Questions tagged [file-format]

File format refers to the way information and data is encoded and stored in a computer file.

Filter by
Sorted by
Tagged with
0
votes
1answer
37 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
-1
votes
0answers
50 views

How to unpack files for old Dos game? (Nitemare 3D) [on hold]

I am trying to reverse engineer an old Wolf3D style Dos game named "Nitemare 3D", I can get a raycasting engine with directional sprites running pretty easily in my free time using SDL2, but I have no ...
0
votes
1answer
43 views

Automatically detecting and carving images from .doc, .docx and spreadsheets

I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
0
votes
0answers
49 views

I have a .exe program file compiled using Intel Fortran 8.1. for windows 10. Can I edit the code off the .exe file?

I have a .exe program file compiled using Intel Fortran 8.1 for Windows under WinXP with 64-bit Windows 10 system. Can I edit the code off the .exe file? I need to change a value in the code. Thank ...
1
vote
1answer
80 views

Which file system is this? file type 0x00, folder type 0x01

Inside a internet radio firmware file I found a file system, and I don't know which one it is. What I know: (The first two bytes are 0A 4C (maybe magic byte)) they are actually not part of the file ...
0
votes
0answers
26 views

Can't install sasquatch tool

Ubuntu 16.04 LTS. I'm trying to install sasquatch tool (which should apply patches to the standard unsquashfs utility), but got the issue, every time build process show error in one place: ./build.sh:...
0
votes
0answers
67 views

Edit unknown binary file

I have here an unknown binary file which contains a graphical user interface. The file has the ending .kzb and it comes from the Kanzi desinger. Unfortunately the Kanzi desinger can no longer edit the ...
0
votes
1answer
154 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...
3
votes
1answer
217 views

Reverse engineering file format - ImageLink

I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files: book.bbi ...
0
votes
1answer
137 views

Compressed PS2 .RAW File

I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...
0
votes
1answer
264 views

finding file I/O in IDA Pro (actually IDA free)

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff. The parts of the program I am interested in is where it reads a file. This is a ...
0
votes
2answers
359 views

Extracting the contents of an unknown archive file format

I need some help and advice here. I am privately learning on how to reverse engineer our teachers custom file archive file that have other files stored inside of them. for school project. But, I am ...
4
votes
0answers
347 views

Finding decompress algorithm for unknown compression

I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression. You can see the file here. I think they are using some kind of LZRW 1 ...
1
vote
1answer
132 views

Reverse Engineering And Rendering Old Image Format .CEL

I want to reverse engineer titltext.cel .CEL image format and render this in SDL2. I happen to know a little bit about the CEL file that I am working with. I know it is supposed to be a sprite-sheet ...
2
votes
2answers
230 views

DLL starting with DCD

Today I was investigating an issue with a Microsoft DLL, mscordacwks.dll, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it ...
2
votes
1answer
114 views

Find out string encoding/shift of proprietary binary file format

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand. By trial-and-error I ...
3
votes
1answer
48 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
0
votes
2answers
259 views

Determining file format of an OBB

I'm trying to unpack an obb file used in an android game. From my initial google searches, it's my understanding that an obb can be basically any type of file. The only lead I have is the magic bytes ...
2
votes
0answers
98 views

How should I got about working out the format for this psp game?

I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
1
vote
0answers
77 views

File Decryption Problems

over the past year, I provided an English patch to a community of thousands of players of a game I love and which is not available in English (just Chinese and Korean). Sadly, besides me, other ...
3
votes
0answers
72 views

Interpreting clipboard data from HMI software

I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs. Long story short, I need the ability to fill the ...
1
vote
1answer
170 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
1
vote
0answers
197 views

Compression algorithm working with bitstream

I'm trying to reverse decompression algorithm for one of old games. After some reversing I found that it reads bit stream, not byte by byte. It looks like this: std::vector<uint32_t> TABLE_1 = {...
4
votes
2answers
573 views

How does a stripped XCOFF binary still remain usable?

IBM's AIX strip utility documentation states the following: The strip command with no options removes the line number information, relocation information, symbol table, the debug section, and the ...
-1
votes
3answers
737 views

Trying to identify a file format for CTF forensics challenge

I'm currently working through a series of CTF forensics challenge and have run into a file format that I am dead-ending on. The format has no recognizable File Magic Number - and the file itself is ...
1
vote
1answer
382 views

De-compiling a random file format to retrieve the files?

Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files. I've read multiple posts that mention ...
4
votes
0answers
399 views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
0
votes
1answer
241 views

reverse engeeneering the 3d file of a game [closed]

I have a problem to find out how to open a file of a game this one seems to have encrypted its files. Currently all I know about the file is that it seems to be a custom 3D file. here is the file ...
-2
votes
1answer
340 views

Unknown game file decompress [closed]

So I got this file with an unknown extension. The file is an event flow code Ok, so I analysed the file (with HxD) and it seems to be compressed in some way because you can read some plain text there....
1
vote
1answer
118 views

Converting 16 bit long Hex value to a color

I am currently trying to reverse engineer some game files. I have found the exact location of each graphic element, but now I am stuck trying to convert their data to "readable" rgb code. They use 16 ...
1
vote
0answers
98 views

Unsquashfs fails partways with gzip error code -5

I have been trying to unsquash a system.sfs file in order to modify the directories. however, unsquashfs system.sfs returns the following output: Parallel unsquashfs: Using 8 processors 1 inodes (...
2
votes
1answer
774 views

objdump -T gives Invalid Operation on MIPS .so

I have a MIPS .so file that I'm trying to reverse. Binary Ninja (too cheap for IDA) finds no symbols, and neither does objdump -T, instead giving "Invalid Operation": % mips-linux-gnu-objdump -x ...
0
votes
1answer
93 views

Identifying Checksum?

I bring you either a hard challenge or the easiest challenge you've ever had. I have a save file for this game The first bytes are: F9 29 CE 54 02 4D 71 04 4D 71 00 00 this is the same throughout ...
1
vote
0answers
185 views

Custom image format decoding

TL;DR: is there any chance of decoding custom picture format in case I have sufficient amount of data? Please see examples at end. I have binary files of an old DOS diskmag (late 90's). After couple ...
3
votes
1answer
244 views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
2
votes
1answer
3k views

Address to file offset

I have read st_value from the ELF symbol table, with the value being 4195622. When converted to hex, the value is 400580. I am aware that the file offset is 580 bytes. My question is how to actually ...
2
votes
0answers
328 views

Struggling with an archive file format using “encryption”

I am currently working on a file format used to pack (storage only, no compression) different file types together for transport. There is some sort of very simple "encryption" used and so far I have ...
0
votes
1answer
128 views

I'm would like to view this malicious payload, but am having trouble decoding it

This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this? H4sIAAAAAAAAAL1X6W6jyBb+...
3
votes
1answer
446 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
2
votes
1answer
454 views

File analysis with hexdump - unknown container

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
2
votes
1answer
167 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
0
votes
1answer
190 views

How to extract contents from this .DIG file?

I have this .DIG file from a PS2 game: https://drive.google.com/open?id=0B8-7FMP3lW8cU3NqUmNUcWdhcEk Apparently, it should contain most of the game data, except cutscene movies and voiceovers, which ...
1
vote
2answers
1k views

Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk

I am unable to open PNG files extracted from a certain Android app. I can't open them with the stock Android Gallery app. I can't open them in image browsers after downloading them on my computer. ...
1
vote
2answers
196 views

Find out how a program is reading a file

I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...
1
vote
2answers
692 views

Changing the format of IDA's Produce file -> Create ASM file

OK, so I know this is path is not recommended but it is a situation I have been forced into. I have a tool not created by me which takes the exported asm file from IDA and processes the exported ...
2
votes
2answers
173 views

VBA code detection in MS office documents

So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams. I've read ...
3
votes
0answers
78 views

methods for identifying deliberately unmagiked filesystem

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
2
votes
0answers
1k views

Reverse engineering ps2 game texture file format - got most of it but a few issues

I've spent a lot of time on this and I have made a lot of progress, but there is several problems to solve still. I have this old PS2 game and, as any curious person would, I put the disc in my ...
2
votes
1answer
474 views

Deducing Protobuf Schema and Datatypes

I have a number of protobuf files but no .proto schema file! cat myfile.pbuf | protoc --decode_raw > outputfile.txt Using the above command, I was able to decode the file into a somewhat readable ...
1
vote
2answers
1k views

Strange File Format: How to unpack a set of compressed files?

I am trying to extract data from a proprietary file type: .take. I am unfamiliar with file compression and encoding, but it appears as if this file type is acting as some sort of wrapper for other ...