24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
Spektre's user avatar
  • 1,384
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
julian's user avatar
  • 7,138
8 votes
Accepted

What compression algorithm is this?

As you say it is an LZ77 style format, however I could not find a specific algorithm which it matches. The compressed data forms a number of blocks, each of which contain at least one of some data, ...
zed0's user avatar
  • 96
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
user20993's user avatar
8 votes

Reverse Engineering a Firmware. Someone can help me?

Finding: NGA_FW_CURRENT.BIN is a compressed Videx microchip firmware image file. Preliminary Remarks There is conflicting background information given in the comments about the file alleged to be ...
julian's user avatar
  • 7,138
7 votes

Extracting textures from a file (Gamecube game)

This looks .. interesting. When i open the first and second of your files in a hex editor, one has 20240 bytes, the other has 10240 bytes (all numbers in hex). So, 2^16+220 in one case, 2^17+220 in ...
Guntram Blohm's user avatar
7 votes
Accepted

Compression algorithm from very old tape backup?

Just to close the loop on this: I ended up successfully reverse-engineering this compression format, which turned out to be written by an extremely obscure tape backup tool from the early 90s called ...
Dmitry Brant's user avatar
6 votes

Any ideas on how to decode Photoshop Liquify .msh files?

Here's a description of the .msh format on Adobe Photoshop CC 2019, at least of what I've been able to glean. The format uses run-length encoding to encode the offset coordinates of the mesh cells ...
Stefan Dragnev's user avatar
5 votes
Accepted

Need help with compressed string of unknown format

As @w4rex said, it definitely looks like base64. If you try to decode it like a regular base64 string, you end up with : 37 7a bc af 27 1c 00 03 d8 a0 33 34 30 78 00 00 7z.............. You ...
user2823000's user avatar
5 votes
Accepted

Unknown game file decompress

it seems to be compressed in some way because you can read some plain text there This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
julian's user avatar
  • 7,138
5 votes
Accepted

Extracting the contents of an unknown archive file format

I hope you'll find your experience in RE.SE enjoyable and educating :) Reverse engineering is often studied as a hobby, so you're in good company! IDA pro is a disassembler, which is focused on ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

The code isn't easy to read since one has to do that statically and it doesn't seem to respect a standard EABI. So, instead of trying to fully reverse engineer the code, I tried to search for the used ...
wisk's user avatar
  • 1,154
4 votes

Decompressing zImage

the zImage kernel is "uncompressed" in the meaning that it can be just copied to some place in RAM and run from there as-is, without additional decompression step. The bulk of the kernel is still ...
Igor Skochinsky's user avatar
  • 36.6k
4 votes
Accepted

Decoding an unknown image format with "DREK" signature (*.drk)

I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
K-Adam's user avatar
  • 56
4 votes
Accepted

How to extract D-Link DCS-4603 camera firmware

Recommendation: since the firmware is obfuscated, recover the bootloader The firmware may be encoded, compressed, encrypted, or some combination of these. In order for the firmware image to be loaded ...
julian's user avatar
  • 7,138
4 votes

Decrypt / Decode / Decompress Proprietary File

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed. The header in the file could be a lot of ...
Gogeta70's user avatar
  • 171
4 votes
Accepted

How to unpack kkrunchy executables?

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip. Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
mrexodia's user avatar
  • 1,652
4 votes

I'm would like to view this malicious payload, but am having trouble decoding it

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
rustam Shirinov's user avatar
4 votes

how to find the encryption algorithm?

First, I have to say several things don't quite add up in the decompilation, and I often find it easier to understand disassembly than decompilation Let's start with the function doing most of the ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Converting 16 bit long Hex value to a color

It appears to be stored in byte-reversed order from what you gave with a standard 5-6-5 bit encoding and then scaled to a maximum of 255 for each. 0xC0CF (0b1100000011001111) R: 24 (0b11000) * 255/31 =...
cimarron's user avatar
  • 1,341
4 votes
Accepted

how to find the encryption algorithm?

All the credit for this this answer should go to the @NirIzr and @Avery3R. Here is a python script that implements the xoring mentioned by these kind people: import urllib import binascii data = "%...
w s's user avatar
  • 8,478
4 votes
Accepted

What compression type has been used here?

Basics I've had look at your image file and, as the answer to your previous question said, the compression is something like LZSS. Specifically, the compressed data begins with a flag byte. Each ...
Ian Cook's user avatar
  • 2,548
4 votes
Accepted

How to interpret the final 0x03 0x00 in this minimal gzip sample?

If you read zlib source code alongside the DEFLATE Compressed Data Format Specification you can find where they come from. The bits in those bytes represent the start and end of the compressed stream. ...
Ian Cook's user avatar
  • 2,548
4 votes
Accepted

Is there a way to decompress a Fody-Costura generated exe in c#?

Embedded assemblies needs to be decompressed before they can be used so you can inspect all the code that does that in the assembly. Just go to Costura.AssemblyLoader to check how it is done. below is ...
Paweł Łukasik's user avatar
3 votes

Decompress and Analyse VMWARE EFI64 bios

Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using binwalk to scan the file. Here is the signature scan output for your file: $ binwalk ...
julian's user avatar
  • 7,138
3 votes
Accepted

Decoding LZSS buffer lookup indices

As already described in the updates to my question, it turned out that the compression algorithm is the standard LZSS algorithm with a 12 bit lookup index and 4 bit lookup length. They were just ...
Mario Gu's user avatar
  • 191
3 votes

Trying to figure what kind of compression was used

It does indeed appear to be an LZ77 variant where 8 encoded/not-encoded flags are combined into a single flag byte. The compressed data is then grouped into 8 data 'units' where each unit is ...
Ian Cook's user avatar
  • 2,548
3 votes
Accepted

binwalk cannot find gzip sections

Binwalk did not find the zlib blob because it is also encrypted. It uses the following code to decrypt the compressed data. The decryption uses a table stored in the stack, which is filled with ...
ebux's user avatar
  • 1,759
3 votes
Accepted

Strings weirdly split in binary

Shot in the dark: Maybe this text (or the whole binary image) is compressed. Think something like LZSS. The fact that there is a mystery byte containing eight 1 bits, followed by eight literal and ...
smitelli's user avatar
  • 258
3 votes
Accepted

Decode synth preset formats for massive (.nmsv) fm8 (.nfm8) and absynth (.nabs)

I think the results of your well-designed tests help explain pretty much everything. It is an LZ77 variant. Try the following scheme for decoding the length and offsets. (Encoded bytes are shown ...
Ian Cook's user avatar
  • 2,548

Only top scored, non community-wiki answers of a minimum length are eligible