I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files:
- book.bbi - book index i.e. what pages are in the book
- a bunch of .bli's - text entries on the page, that's a guess
- a bunch of .ilg's - media on the page, that's a guess too
All these files have a plaintext header and what's remaining is the data which is compressed or encrypted in some way:
upd: the data_header is actually the uncompressed length of the data
I tried running binwalk and XorSearch, but with no success. I guess now I have to debug it, but I am very, very unfamiliar with it. I am using x32dbg with the xAnalyzer plugin. I tried setting a breakpoint on ReadFile and tracing from there, but it produces an enormously large log. However I can see that it uses crush32.dll - "old C/Win32 compression library" and runs some ors/xors and byte shifts(shr) which kinda reinforces my thought about compression/encryption usage.
So my question is how do I approach it from here? How do I at least dump all strings with the correspoding instructions i.e. get to the point where this byte-mess becomes readable strings? I am absolutely stuck. Thanks in advance!