So I got this file with an unknown extension. The file is an event flow code
Ok, so I analysed the file (with HxD) and it seems to be compressed in some way because you can read some plain text there. I have some coding skills but I never done this kind of things before
So... Is there any good tutorial to start decompressing/decoding unknown files? Or at least, is there any good tool I should use for this job? Or any advice/tip for this?
Thanks in advance!
it seems to be compressed in some way because you can read some plain text there
This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any readable ASCII strings in a hexdump. Readable ASCII data indicates at the very least that there are regions within the binary that are not compressed or encrypted.
The fastest way of determining whether a binary is compressed or encrypted is through visualization. Visualization of this binary shows that Rad Lexus is correct: it is neither compressed nor encrypted.
Compressed and encrypted data have an entropy of close to 1 (on a scale of 0 to 1). In this file it is never higher than 0.8, indicating conclusively that there are no compressed or encrypted regions within the binary. The spike in entropy toward the end of the file corresponds to the relatively contiguous block of ASCII data shown by the blue coloring in the 1st and 3rd images.
If you want to know how the data in this file is accessed, you need to examine the processes that read from and write to this file, as Paweł Łukasik said.
Here is some advice
