2

Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, could be 2 floats or 1 double or just anything else. I feel like that would be a situation that occurred extremely often to every reverse engineer.

So my question is: Is there a commonly used approach for that kind of problem? Most likely a command line tool that takes the array and displays it in all the different possible representations? Or do people just rely on the given representations of the programs they currently use (ollydbg, cheat engine, hex editor or what ever they happen to use)?

Improve this question
3
  • 2
    it would depend on context, with the starting 'C' and ending 'F's it kind of looks like a double. it's value would be: -40195039.24999999. usually double's don't come alone, so seeing several similar looking values will give you a hint as will. and they would be used by floating point instructions.
    – Willem Hengeveld
    Oct 6, 2017 at 21:05
  • 4
    where did you find these bytes ? in a washed-up bottle? saw it in a dream? There is always some context to "unknown" data.
    – Igor Skochinsky ♦
    Oct 6, 2017 at 22:50
  • Please keep in mind that the question was not meant to be about this specific data ("just an example"). So I guess what you are trying to do is to address this specific example so that I can get an impression of the general concept. Is that right? Your general approach would be to narrow the possibilities by taking in the context? In that case, let's say it's the first 8 bytes of a resource file of unknown type.
    – Matmarbon
    Oct 7, 2017 at 10:08

1 Answer 1

Reset to default
4

The problem being addressed here is commonly called the semantic gap.

If you stumble across any binary snippet like the one you posted, it's nearly impossible to deduce the way the value is meant to be interpreted, unless you find code interpreting this value in any way (e.g. a file loader using this value as an offset, ...).

The main problem is that you can come up with countless ways of interpretation for this value. Maybe these are just flags. Maybe it's meant to be disassembled for PowerPC. Maybe it's the score variable in a Pacman game. You can try to deduce the meaning by interpreting it in numerous ways, but often that won't cut it.

enter image description here

Improve this answer
2
  • Thank you, I really appreciate that :) Though I hoped for an answer that is less oriented on the problem and more on the common handling of it. I miss a sentence in your answer like "Therefore I would not even try to read the value without knowing how it is used". Alternatively I hoped for some heuristics, like "50 52 4F 50 45 52 54 59 00" has almost no chance of being interpreted as anything but the ASCII string "PROPERTY". But how do people find out, that it even can be read as "PROPERTY"? Or do they just not?
    – Matmarbon
    Oct 10, 2017 at 9:12
  • @Matmarbon Most of the time it boils down to an educated guess. For example, if all byte values range between 0x40 and 0x7e its probably ascii code. Even if the values are higher, you could assume its some kind of extended ascii, but there are numerous tables to try. Basically you try 'brute force' by applying every formating you may now. Depending on the context, I would assume 0x50 is an ia386 push eax instruction...
    – Nordwald
    Oct 10, 2017 at 9:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.