3

I'm trying to extract some binary blobs from a unknown archive format. (*.pakz). I know this archive contains some .xtreme binary files that are the files I'm looking for. My goal is to extract those files from the archive.

By doing some research I've came across binwalk. So I've tried to extract some signature info from it. It returned me several blobs of LZMA compressed data.

f.ex, this is the first entries in the output of binwalk

    DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
12            0xC             LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 1130064 bytes
1079006       0x1076DE        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 669520 bytes
1718248       0x1A37E8        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 807872 bytes

I assume these are parts of a single compressed file I should combine? So I tried extracting each individual files/blob with carve option. This outputs me several .7z files however many are missing. I don't know why, by using verbose and log command line options, it doens't output any errors but outputs LZMA blob addresses that are not extracted.

If I extract files I get several .xml files that give me useful information, f.ex, the path of the files I'm looking for but I still don't know from the path the start/end bytes of that file.

Does anyone has any clue? Thanks in advance.

1
  • It's worth trying the "foremost" data recovery tool as well, sometimes it's able to extract files that binwalk misses. – Dvd848 Dec 26 '19 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.