Releases: warpedatom/OffsetInspect
OffsetInspect V1.0.1 - Multi-File Capability + Review-Driven Refinement
What is new - V1.0.1
This release combines functional upgrades and review-driven improvements from both a contributor and Sorcery-AI feedback.
Added
- Multi-file inspection support
FilePathsnow accepts multiple targetsOffsetInputsaccepts matching offsets- Runs sequentially and outputs independent blocks per file
Changed
-Enforced one or 1:1 mapping between FilePaths and OffsetInputs
- Single offset may be reused (explicitly noted); otherwise, lengths must match
- Centralized offset parsing via new
Parse-Offsethelper - Improved validation and error messaging
CI / Automation-Friendly
- Added non-zero exit code behavior when failures occur, enabling pipeline detection
$script:hadErrorflags tracks processing errors across multiple files
Documentation
- README updated with new usage examples
- Typo fix ("multiple")
Source
See commit history for details
Thank you for supporting DreadHost tooling
What's Changed
- feat: Add multiple files inspect option by @secretlay3r in #1
New Contributors
- @secretlay3r made their first contribution in #1
Full Changelog: V1.0.0...V1.0.1
OffsetInspect v1.0.0
OffsetInspect v1.0.0 — Initial Public Release
Overview
OffsetInspect is a PowerShell-based PE and file-offset inspection utility designed for red team operators, malware analysts, reverse engineers, and researchers who require byte-level insight into file structures.
This release provides the full operational script along with documentation, example output, and integrity verification. OffsetInspect offers a fast, terminal-friendly workflow for analyzing offsets, displaying structured hex/ASCII data, and linking raw byte positions back to file line numbers.
Features
Hex + ASCII Rendering
- HxD-style offset formatting
- 16-byte aligned rows
- ASCII interpretation column
- Printable-character detection
Offset Highlighting
- Highlights the exact byte at the user-specified offset
- Caret indicator showing position in the source line
- Supports hex (
0xE1AB1) and decimal formats
Context Window
- Configurable byte-window around target offsets
- Useful for PE analysis, obfuscated blocks, and binary payload inspection
Line Number Resolution
- Maps raw byte offsets to actual file line numbers
- Ideal for debugging script-based payloads and encoded data
Included in This Release
| File | Description |
|---|---|
OffsetInspect.ps1 |
Main inspection script |
README.md |
Documentation and usage examples |
LICENSE |
MIT license |
OffsetInspectScreen.png |
Screenshot demonstrating output |
CHANGELOG.md |
Version history |
CONTRIBUTING.md |
Contribution guidelines |
SECURITY.md |
Security reporting policy |
module/OffsetInspect.psm1 |
Importable module wrapper |
Basic Usage
Hex Offset
.\OffsetInspect.ps1 C:\AD\PowerView.ps1 0xE1AB1Decimal Offset
.\OffsetInspect.ps1 payload.bin 1024Expanded Context Window
.\OffsetInspect.ps1 file.bin 0x200 -ByteWindow 64SHA-256 Integrity Verification
File: OffsetInspect.ps1
sha256:23a42c592181dbba516a38348aaa4387ef9717b766e517924db6c248c2515891Verify on your system:
Get-FileHash -Algorithm SHA256 .\OffsetInspect.ps1Supported Platforms
- Windows 10 / 11
- Windows Server 2016 / 2019 / 2022
- PowerShell 5.1
- PowerShell 7.x
Changelog Summary
Please take a look at CHANGELOG.md for complete details.
Intended Use Cases
- Red team operations
- Malware reverse engineering
- Payload debugging
- Inspecting PE, shellcode, PowerShell, or encoded data
- Forensic reconstruction and analysis
Licensing
MIT License. Attribution appreciated but not required.
Verification and Security Notes
- Always verify SHA-256 checksums before use
- Do not use this tool in unauthorized environments
- Suitable for sanctioned testing and research only