24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
user avatar
  • 1,374
6 votes
Accepted

What are the steps to reverse engineering a Shockwave .DCR file?

There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script ...
user avatar
  • 2,154
6 votes

Determining CRC algorithm (16 bit?) over RS-232

I figured it out! Some of the comments on this web site made me go back and think harder - actually to think differently. I thought that I should post the analysis that I did on these messages to try ...
user avatar
4 votes
Accepted

Reverse engineering serial communication CRC algorithm

This question seems simpler than you might expect. Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will ...
user avatar
  • 11.4k
4 votes
Accepted

Extracting the contents of an unknown archive file format

I hope you'll find your experience in RE.SE enjoyable and educating :) Reverse engineering is often studied as a hobby, so you're in good company! IDA pro is a disassembler, which is focused on ...
user avatar
  • 11.4k
4 votes
Accepted

Need help to reverse engineer a dog collar transmitter

Answer Consider a "gap" to be a "low" interval between two consecutive "high" interval, ignoring the first longest one. Then, a bit 1 corresponds to a long gap, and a bit ...
user avatar
4 votes

What to do with .dd files?

From my experience, file extensions are rarely meaningful. To really understand what format you are playing with, I suggest you to try the linux file command on this file. It will (maybe) give you ...
user avatar
  • 43
4 votes
Accepted

Decoding an unknown image format with "DREK" signature (*.drk)

I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
user avatar
  • 56
3 votes
Accepted

Open unknown image format (probably a RAW image)

Based on those images, this appears to be a fairly straight-forward run-length encoded 32-bits-per-pixel bitmap format. The general structure seems to consist of number of records each with a single '...
user avatar
  • 2,229
3 votes
Accepted

Deciphering an unknown graphics format

I'm not sure what the 'louie' files are for, but this python script should help reconstruct the images: import png # simple scale from [0,0x1f] to [0,0xff] def scale_up(n): return (n<<3)|n ...
user avatar
  • 881
3 votes
Accepted

Interpret binary format of matrix files provided (*.mtx)

You've correctly identified the first four bytes as the header or matrix shape. If you were to remove those shape bytes and realign the rest of the hex string, the identify matrix becomes very clear: ...
user avatar
  • 11.4k
2 votes

How could colors be encoded in these values?

Worked it out - the colors are encoded using the CIELAB color model. They are represented as a sequence of 3 8-byte, little endian doubles, corresponding to the C, I and E components of the color.
user avatar
  • 51
2 votes
Accepted

What is the format of this time?

Converting the numbers to ASCII, we get: 0 ~ 9 = 0 ~ 9 (0x30 ~ 0x39) 10 ~ 35 = A ~ Z (0x41 ~ 0x5a) 36 ~ 61 = a ~ z (0x61 ~ 0x7a) It is encoded this way probably to make it human-readable.
user avatar
  • 446
2 votes
Accepted

.bin files Firmware

Your camera has a Xilinx FPGA inside. FPGA design likely includes Microblaze soft CPU core. Files extracted by binwalk appear to be valid ELF files, so you'll just need to download Microblaze ...
user avatar
2 votes

Interpret binary format of matrix files provided (*.mtx)

Oh, I just figured it out. I can interpret each of the following 4 byte values after the header as 32-bit signed floating point values in little-endian format. 0000 803f would be equivalent to 1.0f. ...
user avatar
2 votes

reverse engineering file containing time series data

It would help if I knew what the data represented, but I have determined the format of the files once unzipped. Each unzipped file has this structure: short unk1; // 10 short num_records; ...
user avatar
  • 501
2 votes

Can't identify checksum type in unknown RS485 protocol

Found the solution: It is a XOR checksum with an initial key "5A" (not including the first four HEX values). 02 00 01 01 [01 00 00 02 40 00] 19 03 5A ^ 01 ^ 00 ^ 00 ^ 02 ^ 40 ^ 00 = 19
user avatar
2 votes
Accepted

Reverse engineering a partially known binary format

Edit: I'll leave my previous post/edits for historical purposes, but given this comment Also, I'd like to try solve it myself as much as possible with your help, not you solving it FOR me, pretty ...
user avatar
  • 176
1 vote
Accepted

Reverse engineering Roland TR-8S kit file format .t8k

After having unsuccessfully looking for complicated things I tried to think like a software developer and I found this: CRC32 of "534d504c00000200cdcde87e" = 0xdddcdb3c
user avatar
1 vote

Reverse engineering a checksum algorithm

One small discovery on the ND1: In a sys ex dump, byte 6 is 6 if you are dumping a single program, an 8 if you're dumping all. Byte 7 is a 0 if you're dumping one program or the number of the program ...
user avatar
1 vote

Reverse engineering a checksum algorithm

The only Nord Sys Ex spec I found was for the Nord Stage, which apparently used a "7-bit checksum (sum of all bytes above - wrapping)." So I yesterday I tried every variation of that I could think of,...
user avatar
1 vote

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)?

I read about similar issue with ZTE modem: ZTE encrypted backup config file It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work ...
user avatar
1 vote

Extracting the contents of an unknown file format

I'll post this as an answer to techniques to reverse engineer an unknown file. Reverse engineering is not about just looking at binary data. It is a detective mystery. You need to gather clues and try ...
user avatar
1 vote

Reverse engineering a partially known binary format

I'm working on some tooling for automatic reverse engineering. Having messages of varying length makes it much easier to determine which fields are related to overall message lengths. It also makes ...
user avatar
1 vote

How can I tell if a virus was made by Russians?

Code and binary is really, really hard. People who say it's easy are either stupid or want to sell you something. On the other hand, it's relatively easy if the code in question is created by a ...
user avatar
1 vote
Accepted

How to find out where an application stores the resolutions it allows?

One method (theoretical at this point) that comes to mind is searching for constants like resolution numbers in instructions for example, a game uses 600x800 resolution - you might find instructions ...
user avatar
  • 196
1 vote
Accepted

Unkown Swap Encoding

googling for e-snAetgrU yields the VBA Macros just copy paste the macros into a VBA module in word/excel/ insert a few Msgbox() and you can decrypt all the strings the unobfuscation is as follows ...
user avatar
  • 15k

Only top scored, non community-wiki answers of a minimum length are eligible