Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

I have got a file which contains other files. I know where the subfiles start (header) but how do i know where the subfiles end?

thanks in advance

edit: Files like: sound files (.wav) and images (.bmp, png, jpeg)

Example:

file1
file2
data
file3

How do i know where file2 starts and file2 ends

share|improve this question
    
Do you know the file types? You haven't given us much information, try to modify your question with more info. –  0xea May 2 at 18:13
    
Checkout binwalk. –  caffinatedmonkey May 2 at 21:04

2 Answers 2

up vote 3 down vote accepted

Technically speaking what you're describing is an archive. If the archiving data structure was properly designed, in the header you must find either the start offset & the size or the start & end offsets of each file entry in the header, unless the files are all stored one after the other. In that latter case all you need to know is the start offset of each file because (suppose file0 comes first, followed by file1) file1's start offset is file0's end offset.

The example below shows the latter case :

  Offset00:file0
  Offset10:file1
  Offset30:file2
  Offset35:file3
share|improve this answer

In addition to what yaspr said, i'd suggest looking for specification of those contained files. Most file formats have their size specified in the header somewhere. That would allow you to carve the file from the archive, without even knowing the archive structure.

This is what tools like scalpel are doing to carve files. They match the header to a known file type, and then lookup the file size in that header. Some file formats have specific endings which you could also use to carve them out (for example, every png file has IEND and the end).

Try your luck with scalpel and similar file carving tools.

share|improve this answer
    
WAV (a RIFF format), BMP, and PNG have sufficient information in their headers to do just this. (Does JPEG as well? I believe it does not.) Anyway, knowing the supposed file size ties nicely in to yaspr's answer of how and where to locate the archive's own metadata. –  Jongware May 2 at 22:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.