Tool, language and decoders for working with binary data.
Basic usage is
fq . file or
fq d file.
For details see usage.md.
fq is inspired by the well known jq tool and language and allows you to work with binary formats the same way you would using jq. In addition it can present data like a hex viewer, transform, slice and concatenate binary data. It also supports nested formats and has an interactive REPL with auto-completion.
It was originally designed to query, inspect and debug media codecs and containers like mp4, flac, mp3, jpeg. But has since then been extended to support a variety of formats like executables, packet captures (with TCP reassembly) and serialization formats like JSON, YAML, XML, ASN1 BER, Avro, CBOR, protobuf. In addition it also has functions to work with URL:s, convert to/from hex, number bases, search for things etc.
In summary it aims to be jq, hexdump, dd and gdb for files combined into one.
NOTE: fq is still early in development so things might change, be broken or do not make sense. That also means that there is a great opportunity to help out!
aac_frame, adts, adts_frame, amf0, apev2, ar, asn1_ber, av1_ccr, av1_frame, av1_obu, avc_annexb, avc_au, avc_dcr, avc_nalu, avc_pps, avc_sei, avc_sps, avi, avro_ocf, bencode, bitcoin_blkdat, bitcoin_block, bitcoin_script, bitcoin_transaction, bits, bplist, bsd_loopback_frame, bson, bytes, bzip2, cbor, csv, dns, dns_tcp, elf, ether8023_frame, exif, fairplay_spc, flac, flac_frame, flac_metadatablock, flac_metadatablocks, flac_picture, flac_streaminfo, gif, gzip, hevc_annexb, hevc_au, hevc_dcr, hevc_nalu, hevc_pps, hevc_sps, hevc_vps, html, icc_profile, icmp, icmpv6, id3v1, id3v11, id3v2, ipv4_packet, ipv6_packet, jpeg, json, jsonl, macho, macho_fat, markdown, matroska, mp3, mp3_frame, mp3_frame_tags, mp4, mpeg_asc, mpeg_es, mpeg_pes, mpeg_pes_packet, mpeg_spu, mpeg_ts, msgpack, ogg, ogg_page, opus_packet, pcap, pcapng, png, prores_frame, protobuf, protobuf_widevine, pssh_playready, rtmp, sll2_packet, sll_packet, tar, tcp_segment, tiff, toml, udp_datagram, vorbis_comment, vorbis_packet, vp8_frame, vp9_cfm, vp9_frame, vpx_ccr, wasm, wav, webp, xml, yaml, zip
It can also work with some common text formats like URL:s, hex, base64, PEM etc and for some serialization formats like XML, YAML etc it can transform both from and to jq values.
Use one of the methods listed below or download a pre-built release for macOS, Linux or Windows. Unarchive it and move the executable to
On macOS if you don't install using a method below you might have to manually allow the binary to run. This can be done by trying to run the binary, ignore the warning and then go into security preference and allow it. Same can be done with this command:
xattr -d com.apple.quarantine fq && spctl --add fq
brew install wader/tap/fq
sudo port install fq
fq can be installed via scoop.
scoop install fq
pacman -S fq
You can also build and install the development (VCS) package using an AUR helper:
paru -S fq-git
nix-shell -p fq
Use the fq port.
Currently in edge testing but should work fine in stable also.
apk add -X http://dl-cdn.alpinelinux.org/alpine/edge/testing fq
Make sure you have go 1.18 or later installed.
To install directly from git repository (no clone needed) do:
# build and install latest release go install github.com/wader/[email protected] # build and install latest master go install github.com/wader/[email protected] # copy binary to $PATH if needed cp "$(go env GOPATH)/bin/fq" /usr/local/bin
To build, run and test from source:
# build an run go run fq.go # or go run . # just build go build -o fq . # run all tests and build binary make test fq
tshark -T json).
fq is distributed under the terms of the MIT License.
See the LICENSE file for license details.
Licenses of direct dependencies: