0

I need some help and advice here. I am privately learning on how to reverse engineer our teachers custom file archive file that have other files stored inside of them. for school project.

But, I am kinda lost on where I need to start with the file. What do I look for in the file after loading it into ida-pro To, be able to create my own self extracting Tool for my project.

The File format is .crackme that has been compressed with files inside of it from our teacher at school but when I double click on the file it says the file is "archive either unknown format or damaged".

So, yeah the file extension he gave us is not any known on the web he created his own extension for us to crack it and make an extractor tool to get all the data from the archive his extension name is ".crackme" so yeah.

Any Advice, here any help to is much appreciated by me.

  • 2
    maybe attach the file so that people can look what's inside? – Paweł Łukasik Jan 22 at 11:12
  • 2
    @PawełŁukasik That could just be me, but I tend to prefer generic answers, rather than "here's your solution" type of answers that providing specific files in a question may lead/encourage. – NirIzr Jan 22 at 11:28
  • Hi and welcome to RE.SE. I'm confused based on the info you give. So assuming it's an archive (data file) why do you want to load it into IDA at all? What does the Unix file command state ... did you try the usual firmware analysis tools? Do you have access to any program that handles (reads or writes) the format, which you could reverse engineer to learn more about the format? – 0xC0000022L Jan 22 at 21:20
2

I hope you'll find your experience in RE.SE enjoyable and educating :) Reverse engineering is often studied as a hobby, so you're in good company!

IDA pro is a disassembler, which is focused on reverse engineering / reading assembly/machine code. that is - the code actually executed by the CPU. Since it appears you were only given a format file, without any executable code to manipulate / process the file, IDA will prove less useful.

Instead, the only tool you should require for such a task, assuming the format is indeed proprietary, is a hex-editor / reader. 010 Editor is a great one, and it has a trial version.

To eliminate the possibility of a known format, try running a couple file identification tools such as the linux file command, TrID, binwalk, etc. These will try to identify common file formats (binwalk is specifically focused on archive formats), which if provide any insights should point you in the right direction.

To reverse engineer a file format solely based on a single file content, you'll need to map out the the file's apparent structure and you don't have a lot to go with. Excluding textual and very simply file formats, this should be kinda difficult without any additional resources (more files, a program that handles the format in any way, etc).

Here's a list of pointers/tips, although you'll probably find more information available online:

  1. As most files begin with a header, you should begin with mapping what are the different members of the header structure.
  2. Things that are magic values, strings, offsets and sizes are quite easy to recognize. Most decent hex editors will show different representations of every few bytes, so it'll be easy to recognize.
  3. Start by dividing the bytes to different members, before you try to understand their meaning. For example, given the following hex stream: 00 05 00 00 00 01 BE F1 CA D7 it is easy to notice the members are a word (2 bytes), a dword (4 bytes) and another dword. It is also likely that the first two are integers while the third is either a magic value or a CRC.
  4. If the file has any recurring delimiter values, those should also be easily identifiable (although less likely to be present in an active file format).
  5. If you manage to recognize any other file headers (probably using their own magic values), those are good leads to figuring out where the actual file content is placed. This will also mean the archive file does not compress the contained files, linux's tar, for example, can do that. Alternatively, if you encounter long streams of smooth or random looking binary streams those can be the actual compressed data. I tend to believe your teacher did not invent he's own compression algorithm, so there you'll need to find similarities to other compression algorithms, perhaps running those streams under TrID and file again could help.
  6. Common looking patterns, for example, may be a useful way to uncover recurring structures (for which you'll have more than one reference point, yay!). For example, if you recognize every file-name string is followed by a sequence of bytes with a similar structure, those are probably two instances of the same structure.
  • 1
    To add to Nirlzr's excellent answer, there are a couple of great communities dedicated to reversing file formats which could perhaps help serve you tremendously. They are XeNTaX and ZenHAX, respectively. Just Google those names and their forums will pop up. Each site has tutorials that discuss reverse engineering file formats, so if you really want to learn how to do this stuff, check those out. Finally, the main guy behind XeNTaX has a YouTube channel where he shows you how to reverse various file types: youtube.com/… – dsasmblr Jan 22 at 18:10
  • 1
    Thanks so so so much for all of the help I got from each of you really this is an incredible site and a awesome community. Anything I can do to help you all out on your questions feel free to ask I will try my best again thank you very much, strongly appreciated. – markkk Jan 22 at 18:32
  • 1
    @dsasmblr, great addition! markkk, you're welcome! – NirIzr Jan 22 at 18:38
  • Is, there a version of Bin-walk for windows versions of Ida-pro if not is there an alternative to Bin-walk for windows that focuses on archives. @NirIzr #NirIzr – markkk Jan 23 at 17:00
0

Many archive formats contain headers. gzip headers for instance begin with 1f 8b. Use a hex-editor to check for known magic numbers in the header first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.