Hachoir is a Python library used to represent of a binary file as a tree of Python objects. Each object has a type, a value, an address, etc. The goal is to be able to know the meaning of each bit in a file.

Why using slow Python code instead of fast hardcoded C code? Hachoir has many interresting features: * Autofix: Hachoir is able to open invalid / truncated files * Lazy: Open a file is very fast since no information is read from file, data are read and/or computed when the user ask for it * Types: Hachoir has many predefined field types (integer, bit, string, etc.) and supports string with charset (ISO-8859-1, UTF-8, UTF-16, ...) * Addresses and sizes are stored in bit, so flags are stored as classic fields * Endian: You have to set endian once, and then number are converted in the right endian * Editor: Using Hachoir representation of data, you can edit, insert, remove data and then save in a new file.

hachoir-metadata extracts metadata from multimedia files: music, picture, video, but also archives. It supports most common file formats: * Archives: bzip2, gzip, zip, tar * Audio: MPEG audio ("MP3"), WAV, Sun/NeXT audio, Ogg/Vorbis (OGG), MIDI, AIFF, AIFC, Real audio (RA) * Image: BMP, CUR, EMF, ICO, GIF, JPEG, PCX, PNG, TGA, TIFF, WMF, XCF * Video: ASF format (WMV video), AVI, Matroska (MKV), Quicktime (MOV), Ogg/Theora, Real media (RM)

It tries to give the more informations as possible. For some file formats, it gives really more informations then libextractor for example. RIFF parser is really good for example, it can extract creation date, software used to generate the file, etc. But hachoir-metadata can not guess informations. The most complex operation is just to compute duration of a music using frame size and file size.

hachoir-metadata has three modes: * classic mode: extract metadata, you can use --level=LEVEL to limit quantity of information to display (and not to extract) * --type: show on one line the file format and most important informations * --mime: just display file MIME type

The command 'hachoir-metadata --mime' works like 'file --mime', and 'hachoir-metadata --type' like 'file'. But today file command supports more file formats then hachoir-metadata.

hachoir-parser is a package of most common file format parsers written for Hachoir framework. Not all parsers are complete, some are very good and other are poor: only parser first level of the tree for example.

A perfect parser have no "raw" field: with a perfect parser you are able to know *each* bit meaning. Some good (but not perfect ;-)) parsers: * Matroska video * Microsoft RIFF (AVI video, WAV audio, CDA file) * PNG picture * TAR and ZIP archive

hachoir-regex is a Python library for regular expression (regex or regexp) manipulation. You can use a|b (or) and a+b (and) operators. Expressions are optimized during the construction: merge ranges, simplify repetitions, etc. It also contains a class for pattern matching allowing to search multiple strings and regex at the same time.

hachoir-subfile is a tool based on hachoir-parser to find subfiles in any binary stream.