Kaitai Struct: A Tool For Dealing With Binary Formats

The speakers introduce Kaitai Struct, an open-source declarative language for describing binary formats. They trace its origins to reverse engineering undocumented protocols from packet captures, where each hypothesis about a byte had to be checked against thousands of samples. Moving from ad hoc scripts in one language to another led to a single format description that could drive code in many languages.

The talk covers how a format specification is compiled into ready-made parsers, currently for twelve languages, with serializers for Python and Java. Other uses include building reference parsers to check hand-written code, guiding fuzzers with a clean implementation, and sharing one format definition between back end and front end teams. A community library of about 185 format specifications was mentioned, along with auto-generated diagrams for explaining formats to colleagues.

The second speaker demonstrates the browser-based web IDE using the GIF format. The header, logical screen descriptor and global color table are defined step by step, with derived fields extracted from bit flags, and the parsed object tree updates as the specification changes. The demo ends by exporting the result to JSON and generating Python parser code. In the Q&A, the limits were discussed: the tool stops at the first malformed structure, a proposal for scanning damaged data is still unfinished, and most language implementations stream large files rather than loading them into memory.