Questions tagged [file-format]
File format refers to the way information and data is encoded and stored in a computer file.
198
questions
2
votes
1answer
277 views
Trying to reverse engineer teamviewer's printer driver
Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
0
votes
1answer
100 views
Finding What Data Means From File?
I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one.
It's full of content such as this:
117dbdd0 15 ...
2
votes
2answers
504 views
Anyone recognize this variant of Intel HEX firmware format?
I've got a firmware file for an ARM Cortex-M0+ that is in a format extremely similar to Intel HEX. All data is encapsulated in a 0x3a ... 0xa wrapper. The fields seem to mostly match the 16 bit ...
1
vote
1answer
4k views
File Reverse Engineering – League of Legends WAD File Header Hash
I'm looking to edit League of Legends's WAD files, but the developers of the game have recently decided to add a sort of hash to these files to check if their content is valid. Unfortunately, no one ...
3
votes
1answer
1k views
Replace section inside ELF file
Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...
0
votes
1answer
421 views
reversing ios notes file format [closed]
I am trying to understand how to read iOS notes files as they are saved in the NoteStore.sqlite database in the iOS backup.
Here are some sample files. Each file is a different note.
I want to get ...
1
vote
0answers
961 views
How to decompress a custom game data file?
So here's the rundown:
The files in themselves are .spc. Normally, you'd think this is a spectrum file, but it's a custom file made by the developer themselves. It contains an image that is used/will ...
3
votes
0answers
912 views
Reverse-engineering DOS game's data files
I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
1
vote
1answer
825 views
Decrypt / Decode / Decompress Proprietary File
I am using a 3rd party software that stores templates for ID cards in a database. I believe the templates are in xml format but are encrypted / encoded / compressed in the database.
Each encoded ...
0
votes
3answers
203 views
Is it possible to indentify real file format from a 1995 file?
I have some files with the following extensions: .ENV .LEV .VHC
Those are from a pretty old game (1995) that is abandonware, i wanted to open them for a testing project in Unity, but i don't know ...
4
votes
1answer
149 views
What does the author mean in these reverse engineering notes?
I am trying to write a decoder for an old video format used in a DOS game, the Psygnosis SMV video format, but I'm having a hard time understanding the image decoding process, specifically this ...
1
vote
1answer
3k views
Automatically extract known file types (eg. zip) using binwalk
This should have been made easy using binwalk however I fail to understand what I did wrong with the following syntax:
$ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.1.1....
3
votes
2answers
307 views
Interpret binary format of matrix files provided (*.mtx)
I can't figure out exactly how these binary matrix files are formatted, other than the 2 little-endian 32-bit unsigned integers in the header. Supposedly the following is a 3x3 identity matrix:
0300 ...
1
vote
0answers
86 views
Do any of these details contradict the idea that theory that this file is encrypted with Blowfish?
I have a file which has been encrypted with some unknown algorithm. Doing research on the file format, I stumbled across a website that claimed (without explaining why) that these files were encrypted ...
5
votes
3answers
2k views
Does anyone know this encoding?
There is an interesting article on Phack:
http://phrack.org/issues/69/15.html#article
At the end of the article there is the source appended in a strange encoding.
begin 664 hypervisor_for_rootkit....
1
vote
1answer
3k views
Simple carving of zip file using binwalk
I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error ...
3
votes
1answer
213 views
reverse engineering file containing time series data
I have to decode a proprietary file format which mainly contains time series data. The only thing I was told was that the content is 'zipped', although I am not sure whether it is really zipped or ...
3
votes
0answers
511 views
Reverse Engineering SCE .pkg Files
To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
5
votes
1answer
2k views
Reversing a 3D file format from 2001
This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now.
I have already decoded the ...
1
vote
2answers
85 views
How to simulate responses from the file system
I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files ...
16
votes
2answers
2k views
Decoding an unknown image format with “DREK” signature (*.drk)
There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
3
votes
1answer
2k views
What are the steps, to extract an unknown archive file in this case?
I've never did something like this before, but I have programming experiences. There are two files:
data00.big and data01.big, which I would like to extract.
I've tried Dragon Unpacker, which can ...
2
votes
2answers
4k views
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`).
The problem with such a small signature ...
3
votes
1answer
2k views
Extracting textures from a file (Gamecube game)
There is a gamecube videogame (called Winning Eleven) which i want to translate, but i had no success in extracting the textures out of the files which contain them.
I have tried several tools, one ...
9
votes
1answer
486 views
Visual Basic internal structure
I am analyzing some Visual Basic 6.0 malware(before .NET) and I have several questions regarding the internal structure of the format. The samples I have are both p-code or native code compiled(...
2
votes
2answers
406 views
Reading stp (Designaknit Stitch Pattern)-Files II
I know this is not an answer "Reading stp (Designaknit Stitch Pattern)-Files)", but i think it is a way to an answer.
I believe I have the right function found (with ida - i call it testStp), but I do ...
1
vote
0answers
245 views
Reading stp (Designaknit Stitch Pattern)-Files
I want to write a small knitting program for my wife. In it, I will also read * .stp files (Stitch pattern). These are small files containing a graphic created by the program DesignaKnit and many of ...
3
votes
1answer
346 views
What is contained in this transmission? (RF pool-temperature sensor base unit receiver)
Note: I've made progress over at the EE stackexchange on pulling bits out of the signal (see https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal), but now i ...
4
votes
1answer
405 views
Challenging variable-length integer encoding
I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format:
number ...
4
votes
1answer
3k views
Finding, hex-editing date timestamp to correct it
Trying hex-editing to fix the date-time data in file which was generated while the computer system clock was wrong. Some tutorial will be helpful appreciated after my attempts so far.
[screen shot ...
2
votes
1answer
26k views
Extract text data from a compressed/encrypted .DAT file
Hello,
I'm from Uruguay so I'll make my best effort to explain my "problem" in english.
I want to read some text that is inside a .DAT file, but is "encrypted" or "compressed" (I don't know which is ...
1
vote
2answers
173 views
Given the files and their parsed content how can I reverse engineer the file format? [closed]
I have access to a few thousand binary files and I don't have the program that generated them. The files have been parsed and I also have access to the database where the parsed fields are stored. How ...
3
votes
1answer
670 views
How to reverse engineer dash cam metadata
I'm trying to write a video player for clips from Roadhawk dash cams that shows a speedometer and map. I've got the basics covered, it plays the video and sound and extracts the raw metadata from the ...
7
votes
1answer
2k views
Reverse engineering Earthsiege 2 3D model format
As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
2
votes
0answers
106 views
How can I further identify a file which the file command lists as 'data' [closed]
I have file named 'out'. If I issue the file command I see :
:~/Desktop# file out
out: data
How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
6
votes
0answers
792 views
Audio file compression identification
I've been working on reversing file formats from the game of star wars episode 1: the phantom menace.
I have managed to extract the audio files from the .lab file in which they were contained. I ...
0
votes
1answer
73 views
Should these numbers be interpreted as flags or not, or something else?
I am reverse engineering the VAG format, which is a sound file format for the PSX (PlayStation 1). In the format, audio markers indicating audio looping points are encoded in the stream itself by a ...
0
votes
2answers
230 views
How to identify the structure of this specific data file? [closed]
What is the structure of this database file from an old videogame? https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0
Apologies in advance because fixing specific problems is not really the ...
2
votes
1answer
1k views
How to reverse engineer a database file format?
It is an accounting database whose database file format is proprietary data. But the problem is the database is highly unreliable, corruption go unnoticed for years after which it becomes unbearably ...
1
vote
0answers
1k views
Converting Duden dictionaries for Stardict/Goldendict
I’ve a bunch of first-class German dictionaries by Duden (the main German dictionary publisher) which, sadly, use a closed proprietary data format and their dedicated Duden-Bibliothek application (...
2
votes
2answers
2k views
Techniques for reverse engineering an unknown or protected file format
I'm working on converting a game originally developed to run on Windows for the web. I have a bunch of artwork for the game received from the artist in .tga image files which open fine in Photoshop. ...
8
votes
1answer
3k views
How to read NSCR1000 data files?
Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState.
I did the backup of the file before the ...
1
vote
1answer
104 views
reversing bytcode - trying to work decompiling expression
I'm trying to reverse engineer a proprietary scripting "compiled bytecode" So I can recover source codes of contractor who has gone.
While I worked out the majority of it, I'm trying to work out how ...
1
vote
1answer
531 views
File reverse engineering - .tbl format
I've been trying to google any information about how can i create a viewer for some custom file formats.
In my case I've extracted multiple .tbl files from game sources. This file contains a database ...
2
votes
0answers
400 views
Finding the h.264 stream in a bytestream
I have a bytestream that contains h.264 bytestream packets in it. How can I find it?
Output from stream:
https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY
The first 13 bytes ...
0
votes
0answers
581 views
Decompress NAND dump (custom LZ77/LZSS?)
I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used.
Here is an extract ...
2
votes
1answer
575 views
What image format is ANIM1
I am investigating car navigation software which runs on QNX and want to replace the startup animation with my own. I have found the files in the firmware which have the extension .canim which likely ...
2
votes
1answer
92 views
Extra bytes between clusters in FAT12
I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
4
votes
3answers
1k views
Are there exports with neither ordinal nor name or am I not understanding the PE documentation?
I don't understand one thing in the export data directory of PE files.
The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
4
votes
1answer
619 views
What is an indicator that a PE section definitely contains stuff of a specific type?
I was recently working with the Microsoft documentation about the PE and COFF specifications.
Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...