Reverse engineering a VST to learn about signal processing and hopefully help me make my own.

Question

I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio engine, and I have no idea what program they were compiled in. I have tried opening them in Notepad++ but there is no readable content inside using this method. Could they be encrypted, or should I try using another tool?

Answer 1

The .dat files you are looking at do not contain the audio engine.

• I have been trying to simply open and view the source code

• I have tried opening them in Notepad++ but there is no readable content inside using this method.

The file provided does not contain source code. The information contained in this file is encoded such that it is not human-readable.

• I have two .dat files which I presume contain the audio engine, and I have no idea what program they were compiled in.

The file provided does not appear to be formatted in such a way that it can be used to compose a process image in memory, as it does not conform to an executable format such as PE or ELF. In other words, it is not designed to be loadable by any OS loader I am familiar with. It seems doubtful that this file was generated by a compiler.

Here is a dump of the first few bytes:

00000000  61 70 72 6f 22 56 00 00  b7 00 00 00 b4 b1 af ac  |apro"V..........|
00000010  a9 a7 a4 a2 9f 9c 9a 97  95 92 8f 8d 8a 87 85 82  |................|
00000020  80 7d 7a 78 75 73 70 6d  6b 68 66 63 60 5e 5b 58  |.}zxuspmkhfc`^[X|
00000030  56 53 51 4e 4b 49 46 44  41 3e 3c 39 36 34 34 34  |VSQNKIFDA><96444|
00000040  33 33 33 32 32 32 31 31  31 31 30 30 30 30 2f 2f  |33322211110000//|
00000050  2f 2f 2e 2e 2e 2e 2d 2d  2d 2d 2d 2c 2c 2c 2c 2c  |//....-----,,,,,|
00000060  2b 2b 2b 2b 2b 2a 2a 2a  2a 2a 29 29 29 29 29 29  |+++++*****))))))|
00000070  28 28 28 28 28 27 27 27  27 27 27 27 26 26 26 26  |((((('''''''&&&&|
00000080  26 26 26 26 25 25 25 25  25 25 25 24 24 24 24 24  |&&&&%%%%%%%$$$$$|
00000090  24 24 23 23 23 23 23 23  23 23 22 22 22 22 22 22  |$$########""""""|
000000a0  22 22 22 21 21 21 21 21  21 21 21 21 20 20 20 20  |"""!!!!!!!!!    |
000000b0  20 20 20 20 20 20 20 1f  1f 1f 1f 1f 1f 1f 1f 1f  |       .........|
000000c0  1f 1e 1e 1e 1e 1e 1e 1e  1e 1e 1e 1e 1e 1d 1d 1d  |................|
000000d0  1d 1d 1d 1d 1d 1d 1d 1d  1d 1c 1c 1c 1c 1c 1c 1c  |................|

• Could they be encrypted, or should I try using another tool?

The entropy level throughout the file is never high enough to be consistent with encryption of compression. Compressed or encrypted data is expected to have an entropy level very close to 1.

This is the entropy plot of the .dat file 1ca37741f.dat:

For comparison, here is a PE file employing executable compression:

Notepad++ (The first ~1.6 MB is mostly object code):

As we can see in the last plot, average entropy for regions containing x86-64 code is approximately 7.5 and quite variable. IIRC, it is fairly similar for object code across most instruction set architectures (x86, MIPS, PPC, etc.). The entropy in the provided file is either to high or too low and not variable enough to suggest the presence of object code.