11
votes
Accepted
How to read NSCR1000 data files?
It is encrypted with AES so you will need the keys from windows.plist to decode.
The format is (all stored in big-endian):
offset value
0-3 magic ('NSCR' for PersistentUIRecord)
4-7 version ...
- 1,331
7
votes
Accepted
What kind of date stamp is this?
It's a 64 bit floating point value.
See here: https://developer.apple.com/documentation/foundation/nsdate
Returns a TimeInterval which happens to be typealias TimeInterval = Double
Ref: https://...
- 684
7
votes
Accepted
Adding a new PE section for a code cave
Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
- 11.7k
6
votes
Accepted
How to SUCCESSFULLY add a code section to an executable file in Linux?
libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
- 36.4k
5
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
- 151
5
votes
Unknown archive format from QNX operating system
Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package.
...
- 36.4k
4
votes
Accepted
Order of architecture headers in fat (universal) executables
There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections?
The kernel simply loads ...
- 1,257
4
votes
If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?
First, a couple of clarifications
The Import Address Table is a table that only consists of the imported function's addresses. Unlike the Import Table (which consists of IMAGE_IMPORT_DESCRIPTORs) that ...
- 11.7k
4
votes
Accepted
How do reverse engineers commonly detect the format of binary data?
The problem being addressed here is commonly called the semantic gap.
If you stumble across any binary snippet like the one you posted, it's nearly impossible to deduce the way the value is meant to ...
- 2,896
4
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
4
votes
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets.
The pseodocode looks something like this:
func rva2offset(pe, rva):
for section in pe....
- 1,652
4
votes
Accepted
Name other than ".text" for the main code section
The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom ...
- 36.4k
4
votes
Accepted
Decoding a time format
The values appear to be a floating point format similar to single-precision floating-point format.
If I interpret the first byte as an unbiased exponent and interpret the other bytes (excluding the ...
- 261
3
votes
Accepted
Problem with converting hex values to decimal
This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields.
It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
- 11.7k
3
votes
Accepted
Decode C# binary serialization data
Turns out this was barely a reverse engineer task since everything is already available on internet. Mainly this post is a great read:
How to analyse contents of binary serialization stream?
And ...
- 375
3
votes
Accepted
How to calculate the checksum algorithm with data captures
The first byte starts as 0E is then 0F and then 10.
This looks something like a sequential message id, not part of a checksum.
The second byte has a pattern to it too and, taking into account the ...
- 2,503
3
votes
Accepted
PE: Strange entry in debug directory (Type: 0xc)
If you check winnt.h from the latest Windows 10 SDK you can find rest of the values there:
#define IMAGE_DEBUG_TYPE_UNKNOWN 0
#define IMAGE_DEBUG_TYPE_COFF 1
#define ...
- 4,912
3
votes
Challenging variable-length integer encoding
Each of the eight fields in the record has a one-byte header.
In the header, high nybble 8 means unsigned and high nybble 9 means signed (or possibly the other way around, can't be sure); low nybble ...
- 131
3
votes
Accepted
Trying to rip the sprites of this game
Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the other important ...
- 2,354
2
votes
Accepted
Given a program binary, how can I know which compiler it is compiled from?
I am no expert in the matter but I would try:
see exported functions names
if mangling is present you can use it for compiler detection. Just make a list of exported function names and compare to ...
- 1,384
2
votes
Accepted
Difference between Win7 and Win8 PE loader?
The difference is that Windows 8 requires all regular structures (exports, imports, TLS, exception handlers, relocations... that is, everything described by Data Directory entries) to be located ...
- 4,701
2
votes
Accepted
Calculating check sum of m-bus data frame
just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns
so looking at the linked pdf it seems it is clear enough
skip the start and ...
- 16.3k
2
votes
Accepted
Locating entry point in specific firmware .bin file using IDA Pro
(Disclaimer: I do not know ARM, this could be totally wrong)
I loaded vi-default-firmware-FORDBOARD-ctv7.2.0.bin (downloaded from the releases page) into IDA with these settings:
Then, after putting ...
- 458
2
votes
Function dependencies in static libraries
You are actually asking multiple different questions here :
[Regarding static linking only a few functions of a library]
Are there any general reasons why this is not a good idea or impossible?...
- 565
2
votes
Extracting embedded dlls from .NET executable
They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use Process Monitor to check from where they are loaded.
ILSpy should be able to ...
- 4,912
2
votes
Problem with converting hex values to decimal
This looks like the LEB128 encoding.
Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not ...
- 2,503
2
votes
Accepted
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
Unfortunately the real life samples don’t always follow the nice and tidy specification; they only need to work on a specific implementation, not the ideal one described in the documentation.
...
- 36.4k
2
votes
Determine if an ELF file is signed or not
The -S flag lists all section headers, not "sig[nature] section header". The S stands for "sections", not "signature".
Moreover, these section names appear to be quite unrelated to linux itself, but ...
- 11.7k
2
votes
Accepted
Is there a image format that starts with 0x4E 0x58 0x50 (ASCII 'NXP')?
It is a .NPK file. The full signature is NXPK.
Use the latest version of quickbms to extract the game.
You can't use offzip because npk files are compressed with lz4.
- 36
2
votes
Need help decoding bytes to number
Okay, I finally managed to convert it.
Usually a byte-wise conversion is way better than what I did here, but result are OK so far, and basically it's all the same anyway.
And yes, I'm not taking care ...
- 141
Only top scored, non community-wiki answers of a minimum length are eligible