11 votes
Accepted

How to read NSCR1000 data files?

It is encrypted with AES so you will need the keys from windows.plist to decode. The format is (all stored in big-endian): offset value 0-3 magic ('NSCR' for PersistentUIRecord) 4-7 version ...
user avatar
  • 1,331
10 votes
Accepted

Reverse engineering file containing sprites

You got started well; plotting unknown data as pixels immediately showed you this is indeed graphic data, not compressed (at least the buttons aren't), and in a usable RGB order. I guess the missing ...
user avatar
  • 2,274
9 votes

Reverse Engineer Video File Format

The first byte of the file is 0x47, which suggests that it's an MPEG transport stream. I used 010 Editor to create the following template for the file to parse it as an array of Partial Transport ...
user avatar
7 votes

What time structure is this?

The non-linearity is a clue that it's a floating-point encoding. If you are familiar with looking at floating point values in memory dumps, the most significant byte is often in the 0x3f-0x4f range, ...
user avatar
  • 71
7 votes

Windows boot process doesn't make sense!

(I'll assume you're talking about the boot process using legacy BIOS as UEFI situation is different) The boot manager is not a PE, or, rather, not just a PE. It starts with 16-bit realmode part. You ...
user avatar
  • 34.8k
7 votes
Accepted

Adding a new PE section for a code cave

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
user avatar
  • 11.4k
7 votes
Accepted

What kind of date stamp is this?

It's a 64 bit floating point value. See here: https://developer.apple.com/documentation/foundation/nsdate Returns a TimeInterval which happens to be typealias TimeInterval = Double Ref: https://...
user avatar
  • 664
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
user avatar
  • 34.8k
6 votes
Accepted

Win64 .pdata required to be a separate COFF section?

No, the Windows loader doesn't care about the name of the .pdata section. It doesn't find the RUNTIME_FUNCTION structs based on the section name, but rather based on the content of NtHeader->...
user avatar
5 votes
Accepted

What kind of compression/obfuscation algorithm is this?

The gzip headers are valid, but the deflate compressed data format is violated almost immediately, within less than ten bytes in for all of the files. For all of the example files provided, the first ...
user avatar
5 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
user avatar
5 votes

Unknown archive format from QNX operating system

Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package. ...
user avatar
  • 34.8k
4 votes
Accepted

Order of architecture headers in fat (universal) executables

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads ...
user avatar
  • 1,227
4 votes

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

First, a couple of clarifications The Import Address Table is a table that only consists of the imported function's addresses. Unlike the Import Table (which consists of IMAGE_IMPORT_DESCRIPTORs) that ...
user avatar
  • 11.4k
4 votes
Accepted

How do reverse engineers commonly detect the format of binary data?

The problem being addressed here is commonly called the semantic gap. If you stumble across any binary snippet like the one you posted, it's nearly impossible to deduce the way the value is meant to ...
user avatar
  • 2,826
4 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
user avatar
4 votes

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets. The pseodocode looks something like this: func rva2offset(pe, rva): for section in pe....
user avatar
  • 1,602
4 votes
Accepted

Name other than ".text" for the main code section

The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom ...
user avatar
  • 34.8k
3 votes
Accepted

PE: Strange entry in debug directory (Type: 0xc)

If you check winnt.h from the latest Windows 10 SDK you can find rest of the values there: #define IMAGE_DEBUG_TYPE_UNKNOWN 0 #define IMAGE_DEBUG_TYPE_COFF 1 #define ...
user avatar
3 votes
Accepted

Problem with converting hex values to decimal

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
user avatar
  • 11.4k
3 votes

Challenging variable-length integer encoding

Each of the eight fields in the record has a one-byte header. In the header, high nybble 8 means unsigned and high nybble 9 means signed (or possibly the other way around, can't be sure); low nybble ...
user avatar
  • 131
3 votes

Reverse engineering file containing sprites

If you really want to understand every byte of the file, then, as Jason pointed out, you'll have to get the program that reads it and reverse engineer that. Of course, this might be somewhere between ...
user avatar
3 votes
Accepted

How to calculate the checksum algorithm with data captures

The first byte starts as 0E is then 0F and then 10. This looks something like a sequential message id, not part of a checksum. The second byte has a pattern to it too and, taking into account the ...
user avatar
  • 2,164
3 votes
Accepted

Trying to rip the sprites of this game

Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the other important ...
user avatar
  • 2,274
2 votes
Accepted

Missing addresses from relocation section of ASLR enabled PE binary

There are a couple of possiblities here. One possibility is that the relocation table has been truncated, so you see only the first page of relocation items (the table is an array of items on a per-...
user avatar
  • 4,511
2 votes
Accepted

Extra bytes between clusters in FAT12

Your files aren't plain disk images, they are using the Encase File Format. Your repetitive bytes seem to be artifacts of that file format. There's a newer specification of the file format as well, ...
user avatar
2 votes
Accepted

Difference between Win7 and Win8 PE loader?

The difference is that Windows 8 requires all regular structures (exports, imports, TLS, exception handlers, relocations... that is, everything described by Data Directory entries) to be located ...
user avatar
  • 4,511
2 votes
Accepted

Calculating check sum of m-bus data frame

just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns so looking at the linked pdf it seems it is clear enough skip the start and ...
user avatar
  • 14.9k
2 votes

Function dependencies in static libraries

You are actually asking multiple different questions here : [Regarding static linking only a few functions of a library] Are there any general reasons why this is not a good idea or impossible?...
user avatar
  • 565
2 votes

Extracting embedded dlls from .NET executable

They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use Process Monitor to check from where they are loaded. ILSpy should be able to ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible