25
votes
Accepted
How should I approach reverse engineering this text encoding?
The way you can learn this encoding is to study Japanese. :) From the first line of your text file diff, we can see that this on the left:
1131 3210 3130 3330 1021 0000 0000 0000 .12.1030.!......
...
- 2,521
11
votes
Accepted
How can I determine if a piece of code is an encryption algorithm?
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
- 11.7k
7
votes
Accepted
6
votes
Accepted
How can I identify how this string is being encoded so I can replicate it?
Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer)
The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform ...
- 8,919
6
votes
Decoding New Jersey Driver's License Codes
In case you're still trying to figure this out, I've made some progress. With assistance from u/jccool5000 on reddit (post), who has a collection of over 900 samples mostly from Ontario. AFAIK, ...
- 61
5
votes
Decoding New Jersey Driver's License Codes
I don't see this above, but male or female is coded in as well. in the last five digits, the first 2 are month of birth. Males are 01-12. Females 50 is added. so the run from 51 (january) to 62 (...
- 51
5
votes
Reverse engineering a base64 encoded number
These are binary representation of double numbers encoded with base64.
To understand the encoding lets see an example (I used to convert numbers to binary double representation with this page):
0.03 =...
- 1,759
5
votes
Accepted
What is the encoding format for unconditional Jumps on SPARC/SPARC64?
81 c0 40 00 can be broken down as follows
10 00000 111000 00001 0 0000000000000
^--op1
^--rd
^--op3
^--rs1
^--i
^--rs2/...
- 1,581
4
votes
Find out how a program is reading a file
This is what I would do given the very limited information:
Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any "constants." For example, all Windows exe files start ...
- 1,830
4
votes
How can I identify how this string is being encoded so I can replicate it?
Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this:
perl -lne 'print reverse($_) ^ ("\x04" x ...
- 346
4
votes
Does anyone know this encoding?
Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their ...
- 141
4
votes
Base64 encoding with missing padding and many uppercase letters
This might be base64, Although it is missing the required padding. base64 encoded string lengths are 4*(n/3) where n is the original string. Padding is done with one or two equal (=) marks. Since your ...
- 11.7k
4
votes
Accepted
Need help to reverse engineer a dog collar transmitter
Answer
Consider a "gap" to be a "low" interval between two consecutive "high" interval, ignoring the first longest one. Then, a bit 1 corresponds to a long gap, and a bit ...
- 665
3
votes
Reverse engineer CAN-Bus checksum
As can be demonstrated by this page:
CRC width: CRC-8
CRC parametrization: Predefined, CRC8_SAE_J1850 (Polynomial: 0x1d, Initial value: 0xff, Final xor: 0xff)
CRC Input Data: Bytes, D1-D7
- 911
3
votes
How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?
There's not much information to go on, but I would probably try to proceed like this:
Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
- 36.4k
3
votes
Accepted
Reverse engineer checksum algorithm
You seem to have the same air conditioner like the guy who asked this question. Add up bytes 0-11, xor with 0x55 to get byte 12.
It could help if you stated the brand and model number of your AC unit,...
- 12.9k
3
votes
Accepted
Reverse engineering a base64 encoded number
Building on @ebux's answer:
The first 4 bytes is the integral part of the number, encoded in a slightly weird way .. the UPPER nibble of the first byte is the number itself. The other 5 nibbles are 0 ...
- 12.9k
3
votes
Accepted
Deducing Protobuf Schema and Datatypes
I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used this converter to check
- 36.4k
3
votes
Translating a Korean Exclusive PS2 game ~ hangeul encoding?
I would try CP949. Of course, this assumes that text data is not packed or encoded, which can happen too. Maybe try dumping/searching the emulator process memory at runtime (add UTF-16 too in that ...
- 36.4k
3
votes
The questions about li instruction
MIPS instructions are 4 bytes (32 bit) in size. Hence it's not possible to load a 32 bit constant using a single instruction.
The li $gp, 0x18B00 instruction is indeed a pseudo instruction. It's ...
- 6,040
3
votes
Accepted
Encoding of 64-bit double
This appears to be a fixed-point (rather than a floating-point) format.
If you treat the 64-bit values as signed integers and divide by 4398046511104.0, you will get the decimal values you show.
e.g. ...
- 2,503
3
votes
Accepted
Unknown binary format of a b64-encoded list of doubles
The data you have here is not base64 encoded, as that would only have letters, numbers, +, /, and (as you mentioned) =. The \x escape code in the string indicates bytes that are non-printable or ...
- 76
3
votes
Accepted
GNU strings with --encoding=S
Works for me with strings version 2.37:
$ strings --encoding=S bin1.bin
precondition failed
����invalid argument
$ strings --encoding=S bin2.bin
����precondition failed
invalid argument
- 796
2
votes
Accepted
How to get transformation formula comparing two files
As far as I can see it is not encrypted, but just wrote down in binary form straight forward, at least some first fields are exact match.
00 in hexdump means the first zero
4c ...
- 8,408
2
votes
Accepted
Understanding decoding communications over interfaces
A comment in your previous question pointed out that your hydrometer likely uses the M-Bus or Meter-Bus protocol, and your fields in question are all thoroughly explained in the documentation of said ...
- 310
2
votes
What steps are needed to decode a Base64 binary?
This is indeed base64 encoded string, it cannot possibly be so long and randomly follow the base64 acceptable characters and = padding.
The best way to figure out how that base64 decoded data is used ...
- 11.7k
2
votes
Driver's Licence Last Name Numbering Format (Ontario, Quebec, New Jersey)?
I know this is an old thread and probably you either figured it out on your own or gave up and dgaf anymore. But this is I believe Soundex code (It absolutely is the case for the Quebec drivers ...
- 31
2
votes
How to identify known encryption algorithm?
Signsrch is a somewhat old tool that searches for signatures and magic values for different encryption and hash algorithms. I had a collection of other similar tools in the past, so I believe you can ...
- 11.7k
2
votes
Accepted
Find out string encoding/shift of proprietary binary file format
It's a simple exclusive-or (^) operation with the byte 0x5A.
With your examples -
'a' 0x61 ^ 0x5A = 0x3B
'b' 0x62 ^ 0x5A = 0x38
'z' 0x7A ^ 0x5A = 0x20
Plus some others you should be able to check -
...
- 2,503
2
votes
Encoding method of float
This isn't a complete answer but is a bit more than fits in a comment.
There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 ...
- 2,503
Only top scored, non community-wiki answers of a minimum length are eligible