1

I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio engine, and I have no idea what program they were compiled in. I have tried opening them in Notepad++ but there is no readable content inside using this method. Could they be encrypted, or should I try using another tool?

  • 2
    Welcome! VST == en.wikipedia.org/wiki/Virtual_Studio_Technology? Just because we are knowledgeable in RCE (that's reverse code engineering) doesn't mean we know all possible acronyms from all subject matters by heart. Either way you need to provide much more information, such as - for example - the actual files and so on. Depending on what the software is, perhaps there isn't any source code publicly available?! – 0xC0000022L Jun 13 '18 at 13:51
  • Yep, that's the VST I'm talking about. I could provide the .dat files if you want. How would you like me to upload them? – S.Stevens Jun 13 '18 at 15:19
  • @S.Stevens use dropbox or google drive or similar to share the files – julian Jun 13 '18 at 15:33
  • Here's the file: drive.google.com/open?id=1LU_GanfZau5ZubYJNAkI5BQPcnCSOS04 – S.Stevens Jun 13 '18 at 15:59
1

The .dat files you are looking at do not contain the audio engine.

  • I have been trying to simply open and view the source code

  • I have tried opening them in Notepad++ but there is no readable content inside using this method.

The file provided does not contain source code. The information contained in this file is encoded such that it is not human-readable.

  • I have two .dat files which I presume contain the audio engine, and I have no idea what program they were compiled in.

The file provided does not appear to be formatted in such a way that it can be used to compose a process image in memory, as it does not conform to an executable format such as PE or ELF. In other words, it is not designed to be loadable by any OS loader I am familiar with. It seems doubtful that this file was generated by a compiler.

Here is a dump of the first few bytes:

00000000  61 70 72 6f 22 56 00 00  b7 00 00 00 b4 b1 af ac  |apro"V..........|
00000010  a9 a7 a4 a2 9f 9c 9a 97  95 92 8f 8d 8a 87 85 82  |................|
00000020  80 7d 7a 78 75 73 70 6d  6b 68 66 63 60 5e 5b 58  |.}zxuspmkhfc`^[X|
00000030  56 53 51 4e 4b 49 46 44  41 3e 3c 39 36 34 34 34  |VSQNKIFDA><96444|
00000040  33 33 33 32 32 32 31 31  31 31 30 30 30 30 2f 2f  |33322211110000//|
00000050  2f 2f 2e 2e 2e 2e 2d 2d  2d 2d 2d 2c 2c 2c 2c 2c  |//....-----,,,,,|
00000060  2b 2b 2b 2b 2b 2a 2a 2a  2a 2a 29 29 29 29 29 29  |+++++*****))))))|
00000070  28 28 28 28 28 27 27 27  27 27 27 27 26 26 26 26  |((((('''''''&&&&|
00000080  26 26 26 26 25 25 25 25  25 25 25 24 24 24 24 24  |&&&&%%%%%%%$$$$$|
00000090  24 24 23 23 23 23 23 23  23 23 22 22 22 22 22 22  |$$########""""""|
000000a0  22 22 22 21 21 21 21 21  21 21 21 21 20 20 20 20  |"""!!!!!!!!!    |
000000b0  20 20 20 20 20 20 20 1f  1f 1f 1f 1f 1f 1f 1f 1f  |       .........|
000000c0  1f 1e 1e 1e 1e 1e 1e 1e  1e 1e 1e 1e 1e 1d 1d 1d  |................|
000000d0  1d 1d 1d 1d 1d 1d 1d 1d  1d 1c 1c 1c 1c 1c 1c 1c  |................|
  • Could they be encrypted, or should I try using another tool?

The entropy level throughout the file is never high enough to be consistent with encryption of compression. Compressed or encrypted data is expected to have an entropy level very close to 1.

This is the entropy plot of the .dat file 1ca37741f.dat: .dat file entropy

For comparison, here is a PE file employing executable compression: PE32, executable compression

Notepad++ (The first ~1.6 MB is mostly object code): PE64 - notepad++

As we can see in the last plot, average entropy for regions containing x86-64 code is approximately 7.5 and quite variable. IIRC, it is fairly similar for object code across most instruction set architectures (x86, MIPS, PPC, etc.). The entropy in the provided file is either to high or too low and not variable enough to suggest the presence of object code.

  • Wow! Thanks for doing all this analysis. What do you suspect it is then- is it possible to find out what type they are? I can't seem to find any other files that contain the audio engine for the synth, but I'll have another look. – S.Stevens Jun 13 '18 at 21:06
  • @S.Stevens What exactly is this "audio engine"? .dat files typically contain data read by some application. You need to find the executable program that reads the .dat files. – julian Jun 13 '18 at 21:48
  • I am no expert on VST's. There must be some kind of audio processing for this sound module to work, surely? I'll have a look at the exe's now. – S.Stevens Jun 13 '18 at 21:56
  • Ok, I looked at the installer .exe, and have found a section called RCData, this contains some hex codes and a couple of memory addresses. I presume this is where it's fetching all the data to install the program? – S.Stevens Jun 13 '18 at 22:09
  • @S.Stevens You should analyse the program being installed. – julian Jun 13 '18 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.