11
votes
Accepted
How to read NSCR1000 data files?
It is encrypted with AES so you will need the keys from windows.plist to decode.
The format is (all stored in big-endian):
offset value
0-3 magic ('NSCR' for PersistentUIRecord)
4-7 version ...
- 1,331
10
votes
Accepted
Reverse engineering file containing sprites
You got started well; plotting unknown data as pixels immediately showed you this is indeed graphic data, not compressed (at least the buttons aren't), and in a usable RGB order. I guess the missing ...
- 2,274
9
votes
Reverse Engineer Video File Format
The first byte of the file is 0x47, which suggests that it's an MPEG transport stream.
I used 010 Editor to create the following template for the file to parse it as an array of Partial Transport ...
- 20.4k
7
votes
What time structure is this?
The non-linearity is a clue that it's a floating-point encoding. If you are familiar with looking at floating point values in memory dumps, the most significant byte is often in the 0x3f-0x4f range, ...
- 71
7
votes
Windows boot process doesn't make sense!
(I'll assume you're talking about the boot process using legacy BIOS as UEFI situation is different)
The boot manager is not a PE, or, rather, not just a PE. It starts with 16-bit realmode part. You ...
- 34.8k
7
votes
Accepted
Adding a new PE section for a code cave
Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
- 11.4k
7
votes
Accepted
What kind of date stamp is this?
It's a 64 bit floating point value.
See here: https://developer.apple.com/documentation/foundation/nsdate
Returns a TimeInterval which happens to be typealias TimeInterval = Double
Ref: https://...
- 664
6
votes
Accepted
How to SUCCESSFULLY add a code section to an executable file in Linux?
libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
- 34.8k
6
votes
Accepted
Win64 .pdata required to be a separate COFF section?
No, the Windows loader doesn't care about the name of the .pdata section. It doesn't find the RUNTIME_FUNCTION structs based on the section name, but rather based on the content of NtHeader->...
- 20.4k
5
votes
Accepted
What kind of compression/obfuscation algorithm is this?
The gzip headers are valid, but the deflate compressed data format is violated almost immediately, within less than ten bytes in for all of the files.
For all of the example files provided, the first ...
- 191
5
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
- 51
5
votes
Unknown archive format from QNX operating system
Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package.
...
- 34.8k
4
votes
Accepted
Order of architecture headers in fat (universal) executables
There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections?
The kernel simply loads ...
- 1,227
4
votes
If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?
First, a couple of clarifications
The Import Address Table is a table that only consists of the imported function's addresses. Unlike the Import Table (which consists of IMAGE_IMPORT_DESCRIPTORs) that ...
- 11.4k
4
votes
Accepted
How do reverse engineers commonly detect the format of binary data?
The problem being addressed here is commonly called the semantic gap.
If you stumble across any binary snippet like the one you posted, it's nearly impossible to deduce the way the value is meant to ...
- 2,826
4
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
4
votes
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets.
The pseodocode looks something like this:
func rva2offset(pe, rva):
for section in pe....
- 1,602
4
votes
Accepted
Name other than ".text" for the main code section
The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom ...
- 34.8k
3
votes
Accepted
PE: Strange entry in debug directory (Type: 0xc)
If you check winnt.h from the latest Windows 10 SDK you can find rest of the values there:
#define IMAGE_DEBUG_TYPE_UNKNOWN 0
#define IMAGE_DEBUG_TYPE_COFF 1
#define ...
- 4,522
3
votes
Accepted
Problem with converting hex values to decimal
This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields.
It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
- 11.4k
3
votes
Challenging variable-length integer encoding
Each of the eight fields in the record has a one-byte header.
In the header, high nybble 8 means unsigned and high nybble 9 means signed (or possibly the other way around, can't be sure); low nybble ...
- 131
3
votes
Reverse engineering file containing sprites
If you really want to understand every byte of the file, then, as Jason pointed out, you'll have to get the program that reads it and reverse engineer that.
Of course, this might be somewhere between ...
- 12.7k
3
votes
Accepted
How to calculate the checksum algorithm with data captures
The first byte starts as 0E is then 0F and then 10.
This looks something like a sequential message id, not part of a checksum.
The second byte has a pattern to it too and, taking into account the ...
- 2,164
3
votes
Accepted
Trying to rip the sprites of this game
Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the other important ...
- 2,274
2
votes
Accepted
Missing addresses from relocation section of ASLR enabled PE binary
There are a couple of possiblities here.
One possibility is that the relocation table has been truncated, so you see only the first page of relocation items (the table is an array of items on a per-...
- 4,511
2
votes
Accepted
Extra bytes between clusters in FAT12
Your files aren't plain disk images, they are using the Encase File Format. Your repetitive bytes seem to be artifacts of that file format.
There's a newer specification of the file format as well, ...
- 12.7k
2
votes
Accepted
Difference between Win7 and Win8 PE loader?
The difference is that Windows 8 requires all regular structures (exports, imports, TLS, exception handlers, relocations... that is, everything described by Data Directory entries) to be located ...
- 4,511
2
votes
Accepted
Calculating check sum of m-bus data frame
just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns
so looking at the linked pdf it seems it is clear enough
skip the start and ...
- 14.9k
2
votes
Function dependencies in static libraries
You are actually asking multiple different questions here :
[Regarding static linking only a few functions of a library]
Are there any general reasons why this is not a good idea or impossible?...
- 565
2
votes
Extracting embedded dlls from .NET executable
They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use Process Monitor to check from where they are loaded.
ILSpy should be able to ...
- 4,522
Only top scored, non community-wiki answers of a minimum length are eligible