24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
  • 1,384
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
  • 6,948
8 votes

Reverse Engineering a Firmware. Someone can help me?

Finding: NGA_FW_CURRENT.BIN is a compressed Videx microchip firmware image file. Preliminary Remarks There is conflicting background information given in the comments about the file alleged to be ...
  • 6,948
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
8 votes
Accepted

Unknown decompression algorithm

After downloading ChessBase Reader and playing with ProcMon a bit to find the function that reads the archive and writes the data file, i loaded up the whole thing in IDA to analyze it. The data is ...
8 votes
Accepted

What compression algorithm is this?

As you say it is an LZ77 style format, however I could not find a specific algorithm which it matches. The compressed data forms a number of blocks, each of which contain at least one of some data, ...
  • 96
7 votes

Extracting textures from a file (Gamecube game)

This looks .. interesting. When i open the first and second of your files in a hex editor, one has 20240 bytes, the other has 10240 bytes (all numbers in hex). So, 2^16+220 in one case, 2^17+220 in ...
6 votes
Accepted

What kind of compression/obfuscation algorithm is this?

The gzip headers are valid, but the deflate compressed data format is violated almost immediately, within less than ten bytes in for all of the files. For all of the example files provided, the first ...
6 votes

Any ideas on how to decode Photoshop Liquify .msh files?

Here's a description of the .msh format on Adobe Photoshop CC 2019, at least of what I've been able to glean. The format uses run-length encoding to encode the offset coordinates of the mesh cells ...
5 votes
Accepted

Need help with compressed string of unknown format

As @w4rex said, it definitely looks like base64. If you try to decode it like a regular base64 string, you end up with : 37 7a bc af 27 1c 00 03 d8 a0 33 34 30 78 00 00 7z.............. You ...
  • 565
5 votes
Accepted

Unknown Mac OSX 10.10 HFS+ compression

OK... it seems to be LZVN compression. Following on from Igor's suggestions I ran kextstat on my Mac, however that only listed: com.apple.AppleFSCompression.AppleFSCompressionTypeZlib com.apple....
5 votes
Accepted

Unknown game file decompress

it seems to be compressed in some way because you can read some plain text there This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
  • 6,948
5 votes
Accepted

Extracting the contents of an unknown archive file format

I hope you'll find your experience in RE.SE enjoyable and educating :) Reverse engineering is often studied as a hobby, so you're in good company! IDA pro is a disassembler, which is focused on ...
  • 11.6k
5 votes
Accepted

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

The code isn't easy to read since one has to do that statically and it doesn't seem to respect a standard EABI. So, instead of trying to fully reverse engineer the code, I tried to search for the used ...
  • 1,094
4 votes

How to find compressed or encrypted parts in a packed executable?

A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can ...
  • 1,924
4 votes
Accepted

Decoding an unknown image format with "DREK" signature (*.drk)

I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
  • 56
4 votes
Accepted

How to extract D-Link DCS-4603 camera firmware

Recommendation: since the firmware is obfuscated, recover the bootloader The firmware may be encoded, compressed, encrypted, or some combination of these. In order for the firmware image to be loaded ...
  • 6,948
4 votes

Decrypt / Decode / Decompress Proprietary File

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed. The header in the file could be a lot of ...
  • 171
4 votes
Accepted

How to unpack kkrunchy executables?

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip. Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
  • 1,622
4 votes

How can I statically unpack a file packed with an unknown packer without executing it?

You can't. You don't know how the file is packed, the only thing you have is the unpacking code in the file. You could try running the file through an emulator like QEMU, so the unpacking takes place ...
4 votes

I'm would like to view this malicious payload, but am having trouble decoding it

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
4 votes
Accepted

Converting 16 bit long Hex value to a color

It appears to be stored in byte-reversed order from what you gave with a standard 5-6-5 bit encoding and then scaled to a maximum of 255 for each. 0xC0CF (0b1100000011001111) R: 24 (0b11000) * 255/31 =...
  • 1,331
4 votes

how to find the encryption algorithm?

First, I have to say several things don't quite add up in the decompilation, and I often find it easier to understand disassembly than decompilation Let's start with the function doing most of the ...
  • 11.6k
4 votes
Accepted

how to find the encryption algorithm?

All the credit for this this answer should go to the @NirIzr and @Avery3R. Here is a python script that implements the xoring mentioned by these kind people: import urllib import binascii data = "%...
  • 8,155
4 votes
Accepted

What compression type has been used here?

Basics I've had look at your image file and, as the answer to your previous question said, the compression is something like LZSS. Specifically, the compressed data begins with a flag byte. Each ...
  • 2,374
4 votes
Accepted

How to interpret the final 0x03 0x00 in this minimal gzip sample?

If you read zlib source code alongside the DEFLATE Compressed Data Format Specification you can find where they come from. The bits in those bytes represent the start and end of the compressed stream. ...
  • 2,374
3 votes
Accepted

binwalk cannot find gzip sections

Binwalk did not find the zlib blob because it is also encrypted. It uses the following code to decrypt the compressed data. The decryption uses a table stored in the stack, which is filled with ...
  • 1,739
3 votes

Unknown Mac OSX 10.10 HFS+ compression

according to this post, you can use afscexpand tool to decompress such files.if you prefer the hard way, xnu source code may be of help.
  • 35.5k
3 votes

How to find compressed or encrypted parts in a packed executable?

For most packers out there: The start of the decompression or decryption is pretty much the entry point (with a bit of anti-debugging mixed in, perhaps). The end of the decompression or decryption ...
3 votes

Trying to figure what kind of compression was used

It does indeed appear to be an LZ77 variant where 8 encoded/not-encoded flags are combined into a single flag byte. The compressed data is then grouped into 8 data 'units' where each unit is ...
  • 2,374

Only top scored, non community-wiki answers of a minimum length are eligible