Questions tagged [binary-format]
Refer to the hexadecimal format which is directly executed by the CPU or the interpreter. Opposed to the human-readable format which can be understood by the reverse without any intermediate translation.
69
questions
10
votes
2
answers
4k
views
How to read NSCR1000 data files?
Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState.
I did the backup of the file before the ...
- 465
8
votes
0
answers
889
views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
- 81
7
votes
2
answers
2k
views
Reverse engineering file containing sprites
I'm trying to reverse engineer a file that contains sprites. I want to extract the sprites out of the file. So far I've managed to find some kind of line end sequence, and with this I've been able to ...
- 75
7
votes
5
answers
3k
views
How to find out if PE executable was compiled with gcc or VisualStudio?
I looked at two ways so far. Both did not convince me in regard to false positives or false negatives:
Using strings: How to retrieve the GCC version used to compile a given ELF executable?
Using the ...
- 1,550
7
votes
1
answer
1k
views
Determine if an ELF file is signed or not
I need some help in determining if an ELF file is signed or with a valid signature or not.
I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
- 71
7
votes
1
answer
345
views
Byte frequencies in different architectures' binaries?
what I'm looking for
I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
- 281
6
votes
2
answers
207
views
What time structure is this?
I have an existing software, with no source and possible editing. It contains a grid (looks like an old DevExpress one, the software itself is created in Delphi 7). Grid content is stored in the ...
- 61
6
votes
3
answers
9k
views
How to SUCCESSFULLY add a code section to an executable file in Linux?
I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work.
I need to add a section to an already compiled binary. Lets say for a moment is an ...
- 243
6
votes
1
answer
542
views
Difference between Win7 and Win8 PE loader?
Is it known what the differences between the Window 7 and Windows 8 PE loader are?
I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
- 163
5
votes
1
answer
397
views
What kind of date stamp is this?
I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.
There are 2 values in one file (reversed ...
- 53
5
votes
1
answer
86
views
Decoding a time format
I'm reverse engineering a hardware device which stores time a strange format:
32-bit word
H:MM:SS (rounded)
0x03200000
0:00:00
0x09700000
0:00:00
0x0A1B0000
0:00:01
0x0A160000
0:00:01
0x0B098000
...
- 153
5
votes
1
answer
87
views
Why do the first bytes of this executable contain a path to busybox?
I'm reverse engineering an old TP-Link TD-W9970v3 router for fun and wanted to examine one of the executables called webWarn. Ghidra was unable to recognise the format, which surprised me. I then ...
- 151
4
votes
1
answer
2k
views
If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?
Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
- 101
4
votes
1
answer
473
views
Challenging variable-length integer encoding
I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format:
number ...
- 141
4
votes
1
answer
4k
views
Reverse Engineering Windows PowerBuilder Binaries
I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
- 397
4
votes
1
answer
289
views
Some help with sprite graphic
I am trying to get the sprites from a game from 1997 called Swing (US: Marble Master). The file is called NORMAL.SET and contains a set of sprites. There is an executable named SHOWSET.EXE that ...
- 151
3
votes
1
answer
9k
views
Adding a new PE section for a code cave
I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
- 187
3
votes
1
answer
1k
views
Win64 .pdata required to be a separate COFF section?
It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping ...
- 2,010
3
votes
2
answers
334
views
Problem with converting hex values to decimal
I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
- 33
3
votes
1
answer
4k
views
Decode C# binary serialization data
I am trying to decode what seems to be simple C# binary serialization to disk:
https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw
https://github.com/malaterre/MMCPrivate/raw/master/...
- 375
3
votes
1
answer
10k
views
Locating entry point in specific firmware .bin file using IDA Pro
I am trying to become familiar with IDA by reversing a .bin file that I have compiled myself. The code is written in cpp and the open source code can be found here: https://github.com/openxc/vi-...
- 33
3
votes
0
answers
56
views
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:
arm-none-...
3
votes
0
answers
110
views
Trying to understand a simple compiled PSI binary file
I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
- 253
3
votes
0
answers
133
views
Interpreting clipboard data from HMI software
I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs.
Long story short, I need the ability to fill the ...
- 133
2
votes
1
answer
803
views
Windows boot process doesn't make sense!
Here is my question: How can the Windows 7, 8, etc. boot process work?
The first piece of code loaded from the volume boot sector of the OS is bootmgr.exe. But here's why this doesn't make sense:
An ...
2
votes
2
answers
1k
views
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
I load the entire PE into an std::vector<Byte> fileContent using std::fstream.
Then I obtain the executable's dos header:
IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
- 175
2
votes
1
answer
1k
views
What kind of compression/obfuscation algorithm is this?
I have a couple of streams that look pretty odd within a DICOM file. In a few words, DICOM is very close to what binary XML would look like. Almost all of the information from those DICOM files are ...
- 375
2
votes
1
answer
291
views
Unknown archive format from QNX operating system
We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
- 253
2
votes
1
answer
2k
views
How do reverse engineers commonly detect the format of binary data?
Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, ...
- 123
2
votes
1
answer
96
views
Need help decoding bytes to number
I've got a really really old file format from an accounting software, late '70s, DOS, QBasic or QuickBasic. Source code is lost, only .exe file remaining, file needs emulator.
The file formate seems ...
- 141
2
votes
1
answer
1k
views
Given a program binary, how can I know which compiler it is compiled from?
Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis.
My question is that, given a binary, is there any way I can determine ...
- 2,475
2
votes
1
answer
3k
views
Calculating check sum of m-bus data frame
I'm trying to calculate the check sum of a m-bus data frame. In page 1 of this PDF I'm able to read that the frame's check sum "is calculated from the arithmetical sum of the data mentioned above, ...
- 135
2
votes
1
answer
108
views
Extra bytes between clusters in FAT12
I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
- 123
2
votes
1
answer
411
views
Missing addresses from relocation section of ASLR enabled PE binary
I'm analyzing entries in the relocation section of a binary. In particular, I want to know if all the targets of jumps have a corresponding entry in the relocation section. The screenshot shows the ...
- 67
2
votes
1
answer
321
views
Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?
I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
- 21
2
votes
1
answer
359
views
Has anyone encountered PNGs where the chunk data is encrypted/compressed?
I've come across some files which are used in a car's satellite navigation system. Looking at the files in a hex editor shows the ‰PNG signature, but the chunks do not follow the format spec - for ...
- 243
2
votes
1
answer
201
views
Decoding unknown ID format parts
I have a data set where events have a unique ID. Some examples:
CkUKGkNNZmY1TkhObi1zQ0ZWT0h3Z0VkaExJQ0xnEidDSlB0bG9UTG4tc0NGWmhpaXdvZDFxOE5fdzE1OTc1NzY4NzU4Mzg%3D
...
- 133
2
votes
1
answer
281
views
Help with a packed date format
I've came across what appears to be a date format from a legacy database application.
I don't have access to the code that generated it, just have examples corresponding to certain Holiday messages.
...
- 21
2
votes
0
answers
41
views
What format could this image mask be?
So I'm looking at these sprite files from a type of virtual world format that's no longer around. They appear to be JPEGs with some custom markers, one of which appears to be an alpha mask. Here's ...
- 153
2
votes
0
answers
38
views
Find out what is this binary database entry and what format it is
the following varbinary "BUFFER" of a database entry is for an article.
FIELD_0 is in plain text and the item name is "1", which I created with the item management software.
[...
- 21
2
votes
0
answers
83
views
Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles
I have a weird bug that causes this crap:
There are plenty of dumb "solutions" a-la "turn it off and on" but none of them work and/or relevant, the shell apps simply refuse to ...
- 31
2
votes
0
answers
167
views
Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU
I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware.
Does anyone know which ...
- 21
2
votes
0
answers
249
views
Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes
I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse.
When developing ...
- 485
2
votes
0
answers
447
views
Finding the h.264 stream in a bytestream
I have a bytestream that contains h.264 bytestream packets in it. How can I find it?
Output from stream:
https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY
The first 13 bytes ...
1
vote
1
answer
1k
views
Reverse Engineer Video File Format [closed]
I have recorded a video from a set top box which I am not able to see on my computer/laptop. I have already tried multiple video converter softwares and converting it too.
Please !! I would really ...
- 21
1
vote
1
answer
106
views
Name other than ".text" for the main code section
Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
- 1,550
1
vote
2
answers
2k
views
Trying to rip the sprites of this game
I am currently trying to rip the sprites from an Nintendo DS game called Cookie Shop - Create Your Dream Shop but they are all in _LZ.bin files.
When I've unpacked its compression, I could see lots ...
- 21
1
vote
1
answer
1k
views
Function dependencies in static libraries
I read in another SO thread:
With static libraries, the unit of copying is the object file in the
library.
In other words, if two programs call a function from a certain object file, both ...
- 1,550
1
vote
1
answer
143
views
Which JSON object compact binary serialization is this?
I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server.
Does anyone recognize this? I've attached the first ...
- 11
1
vote
1
answer
303
views
how can I know if PE file has appended data or not?
while doing this, I dont know the whole file size (pe size + appended data size)
my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.
- 11