Questions tagged [file-format]

File format refers to the way information and data is encoded and stored in a computer file.

Filter by
Sorted by
Tagged with
49
votes
12answers
4k views

Where to find information about a file format?

Let's say I found 'some' file (might be an executable, might be data, or something else) and want to run or read it. I open this file in a text editor, but the format isn't readable. Examples include: ...
25
votes
2answers
16k views

How to reverse engineer a proprietary data file format (e.g. Smartboard Notebook)?

How should I begin trying to reverse engineer this file format? The only thing I can think of is saving a simple file, and then dig in with a hex editor. But since the file format may be some kind of ...
21
votes
4answers
17k views

Firmware analysis and file system extraction?

I'm trying to analyse the firmware image of a NAS device. I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
17
votes
3answers
3k views

Automated tools for file format reverse engineering?

Are there any tools available to help automate the process of reverse engineering file formats? In particular, I'm interested in tools that use dynamic analysis of an application to parse the format, ...
16
votes
2answers
2k views

Decoding an unknown image format with “DREK” signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
16
votes
3answers
6k views

Parsing/Rescuing corrupted IDA database

I'm reversing an application with IDA. My VM crashed and left the IDA database in a corrupted unpacked state. The next time I tried to load it back, IDA gave me the following error message: The ...
13
votes
2answers
17k views

Extract SquashFS filesystem with shsq magic number

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it: DECIMAL HEX DESCRIPTION -----------...
12
votes
4answers
5k views

Reverse engineering compressed file, where to start?

I want to open finnish sports league "data file" used for bookkeeping. It includes all statistics for few decade, so it's interesting data file. The file is here: http://www.bittilahde.fi/Tietokanta....
12
votes
3answers
8k views

Reversing network protocol

I have a DVR that sends video over Ethernet using its own propriety TCP protocol. I want to write a VLC module to view the video, rather than the supplied DxClient.exe. I have captured traffic in ...
12
votes
4answers
1k views

What are the best practice methods for documenting research into the reverse engineering of a file format?

I a conduct research requiring the reverse engineering file formats, and I am currently looking at ways of documenting that work. On the web you will find resources that use box diagrams and free ...
11
votes
3answers
12k views

How should I determine the format of this audio file?

I have an audio file in an unknown format. How should I try to determine its format ? Also, is it possible to do this by manual observation and not using any automated tool ?
11
votes
2answers
3k views

Extract non-extractable private key from OS X Keychain

I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4. Basically, it appears that security import has a -x option to ...
10
votes
2answers
522 views

Trying to reverse engineer dump of a timestamp

I have the following hex parts and I have a strong suspicion that behind them is a date of an event: 2013.05.23 20:35:00 08014273ed2071a6800017 2013.05.23 21:45:00 08014273ed246cf0000017 2013....
10
votes
1answer
4k views

Where could one find a collection of mid-file binary signatures?

While reading an answer to another question, it was mentioned that "78 9C" was a well-known pattern for Zlib compressed data. Intrigued, I decided to search up the signature on the file signature ...
9
votes
1answer
486 views

Visual Basic internal structure

I am analyzing some Visual Basic 6.0 malware(before .NET) and I have several questions regarding the internal structure of the format. The samples I have are both p-code or native code compiled(...
8
votes
4answers
3k views

What's the easiest way to determine the OS contained in a firmware binary?

I have pulled the Firmware binary from a PPC and have it loaded into IDA. Now I'm trying to determine what operating system it contains but don't know where to start.
8
votes
1answer
3k views

How to read NSCR1000 data files?

Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState. I did the backup of the file before the ...
8
votes
1answer
1k views

identification/reverse engineer lz compression

I am doing a translation project for the PSP version of a game released by Prototype (Japanese company), but I am having trouble with some GIM files (image files). Now the actual problem is not with ...
8
votes
2answers
2k views

Decoding an ancient format

It's a very interesting file format may greatly satisfies binary archaeologists. sample file Background This file format was created in 90s to archive customer created AutoCAD components library ...
7
votes
3answers
2k views

Hauwei E586 firmware

I'm working on unpacking Hauwei E586 MiFi firmware. I downloaded firmware update pack which is available as Windows EXE, then used Hauwei Modem Flasher to unpack real firmware from installer. I've ...
7
votes
1answer
2k views

Reverse engineering Earthsiege 2 3D model format

As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
7
votes
1answer
2k views

Reverse engineer a proprietary save/file format structure

I am working on automating some functionality within a closed-source third party application; I want to automate the creation of "Project Files" (in its simplest form, just a collection of video files ...
6
votes
4answers
5k views

PDB v2.0 File Format documentation

Where I can find such information? I've already read the undocumented windows 2000 secrets explanation of it but it isn't complete. For example the 3rd stream format isn't explained. I have looked at ...
6
votes
2answers
294 views

What is this way of representing color in this unknown image format

All right, I have a PS3 image compressed with a variation of the LZ algoritm (magic bytes 43 5A 32 00) (I have successfully decompressed it) and what I get from the decompressed form is a set of ARGB ...
6
votes
2answers
1k views

Unknown Mac OSX 10.10 HFS+ compression

I'm trying to decompress a Mach-O binary which has been compressed using one of the compression algorithms in Mac 10.10's HFS+ implementation. Basically the file has the "com.apple.decmpfs" ...
6
votes
2answers
4k views

Decode date and time in a sequence of binary data

INTRO I'm trying to reverse engineer a binary data file containing sms messagges. The file is named ems.idx4 and was created with a software named LG PhoneManager around 5 years ago as a backup ...
6
votes
1answer
3k views

Any idea how to decode this binary data?

I have binary data representing a table. Here's the data when I print it with Python's repr(): \xff\xff\x05\x04test\x02A\x05test1@\x04\x03@@\x04\x05@0\x00\x00@\x05\x05test2\x03\x05\x05test1\x06@0\x00\...
6
votes
0answers
790 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
5
votes
3answers
4k views

Help reversing a EDB database file for Pioneers Rekordbox software

Pioneers Rekordbox software is a music management tool for DJs. One of its features is BPM detection for music files. Unfortunately it doesn't write this information to the BPM frame of the files ID3 ...
5
votes
2answers
261 views

Embedding URL call into an image / movie

Is there a way to embed a URL call in the raw data of an image or movie file, such that when the image or movie is opened, it makes a call to a webserver? I want to be able to obtain someone's ...
5
votes
3answers
2k views

Does anyone know this encoding?

There is an interesting article on Phack: http://phrack.org/issues/69/15.html#article At the end of the article there is the source appended in a strange encoding. begin 664 hypervisor_for_rootkit....
5
votes
1answer
743 views

Reverse engineering compressed byte array

We are trying to extract sonar data from a proprietary sonar log file format, which we have working well in most cases. The data is stored in binary, with a variable length header containing ...
5
votes
2answers
378 views

Is there a way to confirm and decompress files that I suspect are compressed with a very early format of PKZIP?

I have a very large number of files (tens of thousands) who's binary all begins with 0x00 0x06. They do not open with 7-ZIP. I notice also that all Office files seem to share the same next 32 bytes. ...
5
votes
1answer
3k views

Unknown compression algorithm

I got data which is compressed but I fail to find the compression algorithm. The data is part of a larger file from which I know the layout, So I managed to find out few things. What I know: I don'...
5
votes
1answer
2k views

Format of .chk firmware package on WGR614v7

Note: I'm aware of the technical and legal implications of reverse-enginneering binaries. I have the firmware for a Netgear WGR614v7 router, in the form of a .chk file, coming from Netgear themselves,...
5
votes
1answer
2k views

Reversing a 3D file format from 2001

This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now. I have already decoded the ...
4
votes
3answers
5k views

With a hex editor, can you really examine/modify every piece of code/data encoding in a “file”?

Say I open a 1x1 BMP file with a hex editor. Will the values therein link directly to the specification used to encode the image, and what the decoding image program will also see? If a dig in to ...
4
votes
2answers
4k views

Need help extracting data from .dat file

https://dl.dropboxusercontent.com/u/247623/item.dat This is a file from a Java game, and I would like to know how to legible string data from it. I would prefer if only hints were given to me. I ...
4
votes
2answers
411 views

Why does an executable give an error when opened in $tool?

I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
4
votes
2answers
812 views

How does a stripped XCOFF binary still remain usable?

IBM's AIX strip utility documentation states the following: The strip command with no options removes the line number information, relocation information, symbol table, the debug section, and the ...
4
votes
1answer
3k views

Find file signatures inside an unknown file

I have a .bin file I would like to analyse. Especially find images embedded in this firmware update. binwalk couldn't find anything. What other tools do you know to search for possible embedded ...
4
votes
2answers
638 views

DLL starting with DCD

Today I was investigating an issue with a Microsoft DLL, mscordacwks.dll, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it ...
4
votes
3answers
1k views

Are there exports with neither ordinal nor name or am I not understanding the PE documentation?

I don't understand one thing in the export data directory of PE files. The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
4
votes
1answer
619 views

What is an indicator that a PE section definitely contains stuff of a specific type?

I was recently working with the Microsoft documentation about the PE and COFF specifications. Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...
4
votes
1answer
665 views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
4
votes
2answers
321 views

Understanding proprietary game texture/image format (.art)

I've been researching on how to modify the textures of Crazy Taxi 3 for a while now and I have pretty much hit a brick wall. The game stores its texture assets in .art files, which, from what I ...
4
votes
2answers
469 views

Reverse engineering file format - ImageLink

I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files: book.bbi ...
4
votes
1answer
149 views

What does the author mean in these reverse engineering notes?

I am trying to write a decoder for an old video format used in a DOS game, the Psygnosis SMV video format, but I'm having a hard time understanding the image decoding process, specifically this ...
4
votes
1answer
405 views

Challenging variable-length integer encoding

I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format: number ...
4
votes
1answer
513 views

Obfuscated JPEG

This might be a bit of a narrow question but I think it is interesting. HP Photo Creations has made a thumbnail file that seems to contain an obfuscated JPEG inside it. I'm not sure why they would ...