I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse engineering something. I figured I would post here and see if anyone had any ideas. My goal is to be able to extract user data from a Revit file. Revit is architectural drawing program, but I know that Revit maintains some kind of event log and history, but I haven't been able to extract it from the file.
Here is what I think I know so far. Revit files are stored with the extension .rvt. The file is actually CFBF file. I wrote some code to parse the CFBF file and dump the contents. It yields a directory structure like this:
├── BasicFileInfo
├── Contents
├── Formats
│ └── Latest
├── Global
│ ├── ContentDocuments
│ ├── DocumentIncrementTable
│ ├── ElemTable
│ ├── History
│ ├── Latest
│ └── PartitionTable
├── Partitions
│ └── 6
├── ProjectInformation
├── RevitPreview4.0
└── TransmissionData
After looking at this, it would seem that Global/History file is what I'm interested in. If you look at one of these files the header looks like this
00000000: 0100 0000 0000 0000 1f8b 0800 0000 0000 ................
00000010: 000b 84da 0934 948f ffe8 714b 4564 8994 .....4....qKEd..
00000020: c8ae fa48 ca9e b5c6 8c99 319b 91a5 2459 ...H......1...$Y
00000030: 4aa2 4264 4b84 ecfb beaf 59cb be6f d9be J.BdK.....Y..o..
00000040: 9694 1422 b264 294b 4a28 ca16 eef3 fdfd ...".d)KJ(......
00000050: bbe7 feae 73cf b9ce 799d 63de e7f3 7c9e ....s...y.c...|.
00000060: 19cf 381c 9e6b 7b68 69fe cf07 85ee 7f3e ..8..k{hi......>
00000070: dfef 2f12 e075 b385 f854 492c a399 d451 ../..u...TI,...Q
00000080: fdff 7bfc 5f2b fe9f c727 20f5 0372 a249 ..{._+...' ..r.I
00000090: c434 6209 f113 b182 f885 d840 d023 e766 .4b........@.#.f
The data looks a bit like gibberish, but 8 bytes in, I can see 1f 8b which is is the magic number for something that is gzipped. So at this point I stripped off the first 8 bytes and un-gzipped the file. This is where I'm stuck. The files are unzipping successfully, but I can't make sense of the binary data that's being spit out.
All of the files have similar pattern. I'm posting pastes to the sample files that I have.
- https://dumpz.org/bByDwdYTztbn
- https://dumpz.org/cW8f7wPHDXya
- https://dumpz.org/bR6Q2BQKgnCz
- https://dumpz.org/aWkNMAs8ZEa3
Each of these files has some very obvious repeating structure. It makes me think it's not just gibberish, but I'm not sure what type of file format it is. The stuff I see:
- Each file starts with a magic number
5d 04 01. It might be a version indicator or something - There is a 16 byte sequence that is unique to each file that repeats three times, then there is 16 bytes of null then the sequence is repeated a fourth time
- The first 102 bytes of the file in every case has that same header structure
- The first 860 bytes or so have alternating null "words"
- Then there is a big chunk of raw data
- At the end of each file there is some repeating data again
I've tried a few different tools to understand what's going on like xortool and binwalk. I haven't been able to really understand what this file is and what the header and trailer sections could mean.
I figured I would share here and see if anyone had any ideas or thoughts of things to try. Looking at the data below, I can also see that there is a section of the data at the beginning that has a number that seems to be counting up. It stands out very clearly in the Veles view.
If it helps, this is a screenshot of what the history looks like for an example Revit file. I would guess it's stored simply in the History file, but I can't really tell.
