Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [file-format]

File format refers to the way information and data is encoded and stored in a computer file.

0
votes
1answer
54 views

Compressed PS2 .RAW File

I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...
0
votes
1answer
64 views

finding file I/O in IDA Pro (actually IDA free)

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff. The parts of the program I am interested in is where it reads a file. This is a ...
0
votes
2answers
136 views

Extracting the contents of an unknown archive file format

I need some help and advice here. I am privately learning on how to reverse engineer our teachers custom file archive file that have other files stored inside of them. for school project. But, I am ...
4
votes
0answers
190 views

Finding decompress algorithm for unknown compression

I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression. You can see the file here. I think they are using some kind of LZRW 1 ...
1
vote
1answer
98 views

Reverse Engineering And Rendering Old Image Format .CEL

I want to reverse engineer titltext.cel .CEL image format and render this in SDL2. I happen to know a little bit about the CEL file that I am working with. I know it is supposed to be a sprite-sheet ...
2
votes
2answers
123 views

DLL starting with DCD

Today I was investigating an issue with a Microsoft DLL, mscordacwks.dll, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it ...
2
votes
1answer
86 views

Find out string encoding/shift of proprietary binary file format

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand. By trial-and-error I ...
3
votes
1answer
35 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
0
votes
2answers
129 views

Determining file format of an OBB

I'm trying to unpack an obb file used in an android game. From my initial google searches, it's my understanding that an obb can be basically any type of file. The only lead I have is the magic bytes ...
2
votes
0answers
77 views

How should I got about working out the format for this psp game?

I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
1
vote
0answers
72 views

File Decryption Problems

over the past year, I provided an English patch to a community of thousands of players of a game I love and which is not available in English (just Chinese and Korean). Sadly, besides me, other ...
3
votes
0answers
60 views

Interpreting clipboard data from HMI software

I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs. Long story short, I need the ability to fill the ...
1
vote
1answer
125 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
1
vote
0answers
131 views

Compression algorithm working with bitstream

I'm trying to reverse decompression algorithm for one of old games. After some reversing I found that it reads bit stream, not byte by byte. It looks like this: std::vector<uint32_t> TABLE_1 = {...
4
votes
2answers
431 views

How does a stripped XCOFF binary still remain usable?

IBM's AIX strip utility documentation states the following: The strip command with no options removes the line number information, relocation information, symbol table, the debug section, and the ...
-1
votes
3answers
502 views

Trying to identify a file format for CTF forensics challenge

I'm currently working through a series of CTF forensics challenge and have run into a file format that I am dead-ending on. The format has no recognizable File Magic Number - and the file itself is ...
-1
votes
0answers
42 views

Identify variable length header encoding

I have a file generated by Microsoft OneNote Online service. It contains a lot of attached binary files and I need to extract all of them. All attachments are stored inside the file in the following ...
1
vote
1answer
325 views

De-compiling a random file format to retrieve the files?

Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files. I've read multiple posts that mention ...
5
votes
0answers
283 views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
0
votes
1answer
198 views

reverse engeeneering the 3d file of a game [closed]

I have a problem to find out how to open a file of a game this one seems to have encrypted its files. Currently all I know about the file is that it seems to be a custom 3D file. here is the file ...
-2
votes
1answer
243 views

Unknown game file decompress [closed]

So I got this file with an unknown extension. The file is an event flow code Ok, so I analysed the file (with HxD) and it seems to be compressed in some way because you can read some plain text there....
1
vote
1answer
86 views

Converting 16 bit long Hex value to a color

I am currently trying to reverse engineer some game files. I have found the exact location of each graphic element, but now I am stuck trying to convert their data to "readable" rgb code. They use 16 ...
1
vote
0answers
69 views

Unsquashfs fails partways with gzip error code -5

I have been trying to unsquash a system.sfs file in order to modify the directories. however, unsquashfs system.sfs returns the following output: Parallel unsquashfs: Using 8 processors 1 inodes (...
2
votes
1answer
539 views

objdump -T gives Invalid Operation on MIPS .so

I have a MIPS .so file that I'm trying to reverse. Binary Ninja (too cheap for IDA) finds no symbols, and neither does objdump -T, instead giving "Invalid Operation": % mips-linux-gnu-objdump -x ...
0
votes
1answer
68 views

Identifying Checksum?

I bring you either a hard challenge or the easiest challenge you've ever had. I have a save file for this game The first bytes are: F9 29 CE 54 02 4D 71 04 4D 71 00 00 this is the same throughout ...
1
vote
0answers
150 views

Custom image format decoding

TL;DR: is there any chance of decoding custom picture format in case I have sufficient amount of data? Please see examples at end. I have binary files of an old DOS diskmag (late 90's). After couple ...
3
votes
1answer
177 views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
1
vote
1answer
2k views

Address to file offset

I have read st_value from the ELF symbol table, with the value being 4195622. When converted to hex, the value is 400580. I am aware that the file offset is 580 bytes. My question is how to actually ...
2
votes
0answers
316 views

Struggling with an archive file format using “encryption”

I am currently working on a file format used to pack (storage only, no compression) different file types together for transport. There is some sort of very simple "encryption" used and so far I have ...
0
votes
1answer
124 views

I'm would like to view this malicious payload, but am having trouble decoding it

This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this? H4sIAAAAAAAAAL1X6W6jyBb+...
3
votes
1answer
388 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
2
votes
1answer
351 views

File analysis with hexdump - unknown container

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
2
votes
1answer
148 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
0
votes
1answer
170 views

How to extract contents from this .DIG file?

I have this .DIG file from a PS2 game: https://drive.google.com/open?id=0B8-7FMP3lW8cU3NqUmNUcWdhcEk Apparently, it should contain most of the game data, except cutscene movies and voiceovers, which ...
1
vote
2answers
791 views

Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk

I am unable to open PNG files extracted from a certain Android app. I can't open them with the stock Android Gallery app. I can't open them in image browsers after downloading them on my computer. ...
-1
votes
0answers
374 views

Open .raw texture file (Playstation 2 game)

I'm trying to translate a PS2 Japanese game (FMA3: Girl who succeeds God). After failing to find any file which could be a dialogue script, I've decided to take a look at the textures. I extracted ...
1
vote
2answers
144 views

Find out how a program is reading a file

I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...
1
vote
2answers
443 views

Changing the format of IDA's Produce file -> Create ASM file

OK, so I know this is path is not recommended but it is a situation I have been forced into. I have a tool not created by me which takes the exported asm file from IDA and processes the exported ...
2
votes
2answers
153 views

VBA code detection in MS office documents

So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams. I've read ...
3
votes
0answers
68 views

methods for identifying deliberately unmagiked filesystem

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
1
vote
0answers
746 views

Reverse engineering ps2 game texture file format - got most of it but a few issues

I've spent a lot of time on this and I have made a lot of progress, but there is several problems to solve still. I have this old PS2 game and, as any curious person would, I put the disc in my ...
2
votes
1answer
375 views

Deducing Protobuf Schema and Datatypes

I have a number of protobuf files but no .proto schema file! cat myfile.pbuf | protoc --decode_raw > outputfile.txt Using the above command, I was able to decode the file into a somewhat readable ...
1
vote
2answers
903 views

Strange File Format: How to unpack a set of compressed files?

I am trying to extract data from a proprietary file type: .take. I am unfamiliar with file compression and encoding, but it appears as if this file type is acting as some sort of wrapper for other ...
-1
votes
0answers
136 views

Can't identify the format of an image mask

I'm trying to examine what appears to be a mask for sprites used in the long-gone Cyberworld QBORG sprite format, stored as a JPEG chunk. Problem is, I'm not sure what kind of format this is. It might ...
1
vote
1answer
1k views

DPFMate Keychain tool

Got this Digital Keychain Photo viewer thingy. Comes with the DPFMate.exe software, which does not run under Windows 10. So far I've confirmed, that it runs perfectly on what they avertise - Windows ...
2
votes
1answer
173 views

Trying to reverse engineer teamviewer's printer driver

Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
0
votes
1answer
82 views

Finding What Data Means From File?

I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one. It's full of content such as this: 117dbdd0 15 ...
0
votes
0answers
99 views

Identification of an Unknown File System in an ITRON OS

I am attempting to reverse an unknown file system found in an ITRON based operating system (circa 2003), but have not been able to figure this out. Any clues to identifying or reversing this file ...
3
votes
2answers
279 views

Anyone recognize this variant of Intel HEX firmware format?

I've got a firmware file for an ARM Cortex-M0+ that is in a format extremely similar to Intel HEX. All data is encapsulated in a 0x3a ... 0xa wrapper. The fields seem to mostly match the 16 bit ...
0
votes
0answers
158 views

Reversing custom JPEG file with POSSIBLE checksum

I'm trying to understand how a certain closed platform stores screenshots. I've led to the conclusion that files are somehow checksumed; Any modification and the built-in picture viewer won't load it, ...