1

I'm trying to reverse engineer a REST API and there is an endpoint that delivers images. Some of them are jpegs but other ones look like they're base64 encoded, except they don't appear to be, as they contain invalid chars such as & and -. If I "repair" the invalid chars I can base64 decode it, but it's just random binary data I can't discern anything from (does base64 have a checksum built in or can I base64-decode any string that has valid base64 characters?).

The data is around ~74 KB for an image I'm requesting in 500px width. Here is a bit of the content:

MAXe09nMdH7sLXdcCVfZhA1p3ll44Ye5vJABsCGRPlh4xej7NYAu9otU2xUns35mHcwVr1j12l9Mn2AsSP9RTZEjljoUGNzkCn5yshkPMGLBmyFgrI2PjRpme0UIFX9n/CF1K1FDbA8uhTqgqxLYV2DeA9LpG5hLSFPGlkKbGcsWlYa4YyqsbYtG9mg1knuzedm+kVWvPjUpN/WtypkypnaZKmUVnXh3jFgMxCOpWHLGX9QfptR331mte+pjS2n4Ot51EYvA2Bm0QxYoEZ8ZeV/W1UjkHw9L9PBH65NY/h1mL1s246/XHFsJT6eSnHTPFlILiT66cOVjJ+2T3LDidobQrDkamZi/+wwsugY5520lFrMUYvvtvyFEb

The API is sending a Content-Transfer-Encoding: binary header with the response.

Are there other common formats to encode binary data that I may not be aware of or does anyone have an idea what kind of data this could be?

7
  • "I suspect that the image is in a vector format" -- but you know where this image gets displayed, right? – Jongware Jun 18 '20 at 7:39
  • Yes, the image is displayed in an iOS app. But of course I don't know what the app does with the data in order for it to be displayed. – ground_head Jun 18 '20 at 9:08
  • 1
    I mean, can you determine if it is a vector or a bitmap? For example, if it's an interactive map and you can freely zoom in and out, it is most likely a vector image. – Jongware Jun 18 '20 at 9:29
  • Good point. No I can't zoom in (without it getting blurry). So I guess it's probably a bitmap file (at least at display time) after all. It's strange that other images (photos) aren't in this format. – ground_head Jun 18 '20 at 9:47
  • 1
    If the client is an app the format may be obfuscated or encrypted. Even if it is a simple xor you can work hours on identifying the format. Therefore if you have access and the image format is not obvious reverse the client. – Robert Jun 18 '20 at 12:34

Browse other questions tagged or ask your own question.