Reverse Engineering Beta

Questions tagged [file-format]

Ask Question

File format refers to the way information and data is encoded and stored in a computer file.

210 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
2
votes
1answer
881 views

File analysis with hexdump - unknown container

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
2
votes
1answer
236 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
0
votes
1answer
305 views

How to extract contents from this .DIG file?

I have this .DIG file from a PS2 game: https://drive.google.com/open?id=0B8-7FMP3lW8cU3NqUmNUcWdhcEk Apparently, it should contain most of the game data, except cutscene movies and voiceovers, which ...
1
vote
2answers
2k views

Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk

I am unable to open PNG files extracted from a certain Android app. I can't open them with the stock Android Gallery app. I can't open them in image browsers after downloading them on my computer. ...
1
vote
3answers
633 views

Find out how a program is reading a file

I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...
1
vote
2answers
1k views

Changing the format of IDA's Produce file -> Create ASM file

OK, so I know this is path is not recommended but it is a situation I have been forced into. I have a tool not created by me which takes the exported asm file from IDA and processes the exported ...
2
votes
2answers
228 views

VBA code detection in MS office documents

So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams. I've read ...
3
votes
0answers
98 views

methods for identifying deliberately unmagiked filesystem

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
3
votes
0answers
2k views

Reverse engineering ps2 game texture file format - got most of it but a few issues

I've spent a lot of time on this and I have made a lot of progress, but there is several problems to solve still. I have this old PS2 game and, as any curious person would, I put the disc in my ...
2
votes
1answer
815 views

Deducing Protobuf Schema and Datatypes

I have a number of protobuf files but no .proto schema file! cat myfile.pbuf | protoc --decode_raw > outputfile.txt Using the above command, I was able to decode the file into a somewhat readable ...
1
vote
2answers
2k views

Strange File Format: How to unpack a set of compressed files?

I am trying to extract data from a proprietary file type: .take. I am unfamiliar with file compression and encoding, but it appears as if this file type is acting as some sort of wrapper for other ...
1
vote
2answers
2k views

DPFMate Keychain tool

Got this Digital Keychain Photo viewer thingy. Comes with the DPFMate.exe software, which does not run under Windows 10. So far I've confirmed, that it runs perfectly on what they avertise - Windows ...
2
votes
1answer
300 views

Trying to reverse engineer teamviewer's printer driver

Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
0
votes
1answer
103 views

Finding What Data Means From File?

I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one. It's full of content such as this: 117dbdd0 15 ...
2
votes
2answers
573 views

Anyone recognize this variant of Intel HEX firmware format?

I've got a firmware file for an ARM Cortex-M0+ that is in a format extremely similar to Intel HEX. All data is encapsulated in a 0x3a ... 0xa wrapper. The fields seem to mostly match the 16 bit ...
1
vote
1answer
4k views

File Reverse Engineering – League of Legends WAD File Header Hash

I'm looking to edit League of Legends's WAD files, but the developers of the game have recently decided to add a sort of hash to these files to check if their content is valid. Unfortunately, no one ...
3
votes
1answer
2k views

Replace section inside ELF file

Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...
0
votes
1answer
445 views

reversing ios notes file format [closed]

I am trying to understand how to read iOS notes files as they are saved in the NoteStore.sqlite database in the iOS backup. Here are some sample files. Each file is a different note. I want to get ...
1
vote
0answers
1k views

How to decompress a custom game data file?

So here's the rundown: The files in themselves are .spc. Normally, you'd think this is a spectrum file, but it's a custom file made by the developer themselves. It contains an image that is used/will ...
3
votes
0answers
991 views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
1
vote
1answer
880 views

Decrypt / Decode / Decompress Proprietary File

I am using a 3rd party software that stores templates for ID cards in a database. I believe the templates are in xml format but are encrypted / encoded / compressed in the database. Each encoded ...
0
votes
3answers
207 views

Is it possible to indentify real file format from a 1995 file?

I have some files with the following extensions: .ENV .LEV .VHC Those are from a pretty old game (1995) that is abandonware, i wanted to open them for a testing project in Unity, but i don't know ...
4
votes
1answer
151 views

What does the author mean in these reverse engineering notes?

I am trying to write a decoder for an old video format used in a DOS game, the Psygnosis SMV video format, but I'm having a hard time understanding the image decoding process, specifically this ...
1
vote
1answer
3k views

Automatically extract known file types (eg. zip) using binwalk

This should have been made easy using binwalk however I fail to understand what I did wrong with the following syntax: $ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.1.1....
3
votes
2answers
332 views

Interpret binary format of matrix files provided (*.mtx)

I can't figure out exactly how these binary matrix files are formatted, other than the 2 little-endian 32-bit unsigned integers in the header. Supposedly the following is a 3x3 identity matrix: 0300 ...
1
vote
0answers
86 views

Do any of these details contradict the idea that theory that this file is encrypted with Blowfish?

I have a file which has been encrypted with some unknown algorithm. Doing research on the file format, I stumbled across a website that claimed (without explaining why) that these files were encrypted ...
5
votes
3answers
2k views

Does anyone know this encoding?

There is an interesting article on Phack: http://phrack.org/issues/69/15.html#article At the end of the article there is the source appended in a strange encoding. begin 664 hypervisor_for_rootkit....
1
vote
1answer
3k views

Simple carving of zip file using binwalk

I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error ...
3
votes
1answer
223 views

reverse engineering file containing time series data

I have to decode a proprietary file format which mainly contains time series data. The only thing I was told was that the content is 'zipped', although I am not sure whether it is really zipped or ...
3
votes
0answers
590 views

Reverse Engineering SCE .pkg Files

To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
5
votes
1answer
2k views

Reversing a 3D file format from 2001

This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now. I have already decoded the ...
1
vote
2answers
86 views

How to simulate responses from the file system

I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files ...
16
votes
2answers
3k views

Decoding an unknown image format with "DREK" signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
3
votes
1answer
2k views

What are the steps, to extract an unknown archive file in this case?

I've never did something like this before, but I have programming experiences. There are two files: data00.big and data01.big, which I would like to extract. I've tried Dragon Unpacker, which can ...
2
votes
2answers
5k views

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`). The problem with such a small signature ...
3
votes
1answer
2k views

Extracting textures from a file (Gamecube game)

There is a gamecube videogame (called Winning Eleven) which i want to translate, but i had no success in extracting the textures out of the files which contain them. I have tried several tools, one ...
9
votes
1answer
511 views

Visual Basic internal structure

I am analyzing some Visual Basic 6.0 malware(before .NET) and I have several questions regarding the internal structure of the format. The samples I have are both p-code or native code compiled(...
2
votes
2answers
445 views

Reading stp (Designaknit Stitch Pattern)-Files II

I know this is not an answer "Reading stp (Designaknit Stitch Pattern)-Files)", but i think it is a way to an answer. I believe I have the right function found (with ida - i call it testStp), but I do ...
1
vote
0answers
260 views

Reading stp (Designaknit Stitch Pattern)-Files

I want to write a small knitting program for my wife. In it, I will also read * .stp files (Stitch pattern). These are small files containing a graphic created by the program DesignaKnit and many of ...
3
votes
1answer
368 views

What is contained in this transmission? (RF pool-temperature sensor base unit receiver)

Note: I've made progress over at the EE stackexchange on pulling bits out of the signal (see https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal), but now i ...
4
votes
1answer
411 views

Challenging variable-length integer encoding

I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format: number ...
4
votes
1answer
3k views

Finding, hex-editing date timestamp to correct it

Trying hex-editing to fix the date-time data in file which was generated while the computer system clock was wrong. Some tutorial will be helpful appreciated after my attempts so far. [screen shot ...
3
votes
1answer
31k views

Extract text data from a compressed/encrypted .DAT file

Hello, I'm from Uruguay so I'll make my best effort to explain my "problem" in english. I want to read some text that is inside a .DAT file, but is "encrypted" or "compressed" (I don't know which is ...
1
vote
2answers
185 views

Given the files and their parsed content how can I reverse engineer the file format? [closed]

I have access to a few thousand binary files and I don't have the program that generated them. The files have been parsed and I also have access to the database where the parsed fields are stored. How ...
3
votes
1answer
694 views

How to reverse engineer dash cam metadata

I'm trying to write a video player for clips from Roadhawk dash cams that shows a speedometer and map. I've got the basics covered, it plays the video and sound and extracts the raw metadata from the ...
7
votes
1answer
2k views

Reverse engineering Earthsiege 2 3D model format

As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
2
votes
0answers
130 views

How can I further identify a file which the file command lists as 'data' [closed]

I have file named 'out'. If I issue the file command I see : :~/Desktop# file out out: data How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
6
votes
0answers
822 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
0
votes
1answer
76 views

Should these numbers be interpreted as flags or not, or something else?

I am reverse engineering the VAG format, which is a sound file format for the PSX (PlayStation 1). In the format, audio markers indicating audio looping points are encoded in the stream itself by a ...
0
votes
2answers
248 views

How to identify the structure of this specific data file? [closed]

What is the structure of this database file from an old videogame? https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0 Apologies in advance because fixing specific problems is not really the ...

1 2
3
4 5

Your privacy

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.