2

I have a file that I am trying understand its structure and format. It's a proprietary driver file of a control system for NEC LT380 projector which contain essential information such as TCP port number and available commands that the projector accepts such us power on/off, switch inputs and aspect ratio etc.

I did a few tests on the file and able to determine a few things:

  1. Here's the content of the file: http://codepad.org/0pzGkLgT (you need to save the content into a file then open it using gzip software)
  2. I was able to determine that the file is gzipped and upon extraction, the zip contains a single file without extension.
  3. Here's the content of the extracted file: http://codepad.org/yvuceZcD (to read this, open using hex viewer)
  4. Online TrID File Identifier seems to identify the extracted file as ABR or Adobe Photoshop Brush which of course is incorrect.
  5. Then I opened the extracted file using text editor, it just show a bunch of hex strings.
  6. Which led me to open the hex file in HexEdit. This time, I am able to see some human readable syntaxes and code.
  7. The beginning and end of file contains some unreadable strings and some syntaxes such as "Culture=neutral, PublicKeyToken=null". These syntaxes seemed to suggest its .NET related but exactly what kind of .NET file I am not so sure. In the middle portion of the file, there's a bunch of code that with further investigation seemed like python code. Example:

    def ReadAspectRatio(self, qualifier, context):

  8. Also, on the same file, I found some tags:**<</Type/Catalog/Pages 2 0 R/Lang(en-US) >>** which is often found in a PDF file. Using PDF repair tool, I was able to recover and rebuild the streams of this file into a proper PDF file which contains a few pages of the projector commands and port information.

Questions:

  1. Do you have a way to determine what kind of file is this? Or what has been done to this file since there seems to be 3 different things inside that one file: .NET stuff (maybe manifest file or reference to .NET assembly), python code that does the set/read/write command to device and lastly PDF stream. Was there obfuscation or file joining method or hashes done on that beginning and end of file?
  2. I am looking to recreate and emulate the file. Currently, if I just open that extracted file, edit the middle portion of the file by adding some simple extra options/commands in proper python code, save it and gzip it back, it doesn't work.

Thanks!

  • 1
    It would help if you uploaded the file to a site that supports binary files; we can't really use the codepad.org hex dumps (well, we can, using xxd -r -p, but why require an extra step, and the resulting gzip file seems truncated anyway. A complete file would be more helpful). Anyway, the format seems like some kind of serialization; there's file names like 'nec_1_548.py' and 'nec_1_548_v1_0_0.pdf' in the file as well, so the file seems to have all kind of stuff serialized, some of which are strings, some other are (python and PDF) files. – Guntram Blohm Jan 4 '15 at 13:42
  • Thanks for you reply! The original file is here: bit.ly/1zM3rsV I have also added some extra info to my post, in short the file contains a few stuffs: .NET tags which may contain manifest or reference to .NET assembly, some python code and also PDF stream. – scott Jan 4 '15 at 13:57
1

The file appears to be a binary-serialized .NET file (similar in concept to a Python pickle or a Java serialized stream), and does not appear to be obfuscated in any way. I manually parsed the first few records using the reference from Microsoft's stream format specification, and the format checks out. The file stores a single object of type "Extron.Configuration.Drivers.DriverFileAsset", with 18 class members of varying types.

I guessed this format based on the fact that it contains .NET class library identifiers in the header, then verified the guess by checking the file format spec.

I hacked together a parser for this format, though it is incomplete. The dump of the file looks like this:

Binary Serialization Format
@0
  SerializedStreamHeader(TopId=1, HeaderId=-1, MajorVersion=1, MinorVersion=0)
@17
  BinaryLibrary(LibraryId=2, LibraryName='Extron.Configuration.Drivers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')
@106
  BinaryLibrary(LibraryId=3, LibraryName='Extron.Configuration.Core, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')
@192
  BinaryLibrary(LibraryId=4, LibraryName='Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')
@283
  BinaryLibrary(LibraryId=5, LibraryName='WindowsBase, Version=3.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35')
@367
  ClassWithMembersAndTypes LibraryId=2 ObjectId=1 Name=Extron.Configuration.Drivers.DriverFileAsset:
      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _manifest
          MemberReference(IdRef=6)
      Extron.Configuration.Contracts.Enumeration.DriverPackageStateEnum _packageState
          ClassWithMembers LibraryId=4 ObjectId=-7 Name=Extron.Configuration.Contracts.Enumeration.DriverPackageStateEnum:
              value__ = 0
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=8)
      System.Version DriverDescriptorAsset+_fileVersion
          MemberReference(IdRef=9)
      System.Version DriverDescriptorAsset+_schemaVersion
          MemberReference(IdRef=10)
      System.Version DriverDescriptorAsset+_minAPIVersion
          MemberReference(IdRef=11)
      String DriverDescriptorAsset+_manufacturerName
          BinaryObjectString(ObjectId=12, Value='NEC')
      String DriverDescriptorAsset+_deviceTypeName
          BinaryObjectString(ObjectId=13, Value='Video Projector')
      String DriverDescriptorAsset+_filename
          BinaryObjectString(ObjectId=14, Value='\\\\usa-home10\\home\\wes minner\\programming\\reviews\\nec_1_548 [nec lt280]\\finished\\nec_1_548_v1_0_0.pkp')
      Int32 DriverDescriptorAsset+_contentHashCode
          0
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] DriverDescriptorAsset+_internalChildCollection
          MemberReference(IdRef=8)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=8)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=16, Value='nec_1_548')
      String AssetBase+_name
          MemberReference(IdRef=16)
      System.Guid AssetBase+_guid
          SystemClassWithMembers ObjectId=-17 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Contracts.Assets.IAsset AssetBase+_parentAsset
          ObjectNull()
@2396
  ClassWithMembersAndTypes LibraryId=3 ObjectId=6 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=18)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          ObjectNull()
      String AssetBase+_name
          ObjectNull()
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-19 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Contracts.Assets.IAsset AssetBase+_parentAsset
          ObjectNull()
@3412
  ClassWithMembers LibraryId=5 ObjectId=8 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=20)
      Collection`1+items = MemberReference(IdRef=21)
@3653
  SystemClassWithMembers ObjectId=9 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@3724
  ClassWithId ObjectId=10 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@3749
  ClassWithId ObjectId=11 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@3774
  ClassWithMembers LibraryId=5 ObjectId=18 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=22)
      Collection`1+items = MemberReference(IdRef=23)
@4023
  ClassWithMembers LibraryId=5 ObjectId=20 Name=System.Collections.ObjectModel.ObservableCollection`1+SimpleMonitor[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _busyCount = 0
@4255
  SystemClassWithMembers ObjectId=21 Name=System.Collections.Generic.List`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _items = MemberReference(IdRef=24)
      _size = 6
      _version = 6
@4469
  ClassWithMembers LibraryId=5 ObjectId=22 Name=System.Collections.ObjectModel.ObservableCollection`1+SimpleMonitor[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _busyCount = 0
@4709
  SystemClassWithMembers ObjectId=23 Name=System.Collections.Generic.List`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _items = MemberReference(IdRef=25)
      _size = 2
      _version = 2
@4931
  BinaryArray(ObjectId=24, BinaryArrayTypeEnum=<BinaryArrayType.Single: 0>, Rank=1, Lengths=(8,), LowerBounds=None, TypeEnum=<BinaryType.Class: 4>, AdditionalTypeInfo=ClassTypeInfo(TypeName='Extron.Configuration.Contracts.Assets.IAsset', LibraryId=4))
      MemberReference(IdRef=26)
      MemberReference(IdRef=27)
      MemberReference(IdRef=28)
      MemberReference(IdRef=29)
      MemberReference(IdRef=30)
      MemberReference(IdRef=31)
      ObjectNullMultiple256(NullCount=2)
@5027
  BinaryArray(ObjectId=25, BinaryArrayTypeEnum=<BinaryArrayType.Single: 0>, Rank=1, Lengths=(4,), LowerBounds=None, TypeEnum=<BinaryType.Class: 4>, AdditionalTypeInfo=ClassTypeInfo(TypeName='Extron.Configuration.Contracts.Assets.IResourceAsset', LibraryId=4))
      MemberReference(IdRef=32)
      MemberReference(IdRef=33)
      ObjectNullMultiple256(NullCount=2)
@5111
  ClassWithMembersAndTypes LibraryId=3 ObjectId=26 Name=Extron.Configuration.Core.Assets.RevisionHistoryAsset:
      DateTime _date
          2014-08-01 02:08:28.537000
      String _author
          BinaryObjectString(ObjectId=34, Value='ngupta')
      System.Version _version
          MemberReference(IdRef=35)
      String _notes
          BinaryObjectString(ObjectId=36, Value='')
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=37)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=37)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=38, Value='Creation')
      String AssetBase+_name
          MemberReference(IdRef=38)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-39 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@6090
  ClassWithId ObjectId=27 Name=Extron.Configuration.Core.Assets.RevisionHistoryAsset:
      DateTime _date
          2014-08-01 02:08:28.537000
      String _author
          BinaryObjectString(ObjectId=34, Value='ngupta')
      System.Version _version
          MemberReference(IdRef=35)
      String _notes
          BinaryObjectString(ObjectId=36, Value='')
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=37)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=37)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=38, Value='Creation')
      String AssetBase+_name
          MemberReference(IdRef=38)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-39 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@6195
  ClassWithMembersAndTypes LibraryId=3 ObjectId=28 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=48)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=49, Value='DriverCommands')
      String AssetBase+_name
          MemberReference(IdRef=49)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-50 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@7264
  ClassWithMembersAndTypes LibraryId=3 ObjectId=29 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=52)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=53, Value='SupportedProtocols')
      String AssetBase+_name
          MemberReference(IdRef=53)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-54 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@8331
  ClassWithMembersAndTypes LibraryId=3 ObjectId=30 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=56)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=57, Value='SupportedModels')
      String AssetBase+_name
          MemberReference(IdRef=57)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-58 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@9397
  ClassWithMembersAndTypes LibraryId=3 ObjectId=31 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=60)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=61, Value='DriverParams')
      String AssetBase+_name
          MemberReference(IdRef=61)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-62 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@10454
  ClassWithMembersAndTypes LibraryId=3 ObjectId=32 Name=Extron.Configuration.Core.Assets.Resource.StreamResourceAsset:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=64)
      String ResourceAssetBase+_key
          BinaryObjectString(ObjectId=65, Value='nec_1_548_v1_0_0.pdf')
      Object ResourceAssetBase+_content
          MemberReference(IdRef=66)
      Object ResourceAssetBase+_tag
          BinaryObjectString(ObjectId=67, Value='nec_1_548_v1_0_0.pdf')
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] ResourceAssetBase+_internalChildCollection
          MemberReference(IdRef=64)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=64)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=69, Value='nec_1_548_v1_0_0.pdf')
      String AssetBase+_name
          BinaryObjectString(ObjectId=70, Value='nec_1_548_v1_0_0.pdf')
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-71 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_parentAsset
          MemberReference(IdRef=6)
@11913
  ClassWithId ObjectId=33 Name=Extron.Configuration.Core.Assets.Resource.StreamResourceAsset:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=64)
      String ResourceAssetBase+_key
          BinaryObjectString(ObjectId=65, Value='nec_1_548_v1_0_0.pdf')
      Object ResourceAssetBase+_content
          MemberReference(IdRef=66)
      Object ResourceAssetBase+_tag
          BinaryObjectString(ObjectId=67, Value='nec_1_548_v1_0_0.pdf')
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] ResourceAssetBase+_internalChildCollection
          MemberReference(IdRef=64)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=64)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=69, Value='nec_1_548_v1_0_0.pdf')
      String AssetBase+_name
          BinaryObjectString(ObjectId=70, Value='nec_1_548_v1_0_0.pdf')
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-71 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_parentAsset
          MemberReference(IdRef=6)
@12046
  ClassWithId ObjectId=35 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@12071
  ClassWithId ObjectId=37 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=20)
      Collection`1+items = MemberReference(IdRef=21)
@12090
  ClassWithId ObjectId=42 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@12115
  ClassWithId ObjectId=44 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=20)
      Collection`1+items = MemberReference(IdRef=21)
@12134
  ClassWithMembers LibraryId=5 ObjectId=48 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=86)
      Collection`1+items = MemberReference(IdRef=87)
@12396
  ClassWithMembers LibraryId=5 ObjectId=52 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=88)
      Collection`1+items = MemberReference(IdRef=89)
@12655
  ClassWithMembers LibraryId=5 ObjectId=56 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=90)
      Collection`1+items = MemberReference(IdRef=91)
@12915
  ClassWithMembers LibraryId=5 ObjectId=60 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=92)
      Collection`1+items = MemberReference(IdRef=93)
@13172
  ClassWithId ObjectId=64 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=20)
      Collection`1+items = MemberReference(IdRef=21)

You may be able to load the file using some .NET functions, if you first import the driver's libraries. Otherwise, you can use the spec (which is very easy to read) to disassemble the file and extract the contents you want.


As you noted, there are more files nested inside. Therefore your first step should be to parse the serialized stream to extract everything, then parse the contents of each class member (some of which are complete files, like the PDF and PKP files).

  • Thank you for the insights! I have Visual Studio for Desktop installed, not familiar with it but would you be able to share your parser or list the steps to open the file in the dump format like yours? – scott Jan 12 '15 at 8:40
  • @scott: Sure thing; I have uploaded the code to GitHub. Keep in mind I am only parsing a small subset of the format, enough only to show what I have above. You may need to extend it to work for the entire file. – nneonneo Jan 12 '15 at 18:03
  • Thank you! I hope the python script does make sense to me. :) – scott Jan 13 '15 at 5:42
1

Normally, i don't trust google searches for "xyz file format", because they return all sorts of unethical "if you have an xyz file, download our registry cleaner here" sites. But in this case, one of the links is http://extension.nirsoft.net/pkp, which claims that a .pkp file might be a visual studio packaging project - which actually sounds sensible given the content of the file.

Also, one of the strings in the file is the full path it once had: \\usa-home10\home\wes minner\programming\reviews\nec_1_548 [nec lt280]\finished\nec_1_548_v 1_0_0.pkp, and a lot of strings contain the company name Extron. Googling for wes minner extron finds this LinkedIn Profile of a guy whose job description is "Device driver writing and reviewing in Python".

I suggest you try one of the following:

  • get a copy of visual studio and check if it can import your file as a project file
  • use the LinkedIn Profile to contact the guy who created your file and ask him what type of file it is; this might yield better results than using one of the official channels of the company.

Seems sometimes there are non-technical ways of reverse engineering as well ...

  • Thanks Guntram for your extra pointer! I tried opening the file using Visual Studio but no luck, it just showed the same thing as when I open it using HexEdit. I suspect those chunks of code (python and PDF) were combined and packed using something that is unknown to me yet. – scott Jan 5 '15 at 14:05
  • On your suggestion to contact the dev who made this, I will try that when I exhausted all my options. I am doubtful he will reply though because it looks to me that the driver is intended to be kept obscure to discourage amendment, else it would be in easy editable XML or JSON file with key value pairs of information. I might be wrong about this again. – scott Jan 5 '15 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.