Questions tagged [hex]

Format in which is visualized the memory content or the variables while memory inspection. Hexadecimal (or 'hex') represents integers in base 16 (with digits taken within `0`-`9` and `a`-`f`).

Filter by
Sorted by
Tagged with
19 votes
2 answers
4k views

What techniques are used in reverse engineering a serial protocol?

I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. A key piece of data we need is the current bus route a given ...
user avatar
  • 409
16 votes
1 answer
22k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
user avatar
  • 175
16 votes
3 answers
7k views

Parsing/Rescuing corrupted IDA database

I'm reversing an application with IDA. My VM crashed and left the IDA database in a corrupted unpacked state. The next time I tried to load it back, IDA gave me the following error message: The ...
user avatar
12 votes
2 answers
6k views

"Raw" offsets to "disassembler" offsets?

This is a very silly question, but surprisingly I've had a problem with this today. In a hex editor, I've found an offset and I wanted to take a look at that code in a disassembler. In the hex-editor, ...
user avatar
  • 515
11 votes
3 answers
3k views

Wanted: Java bytecode disassembler that shows addresses, opcodes, operands, in hex

I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal. To show ...
user avatar
10 votes
1 answer
4k views

How to see what compiler made PIC ASM code?

I extracted a .hex file from a PIC16F88. For example: :020000040000FA :100000008F3083160F0570388F009B0183129F017C :1000100083169F0107309C0005108312051483127C :...
user avatar
8 votes
3 answers
559 views

How to differentiate from different hex files of different families of microcontrollers?

Is there any way to differentiate different microcontroller's hex files? I have a hex file and now I have forgotten of which micro-controller it belongs. Is there any available tool to tell this? or ...
user avatar
7 votes
1 answer
2k views

Reverse engineering Earthsiege 2 3D model format

As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
user avatar
  • 173
7 votes
1 answer
3k views

Reverse-engineering a tough-to-crack video game save-file checksum

Been trying to figure this one out for a while now, and would be eternally grateful for anyone with more experience in checksum algorithms lending a hand. I've been trying to alter save files for an ...
user avatar
6 votes
3 answers
10k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
user avatar
6 votes
1 answer
720 views

Issues with reversing LZSS compression algorithm

I am trying to reverse engineer my HP printer's firmware, so I dumped the SPI chip from the board, and there are a lot of strings, but almost always look something like this: I noticed a pattern that ...
user avatar
  • 73
5 votes
1 answer
803 views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
user avatar
5 votes
1 answer
2k views

Reversing a 3D file format from 2001

This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now. I have already decoded the ...
user avatar
  • 215
4 votes
3 answers
3k views

What ways is there for an application to detect that it has been modified?

I am using ollydbg and a Hex editor. I confirmed that once the application is edited in any way it behaves different than normal. My first thought was that the file is checking the checksum value so ...
user avatar
  • 55
4 votes
1 answer
117 views

Help with a pointer

Sorry for this stupid question. It's late here and I've been kinda stuck for a while over this so I hope someone here can answer this easily. In CheatEngine, 028FA190+374 is pointing to 028F1788. ...
user avatar
4 votes
1 answer
2k views

Modifying a binary save-data file for a video game with a CRC/Checksum check

I recently overwrote the save game file of a video game that my girlfriend and I had been playing through. After trying to recover the file a few different ways (game didn't erase but overwrote the ...
user avatar
4 votes
1 answer
3k views

Finding, hex-editing date timestamp to correct it

Trying hex-editing to fix the date-time data in file which was generated while the computer system clock was wrong. Some tutorial will be helpful appreciated after my attempts so far. [screen shot ...
user avatar
  • 49
3 votes
1 answer
10k views

Making changes in ELF file after dissassembly [duplicate]

I am new to reverse engineering and after some research, I haven't found a clear way to do what I want to do. I have an ELF file, but not the original source code that generated it. It is really ...
user avatar
3 votes
1 answer
187 views

Deciphering the format of an unknown file

I am attempting to discover the exact format/encoding of a file. These files stem from closed-source analysis software we use on a daily basis. I would like to obtain the format in order to create an ...
user avatar
3 votes
2 answers
298 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
user avatar
3 votes
2 answers
794 views

Disassembling Hex to assembly, then what?

I am working on a HEX string, which I figured out is a binary. I would like some pointers on what to do next after I have disassembled from hex to assembly. I'm just assuming that the architecture is ...
user avatar
3 votes
1 answer
3k views

Converting hex value to lat/long

Sorry if this is the wrong place to ask this but I'm stumped. I'm looking at iOS code as follows. - (NSString *)currentE6Location { CLLocationCoordinate2D loc = [AppDelegate instance].mapView....
user avatar
  • 133
3 votes
1 answer
357 views

Decipher variable length serial protocol

I have an ebike consisting of a controller which regulates power to the motor and a smart LCD which can adjust max speed, power output, pedal assist sensitivity etc as well as displaying the current ...
user avatar
  • 33
3 votes
1 answer
694 views

How can I create an appropriate Japanese .tbl file for Hex Editing?

I'm trying to edit a Japanese Configuration executable using Resource Hacker and I just want to translate the UI stuff to English. There are also a few English text that I was able to find and ...
user avatar
3 votes
2 answers
1k views

Is there a tool to scan for code / functions that can account for different compilers?

I have a library DLL and a program that uses the library (statically; the DLL is separate). My goal is to find a bunch of the functions from the library in the program, but unfortunately, it looks ...
user avatar
  • 185
3 votes
1 answer
848 views

End of central directory signature not found after extracting an embedded zip file

I'm learning about stenography and found this example. I've followed the instructions but when I write out a new zip file after changing the filename inside the file I get this: unzip nospaces.zip ...
user avatar
3 votes
1 answer
713 views

Reverse Engineering Firmware

I have a HEX file with a firmware for Attiny45. What I want to do is to extract some kind of formula that is coded inside it. I have done some research (mostly to find out that "it is not possible", ...
user avatar
3 votes
1 answer
685 views

Finding timestamp in hex data

I'm reading stuff from public transport cards and I've got this hex data which is an usage history. I believe that these records contain timestamp or date in some format (but I'm not sure), but I ...
user avatar
  • 31
3 votes
0 answers
92 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
user avatar
2 votes
1 answer
7k views

Adding a new PE section for a code cave

I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
user avatar
  • 177
2 votes
1 answer
654 views

Unpack .apk file from a PC game (NOT Android related)

I have an old PC game called Air Strike 3D II. I wanted to extract music files but I couldn't figure out how to unpack the .apk file (NOT Android package). 7-zip can't open it. When I open the .apk ...
user avatar
  • 133
2 votes
1 answer
188 views

Decoding Hex Data

I'm trying to decode .PLW data acquired by a temperature logger (PicoLog PT-104). If you convert the .PLW file to a .txt file through the official software you get something like this: where each row ...
user avatar
  • 23
2 votes
1 answer
9k views

Basic question: how to input non-printable hex values in GDB / NC? [duplicate]

I'm working on a CTF challenge that is an introduction to smashing the stack. I have the binary working in GDB, and can overwrite the correct part of the stack with printable characters. The ...
user avatar
2 votes
1 answer
2k views

Bypassing av signature with Hex editing

I recently started studying on bypassing AV by finding an AV signature on nc.exe (NetCat) and changing it to see how it works. I have already found the place of signature with splitting method. Then, ...
user avatar
  • 121
2 votes
1 answer
2k views

Reversing unknown data in hex string

I have a string from job advert (Ethical hacker). I am not planning to candidate to that position. I just would try to resolve puzzle. Can someone suggest directions to look further? (And not yet post ...
user avatar
  • 123
2 votes
2 answers
409 views

Addressed changed by code from a common address

I have traced a static address which is using the base address and an offset. I am interrested in this address because a 'Find out what addresses this instruction accesses' shows values, changing as ...
user avatar
2 votes
2 answers
102 views

HEX code to call DLL function

I'm working with 2 third party DLLs (let's A.dll and B.dll), which I don't have the source code, only the compiled DLL. I know A.dll uses the main function from B.dll, and they both works perfectly. ...
user avatar
  • 23
2 votes
1 answer
359 views

Invalid INDX entries for $I30 on NTFS harddisk

While parsing my NTFS formatted hard disk, I found some invalid entries of INDX while Windows is still able to list all the root directory contents! The structure of the Index Record in NTFS 3.1 is ...
user avatar
  • 111
2 votes
1 answer
2k views

Calculating check sum of m-bus data frame

I'm trying to calculate the check sum of a m-bus data frame. In page 1 of this PDF I'm able to read that the frame's check sum "is calculated from the arithmetical sum of the data mentioned above, ...
user avatar
  • 135
2 votes
1 answer
98 views

Extra bytes between clusters in FAT12

I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
user avatar
  • 123
2 votes
1 answer
91 views

How to determine a type of binary serialization?

I'm trying to analyze the messages that the game sends to the server through WebSockets. I have a simple WebSockets proxy that stands in the middle and prints all messages to the console. I noticed ...
user avatar
  • 21
2 votes
1 answer
968 views

File analysis with hexdump - unknown container

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
user avatar
2 votes
0 answers
145 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
user avatar
  • 238
1 vote
1 answer
266 views

Hex timestamp decode

I am trying to decode this hex timestamp: 5A24 B103 73AE --> 02/26/2018 15:45:44 5A24 FC03 83BC --> 02/26/2018 17:00:48 5A24 FE03 93E3 --> 02/26/2018 17:02:58 Data is coming from an old ...
user avatar
  • 133
1 vote
1 answer
67 views

I want to modify the data [closed]

I am so newbie about this matter. I have a file XXXX.record file that contains a data. When I open the file How can I read this data and modify the values? thanks.
user avatar
  • 113
1 vote
1 answer
794 views

Router flash dump unknown filesystem

I'm trying to reverse engineering my router firmware after reading an interesting article about an hidden backdoor inside router firmwares from a popular company. Data has been extracted (using ...
user avatar
1 vote
1 answer
77 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
user avatar
  • 13
1 vote
1 answer
172 views

What does this sequence of numbers mean?

so i'm reversing a file format of game. As far as i can understand the file i'm trying to reverse contains compressed textures. I'm already able to locate the textures and decompress them, but i'm not ...
user avatar
1 vote
1 answer
842 views

How to extract an unknown archive file? Currently Im trying to open *.pak (P5CK)

I have a console game called Timesplitters Future Perfect(iso file). I were able to extract and got bunch of files. *.pak being one type I would like to open and see. I opened up a hex editor and saw ...
user avatar
  • 11
1 vote
1 answer
1k views

Basic clarifications about .hex and .bin file

I am newcomer to this field. I would like to understand how these things work and what these file contain (and if I'm on the right path). To explain my doubts, I will use the .hex file posted in a ...
user avatar
  • 175