7 votes
Accepted

What kind of date stamp is this?

It's a 64 bit floating point value. See here: https://developer.apple.com/documentation/foundation/nsdate Returns a TimeInterval which happens to be typealias TimeInterval = Double Ref: https://...
Abigail's user avatar
  • 684
7 votes
Accepted

Adding a new PE section for a code cave

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
NirIzr's user avatar
  • 11.8k
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
Igor Skochinsky's user avatar
  • 36.6k
5 votes

Unknown archive format from QNX operating system

Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package. ...
Igor Skochinsky's user avatar
  • 36.6k
5 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
SheepReaper's user avatar
4 votes
Accepted

Order of architecture headers in fat (universal) executables

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads ...
knx's user avatar
  • 1,257
4 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
EIP Passenger's user avatar
4 votes

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

First, a couple of clarifications The Import Address Table is a table that only consists of the imported function's addresses. Unlike the Import Table (which consists of IMAGE_IMPORT_DESCRIPTORs) that ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

How do reverse engineers commonly detect the format of binary data?

The problem being addressed here is commonly called the semantic gap. If you stumble across any binary snippet like the one you posted, it's nearly impossible to deduce the way the value is meant to ...
Nordwald's user avatar
  • 2,896
4 votes

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets. The pseodocode looks something like this: func rva2offset(pe, rva): for section in pe....
mrexodia's user avatar
  • 1,652
4 votes
Accepted

Name other than ".text" for the main code section

The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom ...
Igor Skochinsky's user avatar
  • 36.6k
4 votes
Accepted

Decoding a time format

The values appear to be a floating point format similar to single-precision floating-point format. If I interpret the first byte as an unbiased exponent and interpret the other bytes (excluding the ...
Bavi_H's user avatar
  • 261
3 votes
Accepted

Problem with converting hex values to decimal

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

Decode C# binary serialization data

Turns out this was barely a reverse engineer task since everything is already available on internet. Mainly this post is a great read: How to analyse contents of binary serialization stream? And ...
tibar's user avatar
  • 375
3 votes
Accepted

How to calculate the checksum algorithm with data captures

The first byte starts as 0E is then 0F and then 10. This looks something like a sequential message id, not part of a checksum. The second byte has a pattern to it too and, taking into account the ...
Ian Cook's user avatar
  • 2,548
3 votes
Accepted

PE: Strange entry in debug directory (Type: 0xc)

If you check winnt.h from the latest Windows 10 SDK you can find rest of the values there: #define IMAGE_DEBUG_TYPE_UNKNOWN 0 #define IMAGE_DEBUG_TYPE_COFF 1 #define ...
Paweł Łukasik's user avatar
3 votes
Accepted

Trying to rip the sprites of this game

Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the other important ...
Jongware's user avatar
  • 2,364
2 votes
Accepted

Locating entry point in specific firmware .bin file using IDA Pro

(Disclaimer: I do not know ARM, this could be totally wrong) I loaded vi-default-firmware-FORDBOARD-ctv7.2.0.bin (downloaded from the releases page) into IDA with these settings: Then, after putting ...
Martin's user avatar
  • 468
2 votes

Function dependencies in static libraries

You are actually asking multiple different questions here : [Regarding static linking only a few functions of a library] Are there any general reasons why this is not a good idea or impossible?...
user2823000's user avatar
2 votes

Extracting embedded dlls from .NET executable

They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use Process Monitor to check from where they are loaded. ILSpy should be able to ...
Paweł Łukasik's user avatar
2 votes

Problem with converting hex values to decimal

This looks like the LEB128 encoding.    Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not ...
Ian Cook's user avatar
  • 2,548
2 votes
Accepted

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

Unfortunately the real life samples don’t always follow the nice and tidy specification; they only need to work on a specific implementation, not the ideal one described in the documentation. ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

Determine if an ELF file is signed or not

The -S flag lists all section headers, not "sig[nature] section header". The S stands for "sections", not "signature". Moreover, these section names appear to be quite unrelated to linux itself, but ...
NirIzr's user avatar
  • 11.8k
2 votes
Accepted

Is there a image format that starts with 0x4E 0x58 0x50 (ASCII 'NXP')?

It is a .NPK file. The full signature is NXPK. Use the latest version of quickbms to extract the game. You can't use offzip because npk files are compressed with lz4.
FILExt.com's user avatar
2 votes

Need help decoding bytes to number

Okay, I finally managed to convert it. Usually a byte-wise conversion is way better than what I did here, but result are OK so far, and basically it's all the same anyway. And yes, I'm not taking care ...
JayC667's user avatar
  • 141
1 vote

Which JSON object compact binary serialization is this?

1f 8b is gzip header magic so try decompressing it first, it may just be raw json
Igor Skochinsky's user avatar
  • 36.6k
1 vote

convert NPRG9x07.mbn to NPRG9x07.bin

The NPRG9x07.mbn and ENPRG9x07.mbn files are both regular ELF files, which should be recognized without problem by most disassemblers and decompilers. The NPRG9x07.mbn file is used for regular ...
Willem Hengeveld's user avatar
1 vote

how can I know if PE file has appended data or not?

As far as I know, you can't. While IMAGE_OPTIONAL_HEADER.SizeOfImage gives you the size of the whole PE file mapped to memory, it does not account for appended data. Appended data is commonly called ...
Johann Aydinbas's user avatar
1 vote

Help with a packed date format

After converting the HEX to 0 and 1, trying to look for a pattern, I think that it's not a coded date but a variation on number of days from a base date. I found two abnormalities - (Jul 4 2001, 03 5E ...
JTS's user avatar
  • 11
1 vote

How to find out if PE executable was compiled with gcc or VisualStudio?

If you use WinDbg, an easy way to tell might be to simply do a search for 0x00400000 (or whatever the image base address is) through every code page. I don't know why GCC does this but apparently, it ...
Jerry Hundric's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible