Questions tagged [encodings]

A mapping of a given code to values or semantics. Guessing the meaning of an encoding requires a lot of trials but some encoding are standard and can be guessed quite easily.

Filter by
Sorted by
Tagged with
2 votes
1 answer
427 views

Decode bitmaps from Director .dxr files

I'm trying to extract bitmaps from an old Macromedia Director protected .dxr file. I was able to find some information about the file structure from here (it turns out to be a XFIR container, the ...
0 votes
0 answers
35 views

Unknown string encoding

I'm new to reverse, my question may be stupid. I am trying to reverse a function in the application that reads a string at the address and concatenate it to another char[250] v30; char[20] v31; ... ...
2 votes
1 answer
95 views

The Logic Of Incremental Data on Serial Communication Encoding

These are the serial communication reverse values. I am trying to understand the logic behind this. I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct. I tried ...
0 votes
0 answers
57 views

How to replicate this encoding algorithm

I am writing a helper script at work for when new people start work and need help setting up respective applications - the application will write configuration files to be loaded into the various ...
1 vote
0 answers
70 views

Reverse engineering from sets of data

I'm starting in the world of reverse engineering, for educational purpose, by studying a (supposed-to-be) relatively simple system as black-box. The system uses a NFC Mifare 1k badge to store ...
8 votes
1 answer
1k views

Reverse engineer TPMS sensor data

I'm trying to reverse engineer data received from TPMS (car tire pressure) sensors. I was able to receive and demodulate the data (433 MHz, FSK, Manchester encoding). Probable packet fields: bytes 1-...
1 vote
1 answer
58 views

Keycode from a serial PDA keyboard (iPAQ G750)

I have a folding PDA keyboard (model number iPAQ G750). It is using a proprietary serial protocol, I want to adapt it to Bluetooth using a micro controllers. The keyboard sends out a 2-byte keycode ...
0 votes
0 answers
39 views

Help on identifying encryption/encoding scheme

I am trying to find the encryption used in a legacy database. The db is from 2003, and it is stored on a dbf (FoxPro) file. The following are supposed to be ZIP numbers, more specifically, are ...
0 votes
0 answers
27 views

Why would unreadable data recovered from a drive be non-recoverable?

I ran Disk Drill on a drive that was a member in a failed software RAID mirror on macOS. The drive seemed to be fine, but was showing up as "uninitialised", so the drive didn't fail as such ...
0 votes
2 answers
967 views

Can you get the error-correction level of a QR code?

You can get the version number of a QR (1-40) by checking the dimensions of the QR, but is there a way to get the error-correction level that was used to generate the QR code? Trying to reverse ...
0 votes
0 answers
38 views

Agilent Gen5 files

Does anyone know how to decode these agilent gen5 files for detection (xpt), or know of a tool/script that can extract the information? They have some example files on their website. https://www....
6 votes
2 answers
22k views

Trying to decode the Ontario Driver's License #

**The Ontario Driver's License follows the below format:** LXxxx-FFFMY-YMMDD Where: L is the first letter of your last name X is a numeric encoding of the last name (See Chart 1 below) xxx is a ...
1 vote
1 answer
66 views

Unsure how LZSS compression is assigning dictionary references

I am having trouble understanding how this LZSS compression assigns dictionary match references. This particular LZSS compression algorithm has a dictionary space of 4096 bytes that are assigned 0 to ...
1 vote
0 answers
168 views

How can I extract the timestamp from this bytestring?

I am missing a piece of the puzzle that is the TCP protocol the Battlefield Bad Company games use to transfer dogtag records to/from the FESL backend. The general packet structure is quite clear and I ...
1 vote
2 answers
1k views

Reverse engineering a base64 encoded number

I am working on reverse engineering an encoding. A number between -12 and 12, with 2 decimals is encoded using an unknown method, and the result is a pair of strings as follows: value string1 ...
1 vote
0 answers
143 views

How to identify encoding algorithm used

I'm using a calendar application, and each date is encoded. I would like to know which algorithm has been used to do this. Example: I have a date: 05-10-2023 ('mm-dd-yyyy') and it's encoded string is ...
2 votes
1 answer
174 views

433MHz Protocol: Unknown Three-Symbol-Encoding within the OOK data

Reverse engineering the protocol of a remote-controlled wall socket (433MHz On-Off-Keying) revealed an embedded pattern which apparently uses three symbols (besides 0s). Symbol A = 000001 Symbol B = ...
2 votes
0 answers
99 views

Android game reverse http request body

I'm trying to reverse request that are made to an android game to learn more about how it works. I was able to find endpoints requests that are made with frida and mitmproxy but now I'm stuck because ...
3 votes
1 answer
61 views

GNU strings with --encoding=S

I have two binaries. Both contain the string "precondition failed" (without the quotes). The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
1 vote
0 answers
168 views

Decode encoded XHR/Ajax response payload

I'm trying to access a site using it's API with Insomnia client, but some XHR responses are encoded, it seems. I don't know the exact algorithm that's being used (but it's not base64, I tried decoding)...
1 vote
0 answers
175 views

What is the URL format for Google Trends?

When you search for the search term Tesla or AOL you get the following URLs: https://trends.google.com/trends/explore?geo=US&q=Tesla But, for the automobile maker, you get: https://trends.google....
3 votes
1 answer
202 views

Simplifying and reversing an encryption/decryption algorithm in ASM X86 / Python

I'm trying to reverse a decoding function in order to produce the function for encoding (for the curious this is a save game for a legacy adventure game which use codes for saving). So far I have ...
4 votes
0 answers
1k views

Reverse engineering and exactly re-creating a QR code

The Casio FX-991EX calculator has a QR code feature for accessing the current equation from another device. It supports version 3 QR codes for some menus and version 11 for most menus. For example, ...
1 vote
0 answers
77 views

Invalid "Variation" of a base64 encoding

I am starring at the following which looks like base64 but not quite: t=base64.b64decode('gAKrEgADAAFwEgACAAFwEgACAAhmYWlybmVzcxIACQAGcmVzdWx0B0ANMzMzMzMzAAZudW1iZXIHQHdO+...
5 votes
2 answers
2k views

Decoding the wire protocol (over RS232) for custom hardware <-> windows application?

Background I have a hardware device with an RS232 port, and a Windows (XP) application that it talks to. No OS-level drivers beyond basic serial, so all the decoding is done in the app. I have the ...
1 vote
1 answer
618 views

Decoding API response of unknown encoding?

I'm using Proxyman to inspect the api requests of an app I use. Most of the data is returned in plain JSON blobs but there is one response which is returning data encoded/encrypted. How can I go ...
2 votes
0 answers
20 views

Encoding scheme identification of the following communication message

I'm trying to RE an app for educational purposes. So here is the behavior of the app. When the app starts, it communicate with a server in plain tcp and based on those tcp messages, it either work as ...
0 votes
0 answers
101 views

Reverse engineering what seems to be a checksum used for RS232 packets

I will try to be as concise as possible: the issue is, I'm trying to develop a custom application for a dielectric tester. I have access to the original program, which was made some 20 years ago or ...
1 vote
1 answer
417 views

2-byte checksum

I cannot figure out what checksum is used for the following communication. As I understand, 450D is the “stop” part. It doesn't change no matter what. And the two bytes before 450D are the “checksum”. ...
0 votes
0 answers
242 views

QR-Codes of Temial-Teamachine

I have a tea-machine that reads QR-Codes and brews the tea accordingly. I want to generate my own codes. I have the following codes (and more): Copy/Paste of the C-Column L7UMQRQCQAZBD OYXPVAANAB4ZE ...
0 votes
1 answer
85 views

Unknown binary format of a b64-encoded list of doubles

While reverse engineering a database middleware. This is presumably encoding a list of double or float values with Base64 encoding and then compressing it. Via zlib.decompress() I was able to ...
0 votes
0 answers
270 views

Decoding Game data

I am very new to this whole business so please bear with me. Goal: Am trying to decode data from a post request from game to server starting with Q0. Most of the game data is encoded in Base64, but ...
1 vote
0 answers
313 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
5 votes
6 answers
69k views

Decoding New Jersey Driver's License Codes

Driver's License numbers in New Jersey aren't random. They follow the format: Affff lllii mmyye, where A is the first letter of the person's last name, ffff is some mapping of the remaining letters of ...
1 vote
1 answer
136 views

What encoding is this?

This is a picture of the encoded code. I'm just wondering what is the encoding that it is using.
-2 votes
2 answers
1k views

CyberChef Challenge #21

The challenge data/input is: ...
1 vote
1 answer
2k views

How to find encrypted strings in an executable?

I am trying to reverse engineer an executable. I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running. The two dumps return a ...
1 vote
2 answers
2k views

How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?

The context: For a student project which goal is to make us learn reverse engineering and how to use IDA Pro, we have to reverse engineer the APT28 hospitality malware (as described in this blog post: ...
0 votes
1 answer
63 views

Encoding of 64-bit double

I'm in the process of reverse engineering a USB driver, and I'm having problems finding a way to decode the binary representation of double values. The values don't seem to be encoded in IEEE-754 ...
3 votes
3 answers
2k views

Reverse engineering a partially known binary format

I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by datetime (accurate down to ...
0 votes
0 answers
1k views

Decoding messages sent/received by Python websocket client

I am using the websocket module for my client in python3, and I am trying to troubleshoot some errors I am getting that lead to the client disconnecting after seemingly random intervals. When I ...
0 votes
0 answers
77 views

Looking for encoding of SVG data

I have some SVG images stored in a database; but I am not able to find out which encoding is used. Unfortunately, I don't have the exact SVG plain text available. The given examples "probably&...
0 votes
1 answer
80 views

Password evaluated from the sum of ASCII letters

After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
1 vote
3 answers
989 views

Find out how a program is reading a file

I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...
0 votes
0 answers
91 views

What kind of integer obfuscation is this?

I'm looking at the network traffic of a game submitting the user's score to the high-score server. The score value seems to be obfuscated in some way. The score is a non-negative integer, and not more ...
2 votes
3 answers
3k views

How to monitor/reverse engineer RS485-connected display device traffic?

Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system? I have a large 12V lithium battery module which has an internal BMS and ...
1 vote
0 answers
274 views

Determining the encoding of an unknown image format [closed]

I'm trying to reverse engineer a REST API and there is an endpoint that delivers images. Some of them are jpegs but other ones look like they're base64 encoded, except they don't appear to be, as they ...
11 votes
1 answer
4k views

Generating Snapchat Snaptags ("QR" Codes)

For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called "Snaptags". ...
2 votes
1 answer
128 views

The questions about li instruction

When reversing a MIPS binary using IDA Pro, I have 2 questions. The source code is as follows. int main(int argc, char* argv[]) { int m = 1; int n = 5; printf("sum = %d\n", m+n); } ....
2 votes
2 answers
563 views

How can I identify how this string is being encoded so I can replicate it?

A friends company uses an old VB6 application to generate encoded strings to then use in their also old and out of date database system. They have the application running in standalone mode so I can ...