24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,384
6
votes
Accepted
What are the steps to reverse engineering a Shockwave .DCR file?
There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script ...
- 2,234
5
votes
Accepted
Extracting the contents of an unknown archive file format
I hope you'll find your experience in RE.SE enjoyable and educating :)
Reverse engineering is often studied as a hobby, so you're in good company!
IDA pro is a disassembler, which is focused on ...
- 11.7k
4
votes
Accepted
Need help to reverse engineer a dog collar transmitter
Answer
Consider a "gap" to be a "low" interval between two consecutive "high" interval, ignoring the first longest one. Then, a bit 1 corresponds to a long gap, and a bit ...
- 665
4
votes
What to do with .dd files?
From my experience, file extensions are rarely meaningful.
To really understand what format you are playing with, I suggest you to try the linux file command on this file. It will (maybe) give you ...
- 43
4
votes
Accepted
Decoding an unknown image format with "DREK" signature (*.drk)
I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
- 56
4
votes
Accepted
Reverse engineering serial communication CRC algorithm
This question seems simpler than you might expect.
Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will ...
- 11.7k
3
votes
Accepted
Open unknown image format (probably a RAW image)
Based on those images, this appears to be a fairly straight-forward run-length encoded 32-bits-per-pixel bitmap format.
The general structure seems to consist of number of records each with a single '...
- 2,503
3
votes
Accepted
Deciphering an unknown graphics format
I'm not sure what the 'louie' files are for, but this python script should help reconstruct the images:
import png
# simple scale from [0,0x1f] to [0,0xff]
def scale_up(n):
return (n<<3)|n
...
- 911
3
votes
Accepted
Interpret binary format of matrix files provided (*.mtx)
You've correctly identified the first four bytes as the header or matrix shape.
If you were to remove those shape bytes and realign the rest of the hex string, the identify matrix becomes very clear:
...
- 11.7k
2
votes
How could colors be encoded in these values?
Worked it out - the colors are encoded using the CIELAB color model. They are represented as a sequence of 3 8-byte, little endian doubles, corresponding to the C, I and E components of the color.
- 73
2
votes
Accepted
What is the format of this time?
Converting the numbers to ASCII, we get:
0 ~ 9 = 0 ~ 9 (0x30 ~ 0x39)
10 ~ 35 = A ~ Z (0x41 ~ 0x5a)
36 ~ 61 = a ~ z (0x61 ~ 0x7a)
It is encoded this way probably to make it human-readable.
- 456
2
votes
Accepted
.bin files Firmware
Your camera has a Xilinx FPGA inside. FPGA design likely includes Microblaze soft CPU core. Files extracted by binwalk appear to be valid ELF files, so you'll just need to download Microblaze ...
- 619
2
votes
Interpret binary format of matrix files provided (*.mtx)
Oh, I just figured it out. I can interpret each of the following 4 byte values after the header as 32-bit signed floating point values in little-endian format. 0000 803f would be equivalent to 1.0f.
...
- 269
2
votes
reverse engineering file containing time series data
It would help if I knew what the data represented, but I have determined the format of the files once unzipped. Each unzipped file has this structure:
short unk1; // 10
short num_records; ...
- 501
2
votes
Can't identify checksum type in unknown RS485 protocol
Found the solution:
It is a XOR checksum with an initial key "5A" (not including the first four HEX values).
02 00 01 01 [01 00 00 02 40 00] 19 03
5A ^ 01 ^ 00 ^ 00 ^ 02 ^ 40 ^ 00 = 19
- 21
2
votes
Accepted
Reverse engineering a partially known binary format
Edit:
I'll leave my previous post/edits for historical purposes, but given this comment
Also, I'd like to try solve it myself as much as possible with your help, not you solving it FOR me, pretty ...
- 206
2
votes
Accepted
Reverse engineering Roland TR-8S kit file format .t8k
After having unsuccessfully looking for complicated things I tried to think like a software developer and I found this:
CRC32 of "534d504c00000200cdcde87e" = 0xdddcdb3c
- 416
2
votes
Extracting the contents of an unknown file format
I'll post this as an answer to techniques to reverse engineer an unknown file. Reverse engineering is not about just looking at binary data. It is a detective mystery. You need to gather clues and try ...
- 878
1
vote
Advanced Binary Exploitation CTF
For Modern Binary Exploitation
https://github.com/nnamon/linux-exploitation-course
https://exploit.education/fusion/
For Kernel Exploitation
https://github.com/xairy/linux-kernel-exploitation
https:/...
1
vote
decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)?
I read about similar issue with ZTE modem: ZTE encrypted backup config file
It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work ...
- 101
1
vote
Reverse engineering a partially known binary format
I'm working on some tooling for automatic reverse engineering.
Having messages of varying length makes it much easier to determine which fields are related to overall message lengths. It also makes ...
- 878
1
vote
Reverse engineering a checksum algorithm
One small discovery on the ND1: In a sys ex dump, byte 6 is 6 if you are dumping a single program, an 8 if you're dumping all. Byte 7 is a 0 if you're dumping one program or the number of the program ...
- 13
1
vote
Reverse engineering a checksum algorithm
The only Nord Sys Ex spec I found was for the Nord Stage, which apparently used a "7-bit checksum (sum of all bytes above - wrapping)." So I yesterday I tried every variation of that I could think of,...
- 11
1
vote
How can I tell if a virus was made by Russians?
Code and binary is really, really hard. People who say it's easy are either stupid or want to sell you something. On the other hand, it's relatively easy if the code in question is created by a ...
- 843
1
vote
Accepted
How to find out where an application stores the resolutions it allows?
One method (theoretical at this point) that comes to mind is searching for constants like resolution numbers in instructions for example, a game uses 600x800 resolution - you might find instructions ...
- 196
1
vote
Accepted
Unkown Swap Encoding
googling for e-snAetgrU yields the VBA Macros
just copy paste the macros into a VBA module in word/excel/
insert a few Msgbox() and you can decrypt all the strings
the unobfuscation is as follows
...
- 16.3k
Only top scored, non community-wiki answers of a minimum length are eligible