Questions tagged [binary-format]

Refer to the hexadecimal format which is directly executed by the CPU or the interpreter. Opposed to the human-readable format which can be understood by the reverse without any intermediate translation.

Filter by
Sorted by
Tagged with
10 votes
1 answer
4k views

How to read NSCR1000 data files?

Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState. I did the backup of the file before the ...
  • 445
7 votes
5 answers
2k views

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the ...
  • 1,456
7 votes
1 answer
336 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
7 votes
0 answers
749 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
6 votes
1 answer
532 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
5 votes
2 answers
2k views

Reverse engineering file containing sprites

I'm trying to reverse engineer a file that contains sprites. I want to extract the sprites out of the file. So far I've managed to find some kind of line end sequence, and with this I've been able to ...
  • 55
5 votes
2 answers
200 views

What time structure is this?

I have an existing software, with no source and possible editing. It contains a grid (looks like an old DevExpress one, the software itself is created in Delphi 7). Grid content is stored in the ...
  • 51
5 votes
1 answer
383 views

What kind of date stamp is this?

I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are. There are 2 values in one file (reversed ...
5 votes
3 answers
7k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
  • 223
4 votes
1 answer
1k views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
  • 101
4 votes
1 answer
431 views

Challenging variable-length integer encoding

I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format: number ...
  • 141
4 votes
1 answer
750 views

Determine if an ELF file is signed or not

I need some help in determining if an ELF file is signed or with a valid signature or not. I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
4 votes
1 answer
3k views

Reverse Engineering Windows PowerBuilder Binaries

I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
4 votes
1 answer
246 views

Some help with sprite graphic

I am trying to get the sprites from a game from 1997 called Swing (US: Marble Master). The file is called NORMAL.SET and contains a set of sprites. There is an executable named SHOWSET.EXE that ...
  • 151
3 votes
1 answer
8k views

Adding a new PE section for a code cave

I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
  • 187
3 votes
1 answer
1k views

Win64 .pdata required to be a separate COFF section?

It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping ...
  • 1,970
3 votes
2 answers
308 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
3 votes
1 answer
3k views

Decode C# binary serialization data

I am trying to decode what seems to be simple C# binary serialization to disk: https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw https://github.com/malaterre/MMCPrivate/raw/master/...
  • 375
3 votes
1 answer
9k views

Locating entry point in specific firmware .bin file using IDA Pro

I am trying to become familiar with IDA by reversing a .bin file that I have compiled myself. The code is written in cpp and the open source code can be found here: https://github.com/openxc/vi-...
  • 33
3 votes
0 answers
38 views

Why do the first bytes of this executable contain a path to busybox?

I'm reverse engineering an old TP-Link TD-W9970v3 router for fun and wanted to examine one of the executables called webWarn. Ghidra was unable to recognise the format, which surprised me. I then ...
3 votes
0 answers
114 views

Interpreting clipboard data from HMI software

I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs. Long story short, I need the ability to fill the ...
  • 133
2 votes
1 answer
757 views

Windows boot process doesn't make sense!

Here is my question: How can the Windows 7, 8, etc. boot process work? The first piece of code loaded from the volume boot sector of the OS is bootmgr.exe. But here's why this doesn't make sense: An ...
2 votes
2 answers
1k views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
  • 175
2 votes
1 answer
1k views

What kind of compression/obfuscation algorithm is this?

I have a couple of streams that look pretty odd within a DICOM file. In a few words, DICOM is very close to what binary XML would look like. Almost all of the information from those DICOM files are ...
  • 375
2 votes
1 answer
234 views

Unknown archive format from QNX operating system

We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
  • 233
2 votes
1 answer
1k views

How do reverse engineers commonly detect the format of binary data?

Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, ...
  • 123
2 votes
1 answer
75 views

Need help decoding bytes to number

I've got a really really old file format from an accounting software, late '70s, DOS, QBasic or QuickBasic. Source code is lost, only .exe file remaining, file needs emulator. The file formate seems ...
  • 141
2 votes
1 answer
1k views

Given a program binary, how can I know which compiler it is compiled from?

Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis. My question is that, given a binary, is there any way I can determine ...
2 votes
1 answer
2k views

Calculating check sum of m-bus data frame

I'm trying to calculate the check sum of a m-bus data frame. In page 1 of this PDF I'm able to read that the frame's check sum "is calculated from the arithmetical sum of the data mentioned above, ...
  • 135
2 votes
1 answer
99 views

Extra bytes between clusters in FAT12

I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
  • 123
2 votes
1 answer
393 views

Missing addresses from relocation section of ASLR enabled PE binary

I'm analyzing entries in the relocation section of a binary. In particular, I want to know if all the targets of jumps have a corresponding entry in the relocation section. The screenshot shows the ...
  • 67
2 votes
1 answer
193 views

Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?

I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
  • 21
2 votes
1 answer
298 views

Has anyone encountered PNGs where the chunk data is encrypted/compressed?

I've come across some files which are used in a car's satellite navigation system. Looking at the files in a hex editor shows the ‰PNG signature, but the chunks do not follow the format spec - for ...
2 votes
1 answer
274 views

Help with a packed date format

I've came across what appears to be a date format from a legacy database application. I don't have access to the code that generated it, just have examples corresponding to certain Holiday messages. ...
  • 21
2 votes
0 answers
45 views

Trying to understand a simple compiled PSI binary file

I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
2 votes
0 answers
57 views

Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles

I have a weird bug that causes this crap: There are plenty of dumb "solutions" a-la "turn it off and on" but none of them work and/or relevant, the shell apps simply refuse to ...
  • 31
2 votes
0 answers
132 views

Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware. Does anyone know which ...
  • 21
2 votes
0 answers
189 views

Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes

I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse. When developing ...
2 votes
0 answers
424 views

Finding the h.264 stream in a bytestream

I have a bytestream that contains h.264 bytestream packets in it. How can I find it? Output from stream: https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY The first 13 bytes ...
1 vote
1 answer
1k views

Reverse Engineer Video File Format [closed]

I have recorded a video from a set top box which I am not able to see on my computer/laptop. I have already tried multiple video converter softwares and converting it too. Please !! I would really ...
1 vote
1 answer
78 views

Name other than ".text" for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
  • 1,456
1 vote
2 answers
1k views

Trying to rip the sprites of this game

I am currently trying to rip the sprites from an Nintendo DS game called Cookie Shop - Create Your Dream Shop but they are all in _LZ.bin files. When I've unpacked its compression, I could see lots ...
  • 21
1 vote
1 answer
1k views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
  • 1,456
1 vote
1 answer
128 views

Which JSON object compact binary serialization is this?

I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server. Does anyone recognize this? I've attached the first ...
  • 11
1 vote
1 answer
190 views

how can I know if PE file has appended data or not?

while doing this, I dont know the whole file size (pe size + appended data size) my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.
1 vote
0 answers
31 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
1 vote
0 answers
117 views

What type of file has the file signature 'BOOT'?

I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
  • 61
1 vote
1 answer
178 views

Decoding unknown ID format parts

I have a data set where events have a unique ID. Some examples: CkUKGkNNZmY1TkhObi1zQ0ZWT0h3Z0VkaExJQ0xnEidDSlB0bG9UTG4tc0NGWmhpaXdvZDFxOE5fdzE1OTc1NzY4NzU4Mzg%3D ...
1 vote
0 answers
39 views

.NET manifest resource format

Currently I'm writing a parser for .NET files and stuck on manifest resources. My main resources: Huge documentation Short summary For resource format I have found this project made in 2005, all ...
  • 789
1 vote
0 answers
297 views

reverse engineer BE126 boot-loader

I am trying to reverse engineer the firmware upgrading process of BE126 wifi repeater which has a MIPS CPU. I couldn't find a firmware upgrade image in the manufacturer site. I have the toolchain ...