Questions tagged [file-format]

File format refers to the way information and data is encoded and stored in a computer file.

Filter by
Sorted by
Tagged with
0
votes
0answers
63 views

Binwalk on flash dump yielding useless files and empty file systems

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer. However when I use binwalk on these dumps I end up with fragments of files mixed in ...
1
vote
2answers
164 views

Reverse engineering a partially known binary format

I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by datetime (accurate down to ...
1
vote
0answers
33 views

Decode bitmaps from Director .dxr files

I'm trying to extract bitmaps from an old Macromedia Director protected .dxr file. I was able to find some information about the file structure from here (it turns out to be a XFIR container, the ...
-1
votes
2answers
91 views

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
0
votes
0answers
63 views

How are strokes stored in the Goodnotes file format?

I have been trying to reverse engineer the .goodnotes file format (a note taking app for iOS devices) and so far have discovered this: A .goodnotes file is simply a zip archive, an example file ...
0
votes
0answers
74 views

What kind of integer obfuscation is this?

I'm looking at the network traffic of a game submitting the user's score to the high-score server. The score value seems to be obfuscated in some way. The score is a non-negative integer, and not more ...
2
votes
1answer
118 views

Reverse engineer a proprietary audio file

This is my first time posting here and also my first time attempting to do reverse engineering of this kind. Let´s get to the point: I have to find a way of reading some phone call audio files. The ...
0
votes
0answers
21 views

Algorithm for decoding database like file structure

I am working on an automatic decode tool for a database like file structure. The file consists of a header and a body. Information that is known before trying to decode the file: Number of rows and ...
1
vote
1answer
64 views

Identifying the nature and contents of a file

As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
0
votes
1answer
78 views

What image format is this?

I am trying to reverse engineer an image file generated by my microscope. It is supposed to be an HDR image. The file has very distinct pattern in HEX editor but I am unable to recognise it: First 16 ...
1
vote
1answer
61 views

Why doesn't binwalk see the filesystems in this Eufy Home Base 2 flash dump?

This teardown: https://electronics-teardowns.blogspot.com/2020/07/eufy-homebase2-teardown.html Gives a flash dump for the Eufy Home Base 2 here: https://anonymousfiles.io/Ve9y3cL4/ With this partition ...
0
votes
1answer
77 views

Reverse Engineer Unknown File Format

I have thousands of old backup files from EaseUs Todo Backup. They are incremental backups saved inside a ".pbd" file (EaseUs's proprietary backup format). I've tried to get my files out ...
2
votes
1answer
131 views

Attempting to reverse engineer an iOS OTA payload-like archival format

Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's softwarecatalog, I attempted to study the contents of ...
1
vote
2answers
90 views

Wave File obfuscation

I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: https://pastebin.com/LD5aA1EG Any suggestions where else ...
2
votes
0answers
72 views

Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes

I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse. When developing ...
1
vote
1answer
40 views

advapi32.dll changes name of function during forwarding of exports

Im trying myself at writing a manual mapper, for injection of DLLs into other processes. Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
-1
votes
1answer
57 views

How to decode a .plr file

I have a .plr file that contains all of the player information for the game Terarria. I would like to decode it to have a look at what data is stored on this file so that I can play around with making ...
0
votes
0answers
17 views

Problems after export patch

I have a problem with a file patched. If I run original file with odg32 and edit 4 lines it works ok, but if I export this edit program doesn't works, or better works but not work correctly. I do 4 ...
0
votes
1answer
78 views

Decoding unknown logfile format

I have logfiles in the following format without any documentation: to 12.03.2020 08:04:15 < '7"\05\04\02\16\F6\C6\D6"'#0D to 12.03.2020 08:04:15 > '7S"\05\04\00\02\00\01\91\8E"'#0D to 12.03....
0
votes
1answer
41 views

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
0
votes
0answers
42 views

Is there a image format that starts with 0x4E 0x58 0x50 (ASCII 'NXP')?

I'm looking at a binary file whose starting bytes are 0x4E 0x58 0x50. Is this an established magic number for a file format? If so, what format is it? My google-fu has proven too weak to find an ...
0
votes
1answer
447 views

Can “missing section headers” ELF files still be executed/dangerous?

On VirusTotal, there are lots of ELF samples are missing section headers when using file command to see the info. Also, when using the Python elftools library to parse them, exceptions will be thrown....
0
votes
0answers
88 views

Modifying a legacy uImage

I have an old device from which I extracted a uImage. I know it has a linux kernel and a cpio filesystem in the uImage, and I need to make some changes to the filesystem. I'm hoping someone can help ...
0
votes
1answer
69 views

Encrypted image format

I am trying to reverse a simple image format for bitmap data with an indexed colour palette. The structure of the file is generally clear and I am able to extract the size of the picture and the ...
1
vote
0answers
22 views

Format of Alcatel_Lucent I-240W-A backup file

I am trying to modify the backup file of this router in order to change some configurations. Here is the structure I have until now: 16 bytes of the header, zlib compressed xml with the ...
1
vote
0answers
191 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
1
vote
1answer
329 views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
2
votes
1answer
67 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
-1
votes
1answer
172 views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
1
vote
0answers
68 views

Reproducing video format

I received a promotional video screen with a USB interface. It comes with a couple example videos, one of which is here: https://drive.google.com/file/d/1B-wSURAgK-ePrfpKFM5nYbNhQ5mD-Ii2/view?usp=...
4
votes
2answers
262 views

Is there a way to confirm and decompress files that I suspect are compressed with a very early format of PKZIP?

I have a very large number of files (tens of thousands) who's binary all begins with 0x00 0x06. They do not open with 7-ZIP. I notice also that all Office files seem to share the same next 32 bytes. ...
1
vote
1answer
36 views

Finding examples of file with particular extentions

I'm trying to start a filetype identification project for certain groups of files based on their file extension (.exe, .pdf, etc), using yara as the identification engine, but I've run into a problem. ...
0
votes
0answers
32 views

Is there a list/property of the vulnerabilities so that, if pentested for, can read but not overwrite the system?

The question is a bit hard to explain, so I go with an example. Suppose the UFO crashed on Earth. The aliens are dead, but their on-board computer is intact. You were tasked to dump the computer's ...
4
votes
2answers
234 views

Understanding proprietary game texture/image format (.art)

I've been researching on how to modify the textures of Crazy Taxi 3 for a while now and I have pretty much hit a brick wall. The game stores its texture assets in .art files, which, from what I ...
2
votes
1answer
205 views

can someone help me with this map format?

I've been messing around in visual studio for half an hour trying to figure out how to properly display maps from a file, but all I can output is hot garbage, all I know is that the maps are 64x64, ...
3
votes
0answers
71 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
3
votes
1answer
133 views

Are there existing automated approaches to reverse engineering the data types in a binary data stream?

Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet. Are there existing tools that automatically detect (or estimate) the various data types present and their ...
3
votes
0answers
54 views

Extracting Archive-Like file format analysis that does not seem to match known formats

Good afternoon, I am looking to try me skills at extracting some data from a proprietary format. I have made some progress but I wanted to contact the experts to see if I could gain some insights. ...
1
vote
0answers
48 views

Need help reversing .m4t TTML subtitles format

I am currently trying to create subtitles for some proprietary Sony software. Unfortunatly, it only recognizes Sony's own .m4t subtitles format. After some research I found that this subtitles is also ...
1
vote
1answer
125 views

Deciphering an unknown graphics format

For my own amusement, I dumped the files of an old Nintendo DS video game I have (the company has long since gone bankrupt/closed) and am trying to extract the assets. I have recovered game text, ...
2
votes
3answers
327 views

Decode synth preset formats for massive (.nmsv) fm8 (.nfm8) and absynth (.nabs)

I'm trying to decode the file formats for Massive, FM8 and absynth VST synths. The file format is binary with several sections. Reason for this endeavour is to convert the above formats to general vst ...
2
votes
1answer
116 views

Unknown archive format from QNX operating system

We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
1
vote
0answers
155 views

Mimicking a file format that is actually a zip

Backstory: I have been trying to find a way to automatically turn batches of photos into WhatsApp stickers. I was able to do that, but now I am trying to figure out a way to actually import them into ...
1
vote
1answer
169 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
0
votes
1answer
166 views

Automatically detecting and carving images from .doc, .docx and spreadsheets

I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
0
votes
0answers
58 views

I have a .exe program file compiled using Intel Fortran 8.1. for windows 10. Can I edit the code off the .exe file?

I have a .exe program file compiled using Intel Fortran 8.1 for Windows under WinXP with 64-bit Windows 10 system. Can I edit the code off the .exe file? I need to change a value in the code. Thank ...
2
votes
1answer
206 views

Which file system is this? file type 0x00, folder type 0x01

Inside a internet radio firmware file I found a file system, and I don't know which one it is. What I know: (The first two bytes are 0A 4C (maybe magic byte)) they are actually not part of the file ...
1
vote
0answers
89 views

Can't install sasquatch tool

Ubuntu 16.04 LTS. I'm trying to install sasquatch tool (which should apply patches to the standard unsquashfs utility), but got the issue, every time build process show error in one place: ./build.sh:...
1
vote
0answers
239 views

Edit unknown binary file

I have here an unknown binary file which contains a graphical user interface. The file has the ending .kzb and it comes from the Kanzi desinger. Unfortunately the Kanzi desinger can no longer edit the ...
0
votes
1answer
345 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...