23

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size Comparing provided background image to its raw image size xs*ys reveal direct dependence Which implies no compression or one that has always the same pixel to ...


5

I figured it out! Some of the comments on this web site made me go back and think harder - actually to think differently. I thought that I should post the analysis that I did on these messages to try to determine the CRC algorighm. My analysis is based on a paper written by Greg Ewing http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-...


4

There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script or two have been created for use with their program, QuickBMS. That won't teach you how to reverse the format, but if you spend some time reading what QuickBMS ...


4

Answer Consider a "gap" to be a "low" interval between two consecutive "high" interval, ignoring the first longest one. Then, a bit 1 corresponds to a long gap, and a bit 0 corresponds to a short gap. Therefore, the messages decoded that way are: 88 14 4b 00 ee : Light 84 14 4b 00 de : Beep 81 14 4b 00 7e : Zap 82 14 4b 00 be : Vibrate 82 14 4b 01 ...


4

From my experience, file extensions are rarely meaningful. To really understand what format you are playing with, I suggest you to try the linux file command on this file. It will (maybe) give you more insight on what you are working with. I never did picoCTF but I bet the .dd refers to a raw disk image. Now I have only a few experience in Forensics (yes I ...


3

I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is available here: https://github.com/K-Adam/DrekDecoder Summary Each line starts with a flag byte. It tells the decoder how many pixels to write and which mode ...


3

I'm not sure what the 'louie' files are for, but this python script should help reconstruct the images: import png # simple scale from [0,0x1f] to [0,0xff] def scale_up(n): return (n<<3)|n def make_pal(n): val = (n[1]<<8)|n[0] return [scale_up((val>>0)&0x1f), scale_up((val>>5)&0x1f), scale_up((val>>10)&0x1f)]...


3

You've correctly identified the first four bytes as the header or matrix shape. If you were to remove those shape bytes and realign the rest of the hex string, the identify matrix becomes very clear: 0000 803f 0000 0000 0000 0000 0000 0000 0000 803f 0000 0000 0000 0000 0000 0000 0000 803f We can easily see here that the text aligns to the shape of an ...


3

This question seems simpler than you might expect. Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will be shown below. as the first byte in each message indeed looks like a preamble, we'll ignore it. Our goal is to recover the function which, when applied to the ...


2

It would help if I knew what the data represented, but I have determined the format of the files once unzipped. Each unzipped file has this structure: short unk1; // 10 short num_records; // 8751 (8760 hours per year) short unk2; // 0 short num_samples; // varies per file from 8 to 179 short unk3; // 0 short unk4; ...


2

Oh, I just figured it out. I can interpret each of the following 4 byte values after the header as 32-bit signed floating point values in little-endian format. 0000 803f would be equivalent to 1.0f. I determined this in node.js using a DataView: const u = new Uint8Array(4); const d = new DataView(u.buffer); u[0] = 0x00; u[1] = 0x00; u[2] = 0x80; u[3] = ...


2

Worked it out - the colors are encoded using the CIELAB color model. They are represented as a sequence of 3 8-byte, little endian doubles, corresponding to the C, I and E components of the color.


2

Converting the numbers to ASCII, we get: 0 ~ 9 = 0 ~ 9 (0x30 ~ 0x39) 10 ~ 35 = A ~ Z (0x41 ~ 0x5a) 36 ~ 61 = a ~ z (0x61 ~ 0x7a) It is encoded this way probably to make it human-readable.


2

I hope you'll find your experience in RE.SE enjoyable and educating :) Reverse engineering is often studied as a hobby, so you're in good company! IDA pro is a disassembler, which is focused on reverse engineering / reading assembly/machine code. that is - the code actually executed by the CPU. Since it appears you were only given a format file, without ...


2

Found the solution: It is a XOR checksum with an initial key "5A" (not including the first four HEX values). 02 00 01 01 [01 00 00 02 40 00] 19 03 5A ^ 01 ^ 00 ^ 00 ^ 02 ^ 40 ^ 00 = 19


1

Code and binary is really, really hard. People who say it's easy are either stupid or want to sell you something. On the other hand, it's relatively easy if the code in question is created by a completely naive person or they really don't give a damn if it being attributed to them. For general education try some results of this search https://www.google.com....


1

One method (theoretical at this point) that comes to mind is searching for constants like resolution numbers in instructions for example, a game uses 600x800 resolution - you might find instructions like push 0x320 #800 in decimal push 0x258 #600 in decimal call initwindowfunction_orsomething or it might reference integers stored in a data section or ...


1

Your camera has a Xilinx FPGA inside. FPGA design likely includes Microblaze soft CPU core. Files extracted by binwalk appear to be valid ELF files, so you'll just need to download Microblaze toolchain. The easiest way to do so is to download Vivado WebPack (it's free) and install it — you'll find a toolchain in the Xilinx SDK folder. $ microblazeel-xilinx-...


1

googling for e-snAetgrU yields the VBA Macros just copy paste the macros into a VBA module in word/excel/ insert a few Msgbox() and you can decrypt all the strings the unobfuscation is as follows obf_str = "e-snAetgrU" obf_str_len = len(obf-str) == 10 redherr = 1 i = 0 d(69, 43, obf_str) rand = arg1 == 69 REPEAT: Char_Choice_num = ( ...


Only top voted, non community-wiki answers of a minimum length are eligible