Questions tagged [file-format]

File format refers to the way information and data is encoded and stored in a computer file.

Filter by
Sorted by
Tagged with
1
vote
3answers
240 views

Proprietary MS SQL server based file format

I'm trying to reverse engineer an application that uses SQL server but somehow hides the database files inside its own proprietary file format. What I'm aiming to do is to write my own app that can ...
2
votes
2answers
108 views

Reverse engineering a .byte file format

I've dug into files of a game that was made in Unity (which uses C# language)... and i was interested in extracting 3D models and textures etc. I understand that data and obb are separate, BUT! In my ...
0
votes
2answers
45 views

how do i use the text like in pe files?

I extracted pe file from another pe file and I saved it. I want it execute but when I saved file computer sees it like text file. Altough my actual file starting with "4d 5a" computer sees ...
0
votes
1answer
72 views

Is there a image format that starts with 0x4E 0x58 0x50 (ASCII 'NXP')?

I'm looking at a binary file whose starting bytes are 0x4E 0x58 0x50. Is this an established magic number for a file format? If so, what format is it? My google-fu has proven too weak to find an ...
4
votes
1answer
124 views

Reverse engineer compressed iOS app file

I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
0
votes
0answers
32 views

Need help learning to extract and modify PS1 ISO files

I was wanting to make a randomizer for a playstation game, Parasite Eve 2. I've spent a ton of time trying to figure this out just googling around and eventually wound up here. Does anyone have an ...
0
votes
1answer
54 views

Detecting and reading embedded filesystems on desktop Linux

I have some data from a NAND chip, dumped using the built in nanddump utility on the embedded device. This is the device information: https://openwrt.org/toh/bt/homehub_v5a The NAND chip is 128MiB ...
1
vote
1answer
132 views

Extracting the contents of an unknown file format

I need some help and advice here. I'm self-learning how to reverse engineer a file content of an unknown format. Here's the content of two files: E5 44 2A F9 1C 72 96 B9 CA B2 40 33 DA 19 B9 56 C4 5F ...
4
votes
3answers
1k views

Are there exports with neither ordinal nor name or am I not understanding the PE documentation?

I don't understand one thing in the export data directory of PE files. The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
1
vote
1answer
210 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
1
vote
2answers
204 views

Opening an undocumented 90s graphics format

I've managed to extract some graphics files from an archive of an old game. Haven't found anything about it online, so I'm trying my luck here, prehaps someone knows a similar format that can help me. ...
3
votes
1answer
149 views

Are there existing automated approaches to reverse engineering the data types in a binary data stream?

Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet. Are there existing tools that automatically detect (or estimate) the various data types present and their ...
1
vote
1answer
305 views

Edit unknown binary file

I have here an unknown binary file which contains a graphical user interface. The file has the ending .kzb and it comes from the Kanzi desinger. Unfortunately the Kanzi desinger can no longer edit the ...
1
vote
1answer
531 views

File reverse engineering - .tbl format

I've been trying to google any information about how can i create a viewer for some custom file formats. In my case I've extracted multiple .tbl files from game sources. This file contains a database ...
0
votes
1answer
46 views

Algorithm for decoding database like file structure

I am working on an automatic decode tool for a database like file structure. The file consists of a header and a body. Information that is known before trying to decode the file: Number of rows and ...
0
votes
1answer
377 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...
0
votes
2answers
71 views

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
2
votes
3answers
261 views

Reverse engineering a partially known binary format

I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by datetime (accurate down to ...
0
votes
1answer
145 views

What image format is this?

I am trying to reverse engineer an image file generated by my microscope. It is supposed to be an HDR image. The file has very distinct pattern in HEX editor but I am unable to recognise it: First 16 ...
0
votes
1answer
44 views

I'm trying to decode this file that supposed to encode an imaged obtained by a laser system

This file suppose to have an image obtained from a Laser system. Since it needs a propietary software for the decoder I have been slowed in order to get the data. I wonder if you guys know any way of ...
1
vote
1answer
856 views

finding file I/O in IDA Pro (actually IDA free)

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff. The parts of the program I am interested in is where it reads a file. This is a ...
0
votes
0answers
129 views

Binwalk on flash dump yielding useless files and empty file systems

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer. However when I use binwalk on these dumps I end up with fragments of files mixed in ...
4
votes
1answer
665 views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
1
vote
0answers
578 views

Windows Media Player - library format

Is anyone aware of any documentation (official or reverse-engineered) on the Windows Media Player library / database .wmdb format? (Specifically WMP 12). The file resides at C:\Users\[username]\...
1
vote
0answers
49 views

Decode bitmaps from Director .dxr files

I'm trying to extract bitmaps from an old Macromedia Director protected .dxr file. I was able to find some information about the file structure from here (it turns out to be a XFIR container, the ...
1
vote
2answers
96 views

Wave File obfuscation

I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: https://pastebin.com/LD5aA1EG Any suggestions where else ...
4
votes
2answers
469 views

Reverse engineering file format - ImageLink

I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files: book.bbi ...
2
votes
3answers
382 views

Decode synth preset formats for massive (.nmsv) fm8 (.nfm8) and absynth (.nabs)

I'm trying to decode the file formats for Massive, FM8 and absynth VST synths. The file format is binary with several sections. Reason for this endeavour is to convert the above formats to general vst ...
-1
votes
2answers
102 views

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
1
vote
0answers
130 views

How are strokes stored in the Goodnotes file format?

I have been trying to reverse engineer the .goodnotes file format (a note taking app for iOS devices) and so far have discovered this: A .goodnotes file is simply a zip archive, an example file ...
1
vote
3answers
488 views

Find out how a program is reading a file

I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...
0
votes
0answers
78 views

What kind of integer obfuscation is this?

I'm looking at the network traffic of a game submitting the user's score to the high-score server. The score value seems to be obfuscated in some way. The score is a non-negative integer, and not more ...
2
votes
1answer
193 views

Reverse engineer a proprietary audio file

This is my first time posting here and also my first time attempting to do reverse engineering of this kind. Let´s get to the point: I have to find a way of reading some phone call audio files. The ...
1
vote
1answer
71 views

Identifying the nature and contents of a file

As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
1
vote
1answer
78 views

Why doesn't binwalk see the filesystems in this Eufy Home Base 2 flash dump?

This teardown: https://electronics-teardowns.blogspot.com/2020/07/eufy-homebase2-teardown.html Gives a flash dump for the Eufy Home Base 2 here: https://anonymousfiles.io/Ve9y3cL4/ With this partition ...
0
votes
1answer
104 views

Reverse Engineer Unknown File Format

I have thousands of old backup files from EaseUs Todo Backup. They are incremental backups saved inside a ".pbd" file (EaseUs's proprietary backup format). I've tried to get my files out ...
2
votes
1answer
231 views

Attempting to reverse engineer an iOS OTA payload-like archival format

Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's softwarecatalog, I attempted to study the contents of ...
2
votes
2answers
406 views

Reading stp (Designaknit Stitch Pattern)-Files II

I know this is not an answer "Reading stp (Designaknit Stitch Pattern)-Files)", but i think it is a way to an answer. I believe I have the right function found (with ida - i call it testStp), but I do ...
2
votes
0answers
90 views

Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes

I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse. When developing ...
1
vote
2answers
2k views

DPFMate Keychain tool

Got this Digital Keychain Photo viewer thingy. Comes with the DPFMate.exe software, which does not run under Windows 10. So far I've confirmed, that it runs perfectly on what they avertise - Windows ...
1
vote
1answer
47 views

advapi32.dll changes name of function during forwarding of exports

Im trying myself at writing a manual mapper, for injection of DLLs into other processes. Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
-1
votes
1answer
78 views

How to decode a .plr file

I have a .plr file that contains all of the player information for the game Terarria. I would like to decode it to have a look at what data is stored on this file so that I can play around with making ...
0
votes
0answers
18 views

Problems after export patch

I have a problem with a file patched. If I run original file with odg32 and edit 4 lines it works ok, but if I export this edit program doesn't works, or better works but not work correctly. I do 4 ...
4
votes
2answers
321 views

Understanding proprietary game texture/image format (.art)

I've been researching on how to modify the textures of Crazy Taxi 3 for a while now and I have pretty much hit a brick wall. The game stores its texture assets in .art files, which, from what I ...
0
votes
1answer
86 views

Decoding unknown logfile format

I have logfiles in the following format without any documentation: to 12.03.2020 08:04:15 < '7"\05\04\02\16\F6\C6\D6"'#0D to 12.03.2020 08:04:15 > '7S"\05\04\00\02\00\01\91\8E"'#0D to 12.03....
0
votes
1answer
782 views

Can “missing section headers” ELF files still be executed/dangerous?

On VirusTotal, there are lots of ELF samples are missing section headers when using file command to see the info. Also, when using the Python elftools library to parse them, exceptions will be thrown....
0
votes
1answer
73 views

Encrypted image format

I am trying to reverse a simple image format for bitmap data with an indexed colour palette. The structure of the file is generally clear and I am able to extract the size of the picture and the ...
1
vote
0answers
26 views

Format of Alcatel_Lucent I-240W-A backup file

I am trying to modify the backup file of this router in order to change some configurations. Here is the structure I have until now: 16 bytes of the header, zlib compressed xml with the ...
1
vote
0answers
328 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
1
vote
1answer
516 views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...