Questions tagged [binary-format]
Refer to the hexadecimal format which is directly executed by the CPU or the interpreter. Opposed to the human-readable format which can be understood by the reverse without any intermediate translation.
72
questions
0
votes
0
answers
34
views
Trying to open the Sprite files from Cookie Shop DS with Python 3.x
I’m trying to rip all of the Cookie Shop DS character sprites by using Python. I already got pypng installed but I don’t understand saving as “cookie2png.py”, It’s too hard for me too do.
Can you help ...
- 1
0
votes
0
answers
36
views
Change Mac address
I have read the NAND memory MT29F2G08ABAEAWP contents via the RT809F programmer from IP Camera,
when I have written the program (.bin) to the new NAND memory the Mac address and serial number of ...
- 1
0
votes
0
answers
55
views
Help determine 3d model vertex structure serialized binary
Help determine 3D model vertex structure serialized binary.
Example of single vertex:
A3 D0 5D BA C9 27 3F 3A DC 6C 87 3B 2B 75 EE 00
FF FF FF FF 92 2F 29 80 B1 19 64 3F 02 82 1D 3F
What I got so far:...
- 1
0
votes
0
answers
594
views
Hello Watch 3+ smart watch firmware extracting
I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me?
File link: ...
1
vote
0
answers
52
views
How can I create a radare2 type for a variable-length struct?
I'm trying to parse a binary file and it has a structure similar to this,
struct foo {
int64_t count_things;
int64_t offset_to_thing[count];
int8_t bytes[];
int64_t other fields;
}
...
- 1,789
0
votes
0
answers
28
views
Why would unreadable data recovered from a drive be non-recoverable?
I ran Disk Drill on a drive that was a member in a failed software RAID mirror on macOS. The drive seemed to be fine, but was showing up as "uninitialised", so the drive didn't fail as such ...
5
votes
1
answer
91
views
Decoding a time format
I'm reverse engineering a hardware device which stores time a strange format:
32-bit word
H:MM:SS (rounded)
0x03200000
0:00:00
0x09700000
0:00:00
0x0A1B0000
0:00:01
0x0A160000
0:00:01
0x0B098000
...
- 153
2
votes
0
answers
42
views
What format could this image mask be?
So I'm looking at these sprite files from a type of virtual world format that's no longer around. They appear to be JPEGs with some custom markers, one of which appears to be an alpha mask. Here's ...
- 153
1
vote
0
answers
103
views
How do I reverse engineer a file uploading api?
The API is pretty old and is written in C#, I tried debugging the API calls with mitmproxy.
This is the successful API call (manually uploading file)
but when I tried curling it, it gave me this error ...
- 11
3
votes
0
answers
73
views
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:
arm-none-...
2
votes
0
answers
40
views
Find out what is this binary database entry and what format it is
the following varbinary "BUFFER" of a database entry is for an article.
FIELD_0 is in plain text and the item name is "1", which I created with the item management software.
[...
- 21
5
votes
1
answer
97
views
Why do the first bytes of this executable contain a path to busybox?
I'm reverse engineering an old TP-Link TD-W9970v3 router for fun and wanted to examine one of the executables called webWarn. Ghidra was unable to recognise the format, which surprised me. I then ...
- 151
2
votes
1
answer
110
views
Need help decoding bytes to number
I've got a really really old file format from an accounting software, late '70s, DOS, QBasic or QuickBasic. Source code is lost, only .exe file remaining, file needs emulator.
The file formate seems ...
- 141
3
votes
0
answers
164
views
Trying to understand a simple compiled PSI binary file
I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
- 253
2
votes
1
answer
420
views
Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?
I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
- 21
2
votes
1
answer
379
views
Has anyone encountered PNGs where the chunk data is encrypted/compressed?
I've come across some files which are used in a car's satellite navigation system. Looking at the files in a hex editor shows the ‰PNG signature, but the chunks do not follow the format spec - for ...
- 313
1
vote
0
answers
152
views
What type of file has the file signature 'BOOT'?
I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
- 61
2
votes
0
answers
114
views
Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles
I have a weird bug that causes this crap:
There are plenty of dumb "solutions" a-la "turn it off and on" but none of them work and/or relevant, the shell apps simply refuse to ...
- 141
0
votes
0
answers
276
views
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?
File Link
- 1
1
vote
1
answer
122
views
Name other than ".text" for the main code section
Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
- 1,560
2
votes
0
answers
190
views
Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU
I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware.
Does anyone know which ...
- 21
2
votes
1
answer
206
views
Decoding unknown ID format parts
I have a data set where events have a unique ID. Some examples:
CkUKGkNNZmY1TkhObi1zQ0ZWT0h3Z0VkaExJQ0xnEidDSlB0bG9UTG4tc0NGWmhpaXdvZDFxOE5fdzE1OTc1NzY4NzU4Mzg%3D
...
- 133
0
votes
1
answer
554
views
Generating an elf header
To get a basic understanding of the ELF format, I'm writing a basic program to generate a valid elf file from the most basic assembly output. I'm going step-by-step so I'll probably ask a few ...
- 103
2
votes
0
answers
291
views
Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes
I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse.
When developing ...
- 561
-1
votes
1
answer
4k
views
Change androidmanifest.xml file within apk
I am able to unpack an android apk file with apktool, but when I am repacking the apk file using apktool, it just crashes with errors, and ibotpeaches seems not patching those errors for years. Now ...
- 309
1
vote
2
answers
2k
views
Trying to rip the sprites of this game
I am currently trying to rip the sprites from an Nintendo DS game called Cookie Shop - Create Your Dream Shop but they are all in _LZ.bin files.
When I've unpacked its compression, I could see lots ...
- 21
0
votes
1
answer
171
views
Is there a image format that starts with 0x4E 0x58 0x50 (ASCII 'NXP')?
I'm looking at a binary file whose starting bytes are 0x4E 0x58 0x50. Is this an established magic number for a file format? If so, what format is it? My google-fu has proven too weak to find an ...
- 1,080
1
vote
1
answer
155
views
Which JSON object compact binary serialization is this?
I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server.
Does anyone recognize this? I've attached the first ...
- 11
2
votes
1
answer
329
views
Unknown archive format from QNX operating system
We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
- 263
1
vote
0
answers
51
views
.NET manifest resource format
Currently I'm writing a parser for .NET files and stuck on manifest resources.
My main resources:
Huge documentation
Short summary
For resource format I have found this project made in 2005, all ...
- 849
0
votes
1
answer
871
views
convert NPRG9x07.mbn to NPRG9x07.bin
Hello i have qualcomm based bootloader for mdm9x07 platform i want to convert to bin format but i did not find any script that does the conversion
here are the mbn files : NPRG9x07.mbn2
ENPRG9x07....
- 111
1
vote
1
answer
328
views
how can I know if PE file has appended data or not?
while doing this, I dont know the whole file size (pe size + appended data size)
my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.
- 11
3
votes
1
answer
5k
views
Decode C# binary serialization data
I am trying to decode what seems to be simple C# binary serialization to disk:
https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw
https://github.com/malaterre/MMCPrivate/raw/master/...
- 375
0
votes
1
answer
412
views
How to calculate the checksum algorithm with data captures
I have an obsolete control system that I am trying to write an interface into our new control system. I have spent weeks capturing data and figuring out the addressing, polling commands, point ...
- 3
2
votes
2
answers
1k
views
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
I load the entire PE into an std::vector<Byte> fileContent using std::fstream.
Then I obtain the executable's dos header:
IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
- 175
5
votes
1
answer
400
views
What kind of date stamp is this?
I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.
There are 2 values in one file (reversed ...
- 53
3
votes
0
answers
136
views
Interpreting clipboard data from HMI software
I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs.
Long story short, I need the ability to fill the ...
- 133
8
votes
0
answers
955
views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
- 81
7
votes
1
answer
1k
views
Determine if an ELF file is signed or not
I need some help in determining if an ELF file is signed or with a valid signature or not.
I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
- 71
2
votes
1
answer
284
views
Help with a packed date format
I've came across what appears to be a date format from a legacy database application.
I don't have access to the code that generated it, just have examples corresponding to certain Holiday messages.
...
- 21
7
votes
5
answers
3k
views
How to find out if PE executable was compiled with gcc or VisualStudio?
I looked at two ways so far. Both did not convince me in regard to false positives or false negatives:
Using strings: How to retrieve the GCC version used to compile a given ELF executable?
Using the ...
- 1,560
0
votes
1
answer
1k
views
PE: Strange entry in debug directory (Type: 0xc)
Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here.
I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2.
Now I have ...
- 1,560
4
votes
1
answer
4k
views
Reverse Engineering Windows PowerBuilder Binaries
I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
- 397
4
votes
1
answer
2k
views
If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?
Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
- 111
1
vote
0
answers
323
views
reverse engineer BE126 boot-loader
I am trying to reverse engineer the firmware upgrading process of BE126 wifi repeater which has a MIPS CPU.
I couldn't find a firmware upgrade image in the manufacturer site.
I have the toolchain ...
- 11
2
votes
1
answer
2k
views
How do reverse engineers commonly detect the format of binary data?
Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, ...
- 123
0
votes
1
answer
79
views
How to find out where an application stores the resolutions it allows?
Many applications (in particular most games) offer a set of resolutions to choose from. Some of them are pretty open and allow basically every resolution the underlying system seems to be capable of, ...
- 103
0
votes
1
answer
3k
views
Extracting embedded dlls from .NET executable
I have a .NET executable that apparently has some embedded DLLs. It's just one standalone executable. I opened this executable with JetBrains dotPeek and ILSPY, both decomiplier are showing DLL names ...
- 33
3
votes
2
answers
350
views
Problem with converting hex values to decimal
I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
- 33
3
votes
1
answer
9k
views
Adding a new PE section for a code cave
I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
- 187