Sigrun

Sigrun is a protocol analysis and reconstruction tool designed to help analysts interpret how binary data forms packets, messages, and higher-level communications. It operates at the protocol layer of the Midgard tool suite, transforming structured binary data into understandable exchanges, transactions, and behaviors.
 
Sigrun enables analysts to examine packetized data through synchronized hex, ASCII, and field-based views, making it possible to identify headers, control fields, addressing information, payload boundaries, and message sequences. The tool supports template overlays, column-based field expansion, and flexible data slicing, allowing users to rapidly test and validate protocol hypotheses.
Built for both standardized and undocumented protocols, Sigrun emphasizes analytic reasoning over automation. Analysts can iteratively define structure, observe repetition and variation across packets, and correlate fields across sessions to determine protocol logic. This disciplined approach enables reliable reconstruction even when formal documentation is unavailable.
 
Sigrun integrates seamlessly with OdinEye and FLOKI, ingesting carved binary data and extending analysis into protocol behavior and application-level meaning. Used in training and operational environments, Sigrun equips analysts to understand what communications are occurring, how they are structured, and why they behave the way they do—completing the end-to-end communications analysis workflow within the Midgard ecosystem.