24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,384
14
votes
Identify compression of this ZTE ZXV10 H201L V2 backup config file
Hypothesis: the file is encrypted
1. Absence of Compression Signatures
The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
- 7,078
8
votes
Accepted
What compression algorithm is this?
As you say it is an LZ77 style format, however I could not find a specific algorithm which it matches. The compressed data forms a number of blocks, each of which contain at least one of some data, ...
- 96
8
votes
Accepted
Identify compression of this ZTE ZXV10 H201L V2 backup config file
The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
- 96
8
votes
Reverse Engineering a Firmware. Someone can help me?
Finding: NGA_FW_CURRENT.BIN is a compressed Videx microchip firmware image file.
Preliminary Remarks
There is conflicting background information given in the comments about the file alleged to be ...
- 7,078
7
votes
Extracting textures from a file (Gamecube game)
This looks .. interesting.
When i open the first and second of your files in a hex editor, one has 20240 bytes, the other has 10240 bytes (all numbers in hex). So, 2^16+220 in one case, 2^17+220 in ...
- 12.9k
7
votes
Accepted
Compression algorithm from very old tape backup?
Just to close the loop on this:
I ended up successfully reverse-engineering this compression format, which turned out to be written by an extremely obscure tape backup tool from the early 90s called ...
- 201
6
votes
Any ideas on how to decode Photoshop Liquify .msh files?
Here's a description of the .msh format on Adobe Photoshop CC 2019, at least of what I've been able to glean.
The format uses run-length encoding to encode the offset coordinates of the mesh cells ...
- 161
5
votes
Accepted
Need help with compressed string of unknown format
As @w4rex said, it definitely looks like base64. If you try to decode it like a regular base64 string, you end up with :
37 7a bc af 27 1c 00 03 d8 a0 33 34 30 78 00 00 7z..............
You ...
- 565
5
votes
Accepted
Unknown game file decompress
it seems to be compressed in some way because you can read some plain text there
This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
- 7,078
5
votes
Accepted
Extracting the contents of an unknown archive file format
I hope you'll find your experience in RE.SE enjoyable and educating :)
Reverse engineering is often studied as a hobby, so you're in good company!
IDA pro is a disassembler, which is focused on ...
- 11.7k
5
votes
Accepted
Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)
The code isn't easy to read since one has to do that statically and it doesn't seem to respect a standard EABI.
So, instead of trying to fully reverse engineer the code, I tried to search for the used ...
- 1,124
4
votes
Decompressing zImage
the zImage kernel is "uncompressed" in the meaning that it can be just copied to some place in RAM and run from there as-is, without additional decompression step. The bulk of the kernel is still ...
- 36.4k
4
votes
Decrypt / Decode / Decompress Proprietary File
I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed.
The header in the file could be a lot of ...
- 171
4
votes
Accepted
How to unpack kkrunchy executables?
For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip.
Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
- 1,652
4
votes
Accepted
Decoding an unknown image format with "DREK" signature (*.drk)
I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
- 56
4
votes
Accepted
How to extract D-Link DCS-4603 camera firmware
Recommendation: since the firmware is obfuscated, recover the bootloader
The firmware may be encoded, compressed, encrypted, or some combination of these. In order for the firmware image to be loaded ...
- 7,078
4
votes
I'm would like to view this malicious payload, but am having trouble decoding it
On a linux machine
Try:
$ cat enc_payload.txt|base64 -d > dec_payload
Then you'll get
$ file dec_payload
dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
- 395
4
votes
Accepted
Converting 16 bit long Hex value to a color
It appears to be stored in byte-reversed order from what you gave with a standard 5-6-5 bit encoding and then scaled to a maximum of 255 for each.
0xC0CF (0b1100000011001111)
R: 24 (0b11000) * 255/31 =...
- 1,331
4
votes
how to find the encryption algorithm?
First, I have to say several things don't quite add up in the decompilation, and I often find it easier to understand disassembly than decompilation
Let's start with the function doing most of the ...
- 11.7k
4
votes
Accepted
how to find the encryption algorithm?
All the credit for this this answer should go to the @NirIzr and @Avery3R.
Here is a python script that implements the xoring mentioned by these kind people:
import urllib
import binascii
data = "%...
- 8,388
4
votes
Accepted
What compression type has been used here?
Basics
I've had look at your image file and, as the answer to your previous question said, the compression is something like LZSS.
Specifically, the compressed data begins with a flag byte. Each ...
- 2,503
4
votes
Accepted
How to interpret the final 0x03 0x00 in this minimal gzip sample?
If you read zlib source code alongside the DEFLATE Compressed Data Format Specification you can find where they come from.
The bits in those bytes represent the start and end of the compressed stream.
...
- 2,503
4
votes
Accepted
Is there a way to decompress a Fody-Costura generated exe in c#?
Embedded assemblies needs to be decompressed before they can be used so you can inspect all the code that does that in the assembly. Just go to Costura.AssemblyLoader to check how it is done. below is ...
- 4,912
3
votes
Accepted
Decoding LZSS buffer lookup indices
As already described in the updates to my question, it turned out that the compression algorithm is the standard LZSS algorithm with a 12 bit lookup index and 4 bit lookup length. They were just ...
- 191
3
votes
Trying to figure what kind of compression was used
It does indeed appear to be an LZ77 variant where 8 encoded/not-encoded flags are combined into a single flag byte.
The compressed data is then grouped into 8 data 'units' where each unit is ...
- 2,503
3
votes
Accepted
binwalk cannot find gzip sections
Binwalk did not find the zlib blob because it is also encrypted. It uses the following code to decrypt the compressed data. The decryption uses a table stored in the stack, which is filled with ...
- 1,759
3
votes
Decompress and Analyse VMWARE EFI64 bios
Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using binwalk to scan the file.
Here is the signature scan output for your file:
$ binwalk ...
- 7,078
3
votes
Accepted
Strings weirdly split in binary
Shot in the dark: Maybe this text (or the whole binary image) is compressed. Think something like LZSS.
The fact that there is a mystery byte containing eight 1 bits, followed by eight literal and ...
- 258
3
votes
Accepted
Decode synth preset formats for massive (.nmsv) fm8 (.nfm8) and absynth (.nabs)
I think the results of your well-designed tests help explain pretty much everything.
It is an LZ77 variant. Try the following scheme for decoding the length and offsets. (Encoded bytes are shown ...
- 2,503
Only top scored, non community-wiki answers of a minimum length are eligible