Reverse Engineering Beta

Questions tagged [file-format]

Ask Question

File format refers to the way information and data is encoded and stored in a computer file.

198 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
2
votes
1answer
277 views

Trying to reverse engineer teamviewer's printer driver

Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
0
votes
1answer
100 views

Finding What Data Means From File?

I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one. It's full of content such as this: 117dbdd0 15 ...
2
votes
2answers
504 views

Anyone recognize this variant of Intel HEX firmware format?

I've got a firmware file for an ARM Cortex-M0+ that is in a format extremely similar to Intel HEX. All data is encapsulated in a 0x3a ... 0xa wrapper. The fields seem to mostly match the 16 bit ...
1
vote
1answer
4k views

File Reverse Engineering – League of Legends WAD File Header Hash

I'm looking to edit League of Legends's WAD files, but the developers of the game have recently decided to add a sort of hash to these files to check if their content is valid. Unfortunately, no one ...
3
votes
1answer
1k views

Replace section inside ELF file

Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...
0
votes
1answer
421 views

reversing ios notes file format [closed]

I am trying to understand how to read iOS notes files as they are saved in the NoteStore.sqlite database in the iOS backup. Here are some sample files. Each file is a different note. I want to get ...
1
vote
0answers
961 views

How to decompress a custom game data file?

So here's the rundown: The files in themselves are .spc. Normally, you'd think this is a spectrum file, but it's a custom file made by the developer themselves. It contains an image that is used/will ...
3
votes
0answers
912 views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
1
vote
1answer
825 views

Decrypt / Decode / Decompress Proprietary File

I am using a 3rd party software that stores templates for ID cards in a database. I believe the templates are in xml format but are encrypted / encoded / compressed in the database. Each encoded ...
0
votes
3answers
203 views

Is it possible to indentify real file format from a 1995 file?

I have some files with the following extensions: .ENV .LEV .VHC Those are from a pretty old game (1995) that is abandonware, i wanted to open them for a testing project in Unity, but i don't know ...
4
votes
1answer
149 views

What does the author mean in these reverse engineering notes?

I am trying to write a decoder for an old video format used in a DOS game, the Psygnosis SMV video format, but I'm having a hard time understanding the image decoding process, specifically this ...
1
vote
1answer
3k views

Automatically extract known file types (eg. zip) using binwalk

This should have been made easy using binwalk however I fail to understand what I did wrong with the following syntax: $ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.1.1....
3
votes
2answers
307 views

Interpret binary format of matrix files provided (*.mtx)

I can't figure out exactly how these binary matrix files are formatted, other than the 2 little-endian 32-bit unsigned integers in the header. Supposedly the following is a 3x3 identity matrix: 0300 ...
1
vote
0answers
86 views

Do any of these details contradict the idea that theory that this file is encrypted with Blowfish?

I have a file which has been encrypted with some unknown algorithm. Doing research on the file format, I stumbled across a website that claimed (without explaining why) that these files were encrypted ...
5
votes
3answers
2k views

Does anyone know this encoding?

There is an interesting article on Phack: http://phrack.org/issues/69/15.html#article At the end of the article there is the source appended in a strange encoding. begin 664 hypervisor_for_rootkit....
1
vote
1answer
3k views

Simple carving of zip file using binwalk

I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error ...
3
votes
1answer
213 views

reverse engineering file containing time series data

I have to decode a proprietary file format which mainly contains time series data. The only thing I was told was that the content is 'zipped', although I am not sure whether it is really zipped or ...
3
votes
0answers
511 views

Reverse Engineering SCE .pkg Files

To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
5
votes
1answer
2k views

Reversing a 3D file format from 2001

This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now. I have already decoded the ...
1
vote
2answers
85 views

How to simulate responses from the file system

I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files ...
16
votes
2answers
2k views

Decoding an unknown image format with “DREK” signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
3
votes
1answer
2k views

What are the steps, to extract an unknown archive file in this case?

I've never did something like this before, but I have programming experiences. There are two files: data00.big and data01.big, which I would like to extract. I've tried Dragon Unpacker, which can ...
2
votes
2answers
4k views

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`). The problem with such a small signature ...
3
votes
1answer
2k views

Extracting textures from a file (Gamecube game)

There is a gamecube videogame (called Winning Eleven) which i want to translate, but i had no success in extracting the textures out of the files which contain them. I have tried several tools, one ...
9
votes
1answer
486 views

Visual Basic internal structure

I am analyzing some Visual Basic 6.0 malware(before .NET) and I have several questions regarding the internal structure of the format. The samples I have are both p-code or native code compiled(...
2
votes
2answers
406 views

Reading stp (Designaknit Stitch Pattern)-Files II

I know this is not an answer "Reading stp (Designaknit Stitch Pattern)-Files)", but i think it is a way to an answer. I believe I have the right function found (with ida - i call it testStp), but I do ...
1
vote
0answers
245 views

Reading stp (Designaknit Stitch Pattern)-Files

I want to write a small knitting program for my wife. In it, I will also read * .stp files (Stitch pattern). These are small files containing a graphic created by the program DesignaKnit and many of ...
3
votes
1answer
346 views

What is contained in this transmission? (RF pool-temperature sensor base unit receiver)

Note: I've made progress over at the EE stackexchange on pulling bits out of the signal (see https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal), but now i ...
4
votes
1answer
405 views

Challenging variable-length integer encoding

I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format: number ...
4
votes
1answer
3k views

Finding, hex-editing date timestamp to correct it

Trying hex-editing to fix the date-time data in file which was generated while the computer system clock was wrong. Some tutorial will be helpful appreciated after my attempts so far. [screen shot ...
2
votes
1answer
26k views

Extract text data from a compressed/encrypted .DAT file

Hello, I'm from Uruguay so I'll make my best effort to explain my "problem" in english. I want to read some text that is inside a .DAT file, but is "encrypted" or "compressed" (I don't know which is ...
1
vote
2answers
173 views

Given the files and their parsed content how can I reverse engineer the file format? [closed]

I have access to a few thousand binary files and I don't have the program that generated them. The files have been parsed and I also have access to the database where the parsed fields are stored. How ...
3
votes
1answer
670 views

How to reverse engineer dash cam metadata

I'm trying to write a video player for clips from Roadhawk dash cams that shows a speedometer and map. I've got the basics covered, it plays the video and sound and extracts the raw metadata from the ...
7
votes
1answer
2k views

Reverse engineering Earthsiege 2 3D model format

As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
2
votes
0answers
106 views

How can I further identify a file which the file command lists as 'data' [closed]

I have file named 'out'. If I issue the file command I see : :~/Desktop# file out out: data How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
6
votes
0answers
792 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
0
votes
1answer
73 views

Should these numbers be interpreted as flags or not, or something else?

I am reverse engineering the VAG format, which is a sound file format for the PSX (PlayStation 1). In the format, audio markers indicating audio looping points are encoded in the stream itself by a ...
0
votes
2answers
230 views

How to identify the structure of this specific data file? [closed]

What is the structure of this database file from an old videogame? https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0 Apologies in advance because fixing specific problems is not really the ...
2
votes
1answer
1k views

How to reverse engineer a database file format?

It is an accounting database whose database file format is proprietary data. But the problem is the database is highly unreliable, corruption go unnoticed for years after which it becomes unbearably ...
1
vote
0answers
1k views

Converting Duden dictionaries for Stardict/Goldendict

I’ve a bunch of first-class German dictionaries by Duden (the main German dictionary publisher) which, sadly, use a closed proprietary data format and their dedicated Duden-Bibliothek application (...
2
votes
2answers
2k views

Techniques for reverse engineering an unknown or protected file format

I'm working on converting a game originally developed to run on Windows for the web. I have a bunch of artwork for the game received from the artist in .tga image files which open fine in Photoshop. ...
8
votes
1answer
3k views

How to read NSCR1000 data files?

Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState. I did the backup of the file before the ...
1
vote
1answer
104 views

reversing bytcode - trying to work decompiling expression

I'm trying to reverse engineer a proprietary scripting "compiled bytecode" So I can recover source codes of contractor who has gone. While I worked out the majority of it, I'm trying to work out how ...
1
vote
1answer
531 views

File reverse engineering - .tbl format

I've been trying to google any information about how can i create a viewer for some custom file formats. In my case I've extracted multiple .tbl files from game sources. This file contains a database ...
2
votes
0answers
400 views

Finding the h.264 stream in a bytestream

I have a bytestream that contains h.264 bytestream packets in it. How can I find it? Output from stream: https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY The first 13 bytes ...
0
votes
0answers
581 views

Decompress NAND dump (custom LZ77/LZSS?)

I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used. Here is an extract ...
2
votes
1answer
575 views

What image format is ANIM1

I am investigating car navigation software which runs on QNX and want to replace the startup animation with my own. I have found the files in the firmware which have the extension .canim which likely ...
2
votes
1answer
92 views

Extra bytes between clusters in FAT12

I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
4
votes
3answers
1k views

Are there exports with neither ordinal nor name or am I not understanding the PE documentation?

I don't understand one thing in the export data directory of PE files. The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
4
votes
1answer
619 views

What is an indicator that a PE section definitely contains stuff of a specific type?

I was recently working with the Microsoft documentation about the PE and COFF specifications. Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...

1 2
3
4