Hex Editor

You can use a hexadecimal (hex) editor to view the hex representation of a file or a graphic image. One such hex editor is XVI32, developed by Christian Maas and available at no cost at the following URL:

http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm

For example, if there is a certain graphic contained within all confidential company documents, you could use the hex editor to obtain a unique identifier for the graphic, and then use the identifying hex string to create a match object. You could reference the match object in a policy that blocks the transfer of files with content matching that graphic.

Using the SonicWall graphic as an example, you would take the following steps:

1
Start XVI32 and click File > Open to open the graphic image GIF file.

2
In the left pane, mark the first 50 hex character block by selecting Edit > Block <n> chars… and then select the decimal option and type 50 in the space provided. This will mark the first 50 characters in the file, which is sufficient to generate a unique thumbprint for use in a custom match object.

Alternatively you can mark the block by using the following sequence:

•
Click on the first character (#0).
•
Press Ctrl+B.
•
Click on the character in position #49.
•
Press Ctrl+B.

To locate the character in position #49, click on a character in the right pane (the text pane) and then look at the bottom left corner for the decimal address. Try different characters until it shows Adr. dec: 49.

* 
NOTE: You must click on the corresponding location in the left pane before you press Ctrl+B to mark the block.

When the block is marked, it changes to red font. To unmark a block of characters, press Ctrl+U.

3
After you mark the block, click Edit > Clipboard > Copy As Hex String.
4
In Textpad or another text editor, press Ctrl+V to paste the selection and then press Enter to end the line.

This intermediary step is necessary to allow you to remove spaces from the hex string.

5
In Textpad, click Search > Replace to bring up the Replace dialog.
6
Type a space into the Find field and leave the Replace field empty.
7
Click Replace All.

The hex string now has 50 hex characters with no spaces between them.

8
Double-click the hex string to select it, then press Ctrl+C to copy it to the clipboard.
9
In SonicOS, navigate to Firewall > Match Objects.
10
Click Add New Match Object. The Add/Edit Match Object Settings dialog displays.
11
Type a descriptive name into the Object Name field.
12
In the Match Object Type drop-down menu, select Custom Object.
13
For Input Representation, select Hexadecimal.
14
In the Content field, press Ctrl+V to paste the contents of the clipboard.
15
Click Add.

16
Click OK.

You now have a Match Object containing a unique identifier for the image. You can create an App Rules policy to block or log traffic that contains the image matched by this Match Object. For information about creating a policy, see Prerequisites to Configuring App Rules Policies.