Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [file-format]

File format refers to the way information and data is encoded and stored in a computer file.

0
votes
0answers
45 views

Edit unknown binary file

I have here an unknown binary file which contains a graphical user interface. The file has the ending .kzb and it comes from the Kanzi desinger. Unfortunately the Kanzi desinger can no longer edit the ...
0
votes
1answer
95 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...
2
votes
1answer
119 views

Reverse engineering file format - ImageLink

I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files: book.bbi ...
0
votes
1answer
92 views

Compressed PS2 .RAW File

I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...
0
votes
1answer
116 views

finding file I/O in IDA Pro (actually IDA free)

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff. The parts of the program I am interested in is where it reads a file. This is a ...
0
votes
2answers
191 views

Extracting the contents of an unknown archive file format

I need some help and advice here. I am privately learning on how to reverse engineer our teachers custom file archive file that have other files stored inside of them. for school project. But, I am ...
4
votes
0answers
271 views

Finding decompress algorithm for unknown compression

I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression. You can see the file here. I think they are using some kind of LZRW 1 ...
1
vote
1answer
108 views

Reverse Engineering And Rendering Old Image Format .CEL

I want to reverse engineer titltext.cel .CEL image format and render this in SDL2. I happen to know a little bit about the CEL file that I am working with. I know it is supposed to be a sprite-sheet ...
2
votes
2answers
175 views

DLL starting with DCD

Today I was investigating an issue with a Microsoft DLL, mscordacwks.dll, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it ...
2
votes
1answer
99 views

Find out string encoding/shift of proprietary binary file format

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand. By trial-and-error I ...
3
votes
1answer
39 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
0
votes
2answers
167 views

Determining file format of an OBB

I'm trying to unpack an obb file used in an android game. From my initial google searches, it's my understanding that an obb can be basically any type of file. The only lead I have is the magic bytes ...
2
votes
0answers
84 views

How should I got about working out the format for this psp game?

I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
1
vote
0answers
73 views

File Decryption Problems

over the past year, I provided an English patch to a community of thousands of players of a game I love and which is not available in English (just Chinese and Korean). Sadly, besides me, other ...
3
votes
0answers
64 views

Interpreting clipboard data from HMI software

I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs. Long story short, I need the ability to fill the ...
1
vote
1answer
138 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
1
vote
0answers
163 views

Compression algorithm working with bitstream

I'm trying to reverse decompression algorithm for one of old games. After some reversing I found that it reads bit stream, not byte by byte. It looks like this: std::vector<uint32_t> TABLE_1 = {...
4
votes
2answers
487 views

How does a stripped XCOFF binary still remain usable?

IBM's AIX strip utility documentation states the following: The strip command with no options removes the line number information, relocation information, symbol table, the debug section, and the ...
-1
votes
3answers
620 views

Trying to identify a file format for CTF forensics challenge

I'm currently working through a series of CTF forensics challenge and have run into a file format that I am dead-ending on. The format has no recognizable File Magic Number - and the file itself is ...
1
vote
1answer
348 views

De-compiling a random file format to retrieve the files?

Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files. I've read multiple posts that mention ...
5
votes
0answers
346 views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
0
votes
1answer
215 views

reverse engeeneering the 3d file of a game [closed]

I have a problem to find out how to open a file of a game this one seems to have encrypted its files. Currently all I know about the file is that it seems to be a custom 3D file. here is the file ...
-2
votes
1answer
275 views

Unknown game file decompress [closed]

So I got this file with an unknown extension. The file is an event flow code Ok, so I analysed the file (with HxD) and it seems to be compressed in some way because you can read some plain text there....
1
vote
1answer
94 views

Converting 16 bit long Hex value to a color

I am currently trying to reverse engineer some game files. I have found the exact location of each graphic element, but now I am stuck trying to convert their data to "readable" rgb code. They use 16 ...
1
vote
0answers
79 views

Unsquashfs fails partways with gzip error code -5

I have been trying to unsquash a system.sfs file in order to modify the directories. however, unsquashfs system.sfs returns the following output: Parallel unsquashfs: Using 8 processors 1 inodes (...
3
votes
1answer
626 views

objdump -T gives Invalid Operation on MIPS .so

I have a MIPS .so file that I'm trying to reverse. Binary Ninja (too cheap for IDA) finds no symbols, and neither does objdump -T, instead giving "Invalid Operation": % mips-linux-gnu-objdump -x ...
0
votes
1answer
77 views

Identifying Checksum?

I bring you either a hard challenge or the easiest challenge you've ever had. I have a save file for this game The first bytes are: F9 29 CE 54 02 4D 71 04 4D 71 00 00 this is the same throughout ...
1
vote
0answers
160 views

Custom image format decoding

TL;DR: is there any chance of decoding custom picture format in case I have sufficient amount of data? Please see examples at end. I have binary files of an old DOS diskmag (late 90's). After couple ...
3
votes
1answer
199 views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
2
votes
1answer
2k views

Address to file offset

I have read st_value from the ELF symbol table, with the value being 4195622. When converted to hex, the value is 400580. I am aware that the file offset is 580 bytes. My question is how to actually ...
2
votes
0answers
324 views

Struggling with an archive file format using “encryption”

I am currently working on a file format used to pack (storage only, no compression) different file types together for transport. There is some sort of very simple "encryption" used and so far I have ...
0
votes
1answer
126 views

I'm would like to view this malicious payload, but am having trouble decoding it

This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this? H4sIAAAAAAAAAL1X6W6jyBb+...
3
votes
1answer
411 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
2
votes
1answer
384 views

File analysis with hexdump - unknown container

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
2
votes
1answer
152 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
0
votes
1answer
177 views

How to extract contents from this .DIG file?

I have this .DIG file from a PS2 game: https://drive.google.com/open?id=0B8-7FMP3lW8cU3NqUmNUcWdhcEk Apparently, it should contain most of the game data, except cutscene movies and voiceovers, which ...
1
vote
2answers
894 views

Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk

I am unable to open PNG files extracted from a certain Android app. I can't open them with the stock Android Gallery app. I can't open them in image browsers after downloading them on my computer. ...
1
vote
2answers
159 views

Find out how a program is reading a file

I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...
1
vote
2answers
530 views

Changing the format of IDA's Produce file -> Create ASM file

OK, so I know this is path is not recommended but it is a situation I have been forced into. I have a tool not created by me which takes the exported asm file from IDA and processes the exported ...
2
votes
2answers
161 views

VBA code detection in MS office documents

So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams. I've read ...
3
votes
0answers
73 views

methods for identifying deliberately unmagiked filesystem

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
1
vote
0answers
849 views

Reverse engineering ps2 game texture file format - got most of it but a few issues

I've spent a lot of time on this and I have made a lot of progress, but there is several problems to solve still. I have this old PS2 game and, as any curious person would, I put the disc in my ...
2
votes
1answer
404 views

Deducing Protobuf Schema and Datatypes

I have a number of protobuf files but no .proto schema file! cat myfile.pbuf | protoc --decode_raw > outputfile.txt Using the above command, I was able to decode the file into a somewhat readable ...
1
vote
2answers
1k views

Strange File Format: How to unpack a set of compressed files?

I am trying to extract data from a proprietary file type: .take. I am unfamiliar with file compression and encoding, but it appears as if this file type is acting as some sort of wrapper for other ...
1
vote
1answer
1k views

DPFMate Keychain tool

Got this Digital Keychain Photo viewer thingy. Comes with the DPFMate.exe software, which does not run under Windows 10. So far I've confirmed, that it runs perfectly on what they avertise - Windows ...
2
votes
1answer
177 views

Trying to reverse engineer teamviewer's printer driver

Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
0
votes
1answer
82 views

Finding What Data Means From File?

I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one. It's full of content such as this: 117dbdd0 15 ...
3
votes
2answers
304 views

Anyone recognize this variant of Intel HEX firmware format?

I've got a firmware file for an ARM Cortex-M0+ that is in a format extremely similar to Intel HEX. All data is encapsulated in a 0x3a ... 0xa wrapper. The fields seem to mostly match the 16 bit ...
1
vote
1answer
2k views

File Reverse Engineering – League of Legends WAD File Header Hash

I'm looking to edit League of Legends's WAD files, but the developers of the game have recently decided to add a sort of hash to these files to check if their content is valid. Unfortunately, no one ...
3
votes
1answer
861 views

Replace section inside ELF file

Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...