob/master/LICENSE (BSD)
• golang/x/* https://github.com/golang/text/blob/master/LICENSE (BSD)
• golang/snappy https://github.com/golang/snappy/blob/master/LICENSE (BSD)
• github.com/BurntSushi/toml https://github.com/BurntSushi/toml/blob/master/COPYING (MIT)
• gopkg.in/yaml.v3 https://github.com/go-yaml/yaml/blob/v3/LICENSE (MIT)