Skip to main content
Commonmark migration
Source Link

Problem Statement

#Problem Statement# II have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

Specifics

#Specifics# II have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct my_struct {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

#Question#

Question

Is there a tool that enables static analysis of flat data structure files?

#What I've considered thus far as a solution#

What I've considered thus far as a solution

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

Where I have already researched

#Where I have already researched# GoogledGoogled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

Results

#Results# ThereThere are three completely valid and correct answers, but I've marked the most detailed and least expensive of them as correct, because it is the most accessible to members of the community reviewing this question.

#Problem Statement# I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

#Specifics# I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct my_struct {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

#Question#

Is there a tool that enables static analysis of flat data structure files?

#What I've considered thus far as a solution#

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

#Where I have already researched# Googled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

#Results# There are three completely valid and correct answers, but I've marked the most detailed and least expensive of them as correct, because it is the most accessible to members of the community reviewing this question.

Problem Statement

I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

Specifics

I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct my_struct {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

Question

Is there a tool that enables static analysis of flat data structure files?

What I've considered thus far as a solution

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

Where I have already researched

Googled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

Results

There are three completely valid and correct answers, but I've marked the most detailed and least expensive of them as correct, because it is the most accessible to members of the community reviewing this question.

Added justification of answer selection
Source Link
gal
  • 335
  • 1
  • 2
  • 7

#Problem Statement# I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

#Specifics# I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct my_struct {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

#Question#

Is there a tool that enables static analysis of flat data structure files?

#What I've considered thus far as a solution#

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

#Where I have already researched# Googled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

#Results# There are three completely valid and correct answers, but I've marked the most detailed and least expensive of them as correct, because it is the most accessible to members of the community reviewing this question.

#Problem Statement# I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

#Specifics# I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct my_struct {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

#Question#

Is there a tool that enables static analysis of flat data structure files?

#What I've considered thus far as a solution#

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

#Where I have already researched# Googled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

#Problem Statement# I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

#Specifics# I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct my_struct {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

#Question#

Is there a tool that enables static analysis of flat data structure files?

#What I've considered thus far as a solution#

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

#Where I have already researched# Googled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

#Results# There are three completely valid and correct answers, but I've marked the most detailed and least expensive of them as correct, because it is the most accessible to members of the community reviewing this question.

#Problem Statement# I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

#Specifics# I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct headermy_struct {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

#Question#

Is there a tool that enables static analysis of flat data structure files?

#What I've considered thus far as a solution#

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

#Where I have already researched# Googled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

#Problem Statement# I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

#Specifics# I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct header {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

#Question#

Is there a tool that enables static analysis of flat data structure files?

#What I've considered thus far as a solution#

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

#Where I have already researched# Googled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

#Problem Statement# I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.

e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)

#Specifics# I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:

struct my_struct {
uint_32 magic
} // sizeof(my_struct) == 0x04

In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer

#Question#

Is there a tool that enables static analysis of flat data structure files?

#What I've considered thus far as a solution#

I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.

#Where I have already researched# Googled 'reverse engineering tools' and browsed the links

Checked wikipedia's reverse engineering pages

Tried some first principles reasoning

Checked pypi

Tweeted twitter.com/#!/StackReverseEng/status/425164045386526720
Source Link
gal
  • 335
  • 1
  • 2
  • 7
Loading