Questions tagged [encodings]
A mapping of a given code to values or semantics. Guessing the meaning of an encoding requires a lot of trials but some encoding are standard and can be guessed quite easily.
102
questions
13
votes
2
answers
17k
views
IDA Convert to Unicode
In IDA 5.0 Freeware how do you convert a block of data into a unicode string, the only thing I can find is to convert it into an ascii string.
db 'a'
db 0
db 'b'
db 0
db 'c'
db 0
db 'd'
db 0
db 0
db ...
13
votes
1
answer
4k
views
How should I approach reverse engineering this text encoding?
So I'm trying to hack the translation from the PS4 version of a game into the Vita version. The script files were conveniently uncompressed, and I was able to drop them in and have it working without ...
13
votes
3
answers
8k
views
Totally unknown file analysis approaches
I guess this is the worst case. I have a file which was initially base64 encoded. This step was easy. But now all I can see is a bunch of rubbish. No structure, nearlly a maximum of entropy, no ...
11
votes
1
answer
4k
views
Generating Snapchat Snaptags ("QR" Codes)
For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called "Snaptags". ...
9
votes
1
answer
1k
views
Need help to reverse engineer a dog collar transmitter
I have a Petrainer PET998DRU shock collar (similar to this one) that got partially chewed up by the dog it is supposed to train. I salvaged it to the point where I have the following buttons:
Mode (...
8
votes
1
answer
1k
views
Reverse engineer TPMS sensor data
I'm trying to reverse engineer data received from TPMS (car tire pressure) sensors. I was able to receive and demodulate the data (433 MHz, FSK, Manchester encoding).
Probable packet fields:
bytes 1-...
7
votes
2
answers
3k
views
Retrieving encryption/encoding logic from dll
I am trying to retrieve a decrypting/deconing logic from a program. Unfortunately I have virtually no experiencing in reverse engineering.
I am building an alternative controller application for a ...
6
votes
1
answer
133
views
Storing barcodes as ASCII
I am currently looking at a TIFF file generated by a microscope vendor. They store an XML within the TIFF (ImageDescription tag). Within this XML I can find a <barcode> element. But instead of ...
6
votes
2
answers
22k
views
Trying to decode the Ontario Driver's License #
**The Ontario Driver's License follows the below format:**
LXxxx-FFFMY-YMMDD
Where:
L is the first letter of your last name
X is a numeric encoding of the last name (See Chart 1 below)
xxx is a ...
6
votes
1
answer
4k
views
Printing Unicode strings in Gdb in OSX
Are there any useful snippets or Gdb functions that you guys normally use to print out Unicode strings? I'm trying to debug Mach-O binaries and x/s seems to be printing out junk. I believe the default ...
5
votes
6
answers
69k
views
Decoding New Jersey Driver's License Codes
Driver's License numbers in New Jersey aren't random. They follow the format: Affff lllii mmyye, where A is the first letter of the person's last name, ffff is some mapping of the remaining letters of ...
5
votes
3
answers
2k
views
Does anyone know this encoding?
There is an interesting article on Phack:
http://phrack.org/issues/69/15.html#article
At the end of the article there is the source appended in a strange encoding.
begin 664 hypervisor_for_rootkit....
5
votes
2
answers
2k
views
Decoding the wire protocol (over RS232) for custom hardware <-> windows application?
Background
I have a hardware device with an RS232 port, and a Windows (XP) application that it talks to. No OS-level drivers beyond basic serial, so all the decoding is done in the app.
I have the ...
5
votes
0
answers
649
views
Reverse engineering an hydrometer's Bluetooth communication
This is a very specific question.
I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
4
votes
1
answer
1k
views
Reverse engineer checksum algorithm
I am trying to reverse-engineer the protocol used between my Air-conditioner and the wired control unit on my wall. (In order to have my home automation be able to monitor and control the A/C.)
The ...
4
votes
1
answer
333
views
Does anyone recognize this keyboard encoding scheme?
I am finalizing the reverse-engineering of a linux driver for the Perixx MX-2000 IIB mouse. One of the features the mouse has is arbitrary button mapping. I can assign a button to produce various keys ...
4
votes
1
answer
442
views
What is contained in this transmission? (RF pool-temperature sensor base unit receiver)
Note: I've made progress over at the EE stackexchange on pulling bits out of the signal (see https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal), but now i ...
4
votes
0
answers
1k
views
Reverse engineering and exactly re-creating a QR code
The Casio FX-991EX calculator has a QR code feature for accessing the current equation from another device. It supports version 3 QR codes for some menus and version 11 for most menus.
For example, ...
3
votes
1
answer
595
views
How can I determine if a piece of code is an encryption algorithm?
I am trying to reverse engineer a malware, and came across a piece of code that I suspect is an encryption/decryption procedure, however I do not know for sure. I can recognize that it extracts its ...
3
votes
1
answer
144
views
What is the encoding format for unconditional Jumps on SPARC/SPARC64?
I am trying to figure out the encoding for unconditional JMPs on SPARC, i.e the JMP. After disassembling a few binaries.
In my IDA disassembly the encoding for JMP %g1 is:
81 c0 40 00
Digging ...
3
votes
2
answers
1k
views
Translating a Korean Exclusive PS2 game ~ hangeul encoding?
I got my hands on a copy of Mystic Nights, a survival horror game for the PS2 realeased exclusively in Korea. The game's text is all in Hangeul (Korean writting system). I extracted the ISO and ...
3
votes
1
answer
61
views
GNU strings with --encoding=S
I have two binaries. Both contain the string "precondition failed" (without the quotes).
The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
3
votes
3
answers
2k
views
Reverse engineering a partially known binary format
I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by datetime (accurate down to ...
3
votes
2
answers
394
views
sub-ghz radio encoding 6 bits
I have a usb stick that communicates with a medical device. I am attempting to decode the communication. I have figured out the basic radio parameters (916.5MHz, ook, bit rate, preamble, sync words), ...
3
votes
1
answer
202
views
Simplifying and reversing an encryption/decryption algorithm in ASM X86 / Python
I'm trying to reverse a decoding function in order to produce the function for encoding (for the curious this is a save game for a legacy adventure game which use codes for saving).
So far I have ...
3
votes
1
answer
2k
views
String Encoding and Decoding Method
so I came across the following string encoding method in python.
def encode(the_string):
encoded_string = ''
rotations = ord(the_string[-1]) + 5
for i in range(0, len(the_string)):
...
3
votes
1
answer
127
views
Is there a standard character encoding that is ASCII minus control characters?
I came across some unusual strings in some embedded SH2A code I'm analyzing....
11 53 54 00 53 55 4E 44 41 59 00 4F 46 00 2E 4F 56 45 4D 42 45 52
. S T . S U N D A Y . O F . . O V E ...
3
votes
0
answers
138
views
Recognize this encoding (in a serialization context)?
I am currently trying to reverse engineer a proprietary serialization format. In some of the sections the encoding is unknown to me. What I was able to figure out:
1 byte 0b00?????? "6bit signed int" ...
3
votes
0
answers
1k
views
Radio Signal 433.92MHz ASK OOK modulation, encoding?
Considering a key fob for RKE (remote keyless entry, automotive) its signal has been captured:
It sends at 433,92MHz simple on/off.
Following I regard the deltas (time differences between on-off or ...
2
votes
2
answers
563
views
How can I identify how this string is being encoded so I can replicate it?
A friends company uses an old VB6 application to generate encoded strings to then use in their also old and out of date database system.
They have the application running in standalone mode so I can ...
2
votes
2
answers
357
views
Issues writing a bootloader in x86 16-bit machine code
I am having trouble displaying simple text.
I am trying to do it all in machine code with INT 10h, but:
I can't find the binary opcode for INT 10h anywhere in the Intel Manual.
I can't figure out how ...
2
votes
2
answers
3k
views
Techniques for reverse engineering an unknown or protected file format
I'm working on converting a game originally developed to run on Windows for the web. I have a bunch of artwork for the game received from the artist in .tga image files which open fine in Photoshop. ...
2
votes
1
answer
128
views
The questions about li instruction
When reversing a MIPS binary using IDA Pro, I have 2 questions.
The source code is as follows.
int main(int argc, char* argv[])
{
int m = 1;
int n = 5;
printf("sum = %d\n", m+n);
}
....
2
votes
1
answer
150
views
How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?
I'm attempting to use a legacy systems recovery feature that typically required calling/faxing a company that is no longer around.
Basically, the system was designed to go into a recovery mode and ...
2
votes
1
answer
1k
views
Deducing Protobuf Schema and Datatypes
I have a number of protobuf files but no .proto schema file!
cat myfile.pbuf | protoc --decode_raw > outputfile.txt
Using the above command, I was able to decode the file into a somewhat readable ...
2
votes
3
answers
3k
views
How to monitor/reverse engineer RS485-connected display device traffic?
Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system?
I have a large 12V lithium battery module which has an internal BMS and ...
2
votes
1
answer
298
views
Find out string encoding/shift of proprietary binary file format
I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand.
By trial-and-error I ...
2
votes
1
answer
2k
views
How to identify known encryption algorithm?
I reverse an .exe file with IDA.
I see a function that appears to be encrypting something by generating some random numbers.
It there any tool to identify if it is a known encryption algorithm?
2
votes
2
answers
23k
views
Driver's Licence Last Name Numbering Format (Ontario, Quebec, New Jersey)?
So I found out that Ontario Driver's Licences have the following format: LXXXX - NNNIY - YMMDD
L - first letter of last name XXXX - number referring to your last name NNN - number referring to your ...
2
votes
1
answer
174
views
433MHz Protocol: Unknown Three-Symbol-Encoding within the OOK data
Reverse engineering the protocol of a remote-controlled wall socket (433MHz On-Off-Keying) revealed an embedded pattern which apparently uses three symbols (besides 0s).
Symbol A = 000001
Symbol B = ...
2
votes
1
answer
283
views
Help with a packed date format
I've came across what appears to be a date format from a legacy database application.
I don't have access to the code that generated it, just have examples corresponding to certain Holiday messages.
...
2
votes
0
answers
99
views
Android game reverse http request body
I'm trying to reverse request that are made to an android game to learn more about how it works.
I was able to find endpoints requests that are made with frida and mitmproxy but now I'm stuck because ...
2
votes
0
answers
20
views
Encoding scheme identification of the following communication message
I'm trying to RE an app for educational purposes.
So here is the behavior of the app.
When the app starts, it communicate with a server in plain tcp and based on those tcp messages, it either work as ...
2
votes
1
answer
95
views
The Logic Of Incremental Data on Serial Communication Encoding
These are the serial communication reverse values.
I am trying to understand the logic behind this.
I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct.
I tried ...
2
votes
1
answer
427
views
Decode bitmaps from Director .dxr files
I'm trying to extract bitmaps from an old Macromedia Director protected .dxr file. I was able to find some information about the file structure from here (it turns out to be a XFIR container, the ...
2
votes
2
answers
375
views
How to identify the encoding performed on this string
I have an old application that stores the username and password in plaintext but encoded by an unknown encoding algorithm to me, it seams like base64, but I think it's not,
It seams that any word ...
2
votes
0
answers
694
views
Reverse engineering TPMS sensor data [closed]
I'm trying to reverse engineer data received from TPMS (car tyre pressure) sensors. I used rtl_433 tool to capture the data from sensor at 433 MHz. Tool was able to detect data is using FSK modulation ...
2
votes
0
answers
451
views
Finding the h.264 stream in a bytestream
I have a bytestream that contains h.264 bytestream packets in it. How can I find it?
Output from stream:
https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY
The first 13 bytes ...
1
vote
2
answers
1k
views
Reverse engineering a base64 encoded number
I am working on reverse engineering an encoding.
A number between -12 and 12, with 2 decimals is encoded using an unknown method, and the result is a pair of strings as follows:
value string1 ...
1
vote
3
answers
989
views
Find out how a program is reading a file
I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...