-2

So I got this file with an unknown extension. The file is an event flow code

Ok, so I analysed the file (with HxD) and it seems to be compressed in some way because you can read some plain text there. I have some coding skills but I never done this kind of things before

So... Is there any good tutorial to start decompressing/decoding unknown files? Or at least, is there any good tool I should use for this job? Or any advice/tip for this?

Thanks in advance!

closed as off-topic by usr2564301, perror, kn0x, Vitaly Osipov, peter ferrie Feb 9 '18 at 20:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – usr2564301, perror, kn0x, Vitaly Osipov, peter ferrie
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    it might be hard to analyse the whole file w/o the binary that reads them – Paweł Łukasik Feb 4 '18 at 20:20
  • 1
    There is nothing in that file that suggests it's compressed in any way. It seems to be just a database. – usr2564301 Feb 5 '18 at 0:13
5

it seems to be compressed in some way because you can read some plain text there

This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any readable ASCII strings in a hexdump. Readable ASCII data indicates at the very least that there are regions within the binary that are not compressed or encrypted.

The fastest way of determining whether a binary is compressed or encrypted is through visualization. Visualization of this binary shows that Rad Lexus is correct: it is neither compressed nor encrypted.

vis 1 ent 1 vis 2 ent 2

binwalk entropy scan

Compressed and encrypted data have an entropy of close to 1 (on a scale of 0 to 1). In this file it is never higher than 0.8, indicating conclusively that there are no compressed or encrypted regions within the binary. The spike in entropy toward the end of the file corresponds to the relatively contiguous block of ASCII data shown by the blue coloring in the 1st and 3rd images.

If you want to know how the data in this file is accessed, you need to examine the processes that read from and write to this file, as Paweł Łukasik said.

Here is some advice

Not the answer you're looking for? Browse other questions tagged or ask your own question.