Questions tagged [binary-format]

Refer to the hexadecimal format which is directly executed by the CPU or the interpreter. Opposed to the human-readable format which can be understood by the reverse without any intermediate translation.

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

Restore debug symbol for a embedded .bin image with an .axf file

I'm currently trying to reverse an firmware image I dumped from a Realtek Ameba device. The image is a stripped RTOS in .bin format which unfortunately does not have any metadata for ida pro to ...
user avatar
2 votes
1 answer
158 views

Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?

I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
user avatar
  • 21
2 votes
1 answer
272 views

Has anyone encountered PNGs where the chunk data is encrypted/compressed?

I've come across some files which are used in a car's satellite navigation system. Looking at the files in a hex editor shows the ‰PNG signature, but the chunks do not follow the format spec - for ...
user avatar
1 vote
0 answers
106 views

What type of file has the file signature 'BOOT'?

I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
user avatar
  • 61
2 votes
0 answers
49 views

Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles

I have a weird bug that causes this crap: There are plenty of dumb "solutions" a-la "turn it off and on" but none of them work and/or relevant, the shell apps simply refuse to ...
user avatar
  • 31
0 votes
0 answers
80 views

How to Find Password/ Bypass Password in a Switch Statement using IDA

I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ? File Link
user avatar
  • 1
1 vote
1 answer
72 views

Name other than ".text" for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
user avatar
  • 1,432
2 votes
0 answers
124 views

Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware. Does anyone know which ...
user avatar
  • 21
0 votes
1 answer
148 views

Decoding unknown ID format parts

I have a data set where events have a unique ID. Some examples: CkUKGkNNZmY1TkhObi1zQ0ZWT0h3Z0VkaExJQ0xnEidDSlB0bG9UTG4tc0NGWmhpaXdvZDFxOE5fdzE1OTc1NzY4NzU4Mzg%3D ...
user avatar
0 votes
1 answer
179 views

Generating an elf header

To get a basic understanding of the ELF format, I'm writing a basic program to generate a valid elf file from the most basic assembly output. I'm going step-by-step so I'll probably ask a few ...
user avatar
  • 103
2 votes
0 answers
164 views

Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes

I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse. When developing ...
user avatar
-2 votes
1 answer
3k views

Change androidmanifest.xml file within apk

I am able to unpack an android apk file with apktool, but when I am repacking the apk file using apktool, it just crashes with errors, and ibotpeaches seems not patching those errors for years. Now ...
user avatar
  • 179
1 vote
2 answers
853 views

Trying to rip the sprites of this game

I am currently trying to rip the sprites from an Nintendo DS game called Cookie Shop - Create Your Dream Shop but they are all in _LZ.bin files. When I've unpacked its compression, I could see lots ...
user avatar
  • 21
0 votes
1 answer
109 views

Is there a image format that starts with 0x4E 0x58 0x50 (ASCII 'NXP')?

I'm looking at a binary file whose starting bytes are 0x4E 0x58 0x50. Is this an established magic number for a file format? If so, what format is it? My google-fu has proven too weak to find an ...
user avatar
1 vote
1 answer
114 views

Which JSON object compact binary serialization is this?

I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server. Does anyone recognize this? I've attached the first ...
user avatar
  • 11
2 votes
1 answer
201 views

Unknown archive format from QNX operating system

We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
user avatar
  • 233
1 vote
0 answers
37 views

.NET manifest resource format

Currently I'm writing a parser for .NET files and stuck on manifest resources. My main resources: Huge documentation Short summary For resource format I have found this project made in 2005, all ...
user avatar
  • 789
-1 votes
1 answer
503 views

convert NPRG9x07.mbn to NPRG9x07.bin

Hello i have qualcomm based bootloader for mdm9x07 platform i want to convert to bin format but i did not find any script that does the conversion here are the mbn files : NPRG9x07.mbn2 ENPRG9x07....
user avatar
  • 101
1 vote
1 answer
163 views

how can I know if PE file has appended data or not?

while doing this, I dont know the whole file size (pe size + appended data size) my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.
user avatar
2 votes
1 answer
3k views

Decode C# binary serialization data

I am trying to decode what seems to be simple C# binary serialization to disk: https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw https://github.com/malaterre/MMCPrivate/raw/master/...
user avatar
  • 323
0 votes
1 answer
353 views

How to calculate the checksum algorithm with data captures

I have an obsolete control system that I am trying to write an interface into our new control system. I have spent weeks capturing data and figuring out the addressing, polling commands, point ...
user avatar
2 votes
2 answers
1k views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
user avatar
  • 175
5 votes
1 answer
377 views

What kind of date stamp is this?

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are. There are 2 values in one file (reversed ...
user avatar
3 votes
0 answers
109 views

Interpreting clipboard data from HMI software

I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs. Long story short, I need the ability to fill the ...
user avatar
  • 133
7 votes
0 answers
681 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
user avatar
4 votes
1 answer
634 views

Determine if an ELF file is signed or not

I need some help in determining if an ELF file is signed or with a valid signature or not. I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
user avatar
2 votes
1 answer
271 views

Help with a packed date format

I've came across what appears to be a date format from a legacy database application. I don't have access to the code that generated it, just have examples corresponding to certain Holiday messages. ...
user avatar
  • 21
7 votes
5 answers
2k views

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the ...
user avatar
  • 1,432
0 votes
1 answer
875 views

PE: Strange entry in debug directory (Type: 0xc)

Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here. I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2. Now I have ...
user avatar
  • 1,432
4 votes
1 answer
3k views

Reverse Engineering Windows PowerBuilder Binaries

I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
user avatar
4 votes
1 answer
1k views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
user avatar
  • 101
1 vote
0 answers
274 views

reverse engineer BE126 boot-loader

I am trying to reverse engineer the firmware upgrading process of BE126 wifi repeater which has a MIPS CPU. I couldn't find a firmware upgrade image in the manufacturer site. I have the toolchain ...
user avatar
2 votes
1 answer
1k views

How do reverse engineers commonly detect the format of binary data?

Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, ...
user avatar
  • 123
0 votes
1 answer
72 views

How to find out where an application stores the resolutions it allows?

Many applications (in particular most games) offer a set of resolutions to choose from. Some of them are pretty open and allow basically every resolution the underlying system seems to be capable of, ...
user avatar
  • 103
0 votes
1 answer
2k views

Extracting embedded dlls from .NET executable

I have a .NET executable that apparently has some embedded DLLs. It's just one standalone executable. I opened this executable with JetBrains dotPeek and ILSPY, both decomiplier are showing DLL names ...
user avatar
3 votes
2 answers
298 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
user avatar
2 votes
1 answer
7k views

Adding a new PE section for a code cave

I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
user avatar
  • 177
5 votes
3 answers
7k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
user avatar
  • 223
3 votes
1 answer
9k views

Locating entry point in specific firmware .bin file using IDA Pro

I am trying to become familiar with IDA by reversing a .bin file that I have compiled myself. The code is written in cpp and the open source code can be found here: https://github.com/openxc/vi-...
user avatar
  • 33
0 votes
1 answer
103 views

Order of architecture headers in fat (universal) executables

I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding ...
user avatar
1 vote
1 answer
954 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
user avatar
  • 1,432
7 votes
1 answer
334 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
user avatar
2 votes
1 answer
1k views

Given a program binary, how can I know which compiler it is compiled from?

Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis. My question is that, given a binary, is there any way I can determine ...
user avatar
4 votes
1 answer
424 views

Challenging variable-length integer encoding

I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format: number ...
user avatar
  • 141
6 votes
1 answer
530 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
user avatar
2 votes
1 answer
2k views

Calculating check sum of m-bus data frame

I'm trying to calculate the check sum of a m-bus data frame. In page 1 of this PDF I'm able to read that the frame's check sum "is calculated from the arithmetical sum of the data mentioned above, ...
user avatar
  • 135
1 vote
0 answers
1k views

Converting Duden dictionaries for Stardict/Goldendict

I’ve a bunch of first-class German dictionaries by Duden (the main German dictionary publisher) which, sadly, use a closed proprietary data format and their dedicated Duden-Bibliothek application (...
user avatar
9 votes
1 answer
3k views

How to read NSCR1000 data files?

Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState. I did the backup of the file before the ...
user avatar
  • 435
2 votes
1 answer
1k views

What kind of compression/obfuscation algorithm is this?

I have a couple of streams that look pretty odd within a DICOM file. In a few words, DICOM is very close to what binary XML would look like. Almost all of the information from those DICOM files are ...
user avatar
  • 323
2 votes
0 answers
415 views

Finding the h.264 stream in a bytestream

I have a bytestream that contains h.264 bytestream packets in it. How can I find it? Output from stream: https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY The first 13 bytes ...
user avatar