1

I am using a 3rd party software that stores templates for ID cards in a database. I believe the templates are in xml format but are encrypted / encoded / compressed in the database.

Each encoded template has the same header at the beginning of the file:

A9 CD AA F5 AE 36 04 2F 04 2A A5 2F CE EF B0 83 C4 97 F7 CA 26 F7 28 ED F8 C3 26 F4 57 D5 CB EA 36 10 F9 9B A6 CE F2 67 6B 47 B9 16 6E A7 41 14 A2 CD 99 88 51 17 67 03 C0 C4 66 18 D6 2A 1F D2 DD 5F 24 83 14 87 96 35 90 B6 70 F1 E6 51 BD 7A AB 41 86 E8 4D F4 E0 B7 D4 0A 22 DA 26 BD 54 D4 DE D1 23 36 BE D8 C8 D9 EC D8 5B 0E 0B 1D BE D8 A3 BD B7 E4 37 40 EB 86 76 85 E5 F7 15 87 EB 47

Is there a way of finding out / does any one recognise this file format?

The file may be some kind of archive containing images and xml files.

Sample files uploaded here:

Empty Template: Here

Actual template with image (png format): Here

Improve this question

1 Answer 1

Reset to default
4

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed.

The header in the file could be a lot of things, but it doesn't have any known magic bytes at the beginning and doesn't appear to belong to any commonly known file type.

Your best bet with getting anywhere is to reverse engineer the software that reads these files. Try finding the routine that decrypts the file in memory and either try to identify which algorithm it's using or recreate the routine in a higher level language (if that's your goal). You'll also need to figure out what the decryption key is for the file (hell, it could even be the header they put in every file - but don't hold your breath) which you should be able to determine while reverse engineering the software.

Keep in mind that many commercial software packages have an EULA that explicitly forbids you from reverse engineering the software in any way which paves the way for legal recourse if you get caught and the software creators decide to pursue it.

Good Luck!

Improve this answer
2
  • Thanks @Gogeta. I'll have a look at again the program itself.
    – Gavin
    Commented Dec 14, 2016 at 20:59
  • Found a key and iv a dll linked to the program. Wish I knew what to do with it...
    – Gavin
    Commented Dec 16, 2016 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.