1

I have an application which I'm sure is malicious. But I'm also sure that it's db files are genuine.

The problem is that I don't want to dig in and debug the disassembly of it. but I want to somehow read from these files.

I know there's a field of reversing of files on it's own, but I haven't gotten much to it.

And I wanted to know if there's a way to find out how to read the files, other than digging through the disassembled code

Thank you

3
  • Use linux file utility, it will possibly suggest the type of the file.
    – w s
    Apr 16, 2014 at 10:26
  • Well, it told me that it's a data. in the MAN page of "file" it said that data could mean anything other than text and executable. Kind of useless information
    – aclowkay
    Apr 16, 2014 at 12:53
  • Have you checked the file header with a hex editor? The file format may have some magic number or identifier string.
    – nrz
    Apr 16, 2014 at 14:45

1 Answer 1

2

Not enough information.

It may be a common file type, shared by many applications, and in that case Googling the file extension is sometimes enough. Unfortunately, ".db" is an extremely generic extension (compare, for example, ".txt" versus ".wp5"). In this particular case, you inspect the file with a hex viewer and try to find documentation based on the very first couple of bytes.

If the data format is known, chances are someone already wrote a converter for it. But before you can try one of these, you must know beyond a shadow of a doubt what kind of file it is; "oh right, then it's a .db file" is not enough.

If it's a private format (or it's so old/new/quaint/rare that you can't find anything useful on the 'net), you will have to write something yourself to (1) read out useful structures, and (2) write out its data in a format useful to you. Recognizing what parts are useful and what's not is something only you can do, as (apparently) you have an inkling of what it should contain.

1
  • I found that there was a plaintext file. and that the DB types were some sort of an index..which is irrelevant for me. the plaintext did the job :) thank you
    – aclowkay
    Apr 21, 2014 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.