Skip to main content
25 votes
Accepted

How should I approach reverse engineering this text encoding?

The way you can learn this encoding is to study Japanese. :) From the first line of your text file diff, we can see that this on the left: 1131 3210 3130 3330 1021 0000 0000 0000 .12.1030.!...... ...
Edward's user avatar
  • 2,521
11 votes
Accepted

How can I determine if a piece of code is an encryption algorithm?

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
NirIzr's user avatar
  • 11.8k
7 votes
Accepted

Does anyone know this encoding?

This seems to be UUencoded data.
Guntram Blohm's user avatar
6 votes

Decoding New Jersey Driver's License Codes

In case you're still trying to figure this out, I've made some progress. With assistance from u/jccool5000 on reddit (post), who has a collection of over 900 samples mostly from Ontario. AFAIK, ...
boat's user avatar
  • 61
6 votes
Accepted

How can I identify how this string is being encoded so I can replicate it?

Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer) The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

What is the encoding format for unconditional Jumps on SPARC/SPARC64?

81 c0 40 00 can be broken down as follows 10 00000 111000 00001 0 0000000000000 ^--op1 ^--rd ^--op3 ^--rs1 ^--i ^--rs2/...
broadway's user avatar
  • 1,581
5 votes

Reverse engineering a base64 encoded number

These are binary representation of double numbers encoded with base64. To understand the encoding lets see an example (I used to convert numbers to binary double representation with this page): 0.03 =...
ebux's user avatar
  • 1,759
5 votes

Decoding New Jersey Driver's License Codes

I don't see this above, but male or female is coded in as well. in the last five digits, the first 2 are month of birth. Males are 01-12. Females 50 is added. so the run from 51 (january) to 62 (...
alexandra's user avatar
4 votes

Does anyone know this encoding?

Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their ...
Luc's user avatar
  • 141
4 votes

Base64 encoding with missing padding and many uppercase letters

This might be base64, Although it is missing the required padding. base64 encoded string lengths are 4*(n/3) where n is the original string. Padding is done with one or two equal (=) marks. Since your ...
NirIzr's user avatar
  • 11.8k
4 votes

Find out how a program is reading a file

This is what I would do given the very limited information: Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any "constants." For example, all Windows exe files start ...
the_endian's user avatar
  • 1,870
4 votes

How can I identify how this string is being encoded so I can replicate it?

Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this: perl -lne 'print reverse($_) ^ ("\x04" x ...
Ilmari Karonen's user avatar
4 votes
Accepted

Need help to reverse engineer a dog collar transmitter

Answer Consider a "gap" to be a "low" interval between two consecutive "high" interval, ignoring the first longest one. Then, a bit 1 corresponds to a long gap, and a bit ...
user202729's user avatar
3 votes

How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?

There's not much information to go on, but I would probably try to proceed like this: Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Reverse engineer CAN-Bus checksum

As can be demonstrated by this page: CRC width: CRC-8 CRC parametrization: Predefined, CRC8_SAE_J1850 (Polynomial: 0x1d, Initial value: 0xff, Final xor: 0xff) CRC Input Data: Bytes, D1-D7
booto's user avatar
  • 931
3 votes
Accepted

Reverse engineer checksum algorithm

You seem to have the same air conditioner like the guy who asked this question. Add up bytes 0-11, xor with 0x55 to get byte 12. It could help if you stated the brand and model number of your AC unit,...
Guntram Blohm's user avatar
3 votes
Accepted

Reverse engineering a base64 encoded number

Building on @ebux's answer: The first 4 bytes is the integral part of the number, encoded in a slightly weird way .. the UPPER nibble of the first byte is the number itself. The other 5 nibbles are 0 ...
Guntram Blohm's user avatar
3 votes
Accepted

Deducing Protobuf Schema and Datatypes

I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used this converter to check
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Translating a Korean Exclusive PS2 game ~ hangeul encoding?

I would try CP949. Of course, this assumes that text data is not packed or encoded, which can happen too. Maybe try dumping/searching the emulator process memory at runtime (add UTF-16 too in that ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

The questions about li instruction

MIPS instructions are 4 bytes (32 bit) in size. Hence it's not possible to load a 32 bit constant using a single instruction. The li $gp, 0x18B00 instruction is indeed a pseudo instruction. It's ...
0xec's user avatar
  • 6,090
3 votes
Accepted

Encoding of 64-bit double

This appears to be a fixed-point (rather than a floating-point) format. If you treat the 64-bit values as signed integers and divide by 4398046511104.0, you will get the decimal values you show. e.g. ...
Ian Cook's user avatar
  • 2,548
3 votes
Accepted

Unknown binary format of a b64-encoded list of doubles

The data you have here is not base64 encoded, as that would only have letters, numbers, +, /, and (as you mentioned) =. The \x escape code in the string indicates bytes that are non-printable or ...
exampl3's user avatar
  • 76
3 votes
Accepted

GNU strings with --encoding=S

Works for me with strings version 2.37: $ strings --encoding=S bin1.bin precondition failed ����invalid argument $ strings --encoding=S bin2.bin ����precondition failed invalid argument
Mega Tonnage's user avatar
2 votes

What steps are needed to decode a Base64 binary?

This is indeed base64 encoded string, it cannot possibly be so long and randomly follow the base64 acceptable characters and = padding. The best way to figure out how that base64 decoded data is used ...
NirIzr's user avatar
  • 11.8k
2 votes

Driver's Licence Last Name Numbering Format (Ontario, Quebec, New Jersey)?

I know this is an old thread and probably you either figured it out on your own or gave up and dgaf anymore. But this is I believe Soundex code (It absolutely is the case for the Quebec drivers ...
John's user avatar
  • 31
2 votes

How to identify known encryption algorithm?

Signsrch is a somewhat old tool that searches for signatures and magic values for different encryption and hash algorithms. I had a collection of other similar tools in the past, so I believe you can ...
NirIzr's user avatar
  • 11.8k
2 votes
Accepted

Find out string encoding/shift of proprietary binary file format

It's a simple exclusive-or (^) operation with the byte 0x5A. With your examples - 'a' 0x61 ^ 0x5A = 0x3B 'b' 0x62 ^ 0x5A = 0x38 'z' 0x7A ^ 0x5A = 0x20 Plus some others you should be able to check - ...
Ian Cook's user avatar
  • 2,548
2 votes

Encoding method of float

This isn't a complete answer but is a bit more than fits in a comment. There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 ...
Ian Cook's user avatar
  • 2,548
2 votes

Trying to decode the Ontario Driver's License #

Chart 2 Code Encode A 1 B 1 C 2 D 2 E 3 F 3 G 4 H 4 I 4 J 5 K 5 L 6 M 6 N 6 O 7 P 7 Q 7 R 7 S 8 T 8 U 8 V 8 X 9 Y 9 Z 9 NOTE: This data was empirically determined.
Batak's user avatar
  • 31
2 votes

Trying to decode the Ontario Driver's License #

Just let you know, anyone with same last name will have same first 4 numbers regardless of what their first name is. You can see this with Chinese last names. Anyone with last name Chen, by the way, ...
user43371's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible