25

The way you can learn this encoding is to study Japanese. :) From the first line of your text file diff, we can see that this on the left: 1131 3210 3130 3330 1021 0000 0000 0000 .12.1030.!...... Translates to this on the right: 1100 3100 3200 1000 3100 3000 3300 3000 ..1.2....1.0.3.0. 1000 01ff 0000 0000 0000 0000 0000 0000 ................. This ...


21

Press Alt-A to bring up the "string style" dialog, from which you can create a string of various types (including Unicode). Through this dialog, you can optionally set the default string type that is created when you press a (i.e., you can make it such that Unicode is the default if you want). Alternatively use Alt+A U as pointed out by joxeankoret in the ...


11

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely similar to encryption. Encryption algorithms are divided into two classes. First is a stream cipher. From wikipedia: A stream cipher is a symmetric key cipher where ...


9

You can try to use binwalk. It can be used in various ways: Embedded file identification and extraction Executable code identification Entropy analysis and graphing (useful for compression and encryption identification) "Smart" strings analysis You could also try to open your file with 7zip, since it supports a shitload of compression formats.


9

From the Wikipedia article to which you linked: A binary file is a computer file that is not a text file; it may contain any type of data, encoded in binary form for computer storage and processing purposes. That's what you're seeing in your screenshot above, but the hex editor you're using is displaying binary data (0s and 1s) in hexadecimal form to ...


7

This is not yet a complete answer, but perhaps what I've found can be combined with other information to come up with the complete solution. First name encoding If we assume a linear encoding, then we have everything needed to figure this out based on your four samples. If we consider letter values as a=0, b=1, ... regardless of whether they're uppercase ...


7

The type of encoding is Base64 encoding. $ echo MDQwNTA2MjlD | base64 -d 04050629C $ echo SDEzMTUwMTU0NzExQTEx | base64 -d H13150154711A11


7

This seems to be UUencoded data.


6

It seems you're new to Hex. You can think of Hex as a compact form for binary. The following table might help you: 0 hex is 0000 binary 1 hex is 0001 binary 2 hex is 0010 binary 3 hex is 0011 binary 4 hex is 0100 binary 5 hex is 0101 binary 6 hex is 0110 binary 7 hex is 0111 binary 8 hex is 1000 binary 9 hex is 1001 binary a hex is 1010 binary b hex is 1011 ...


6

My guess: DL20I000000V80050300DE076A0012000400AF002400FF030300DE0700000000010003000000B883 ^^ ^ ^ ^^^^ || Addr Data CRC16 |` Length ` Data tag D for data L20 for 0x20 or 32 hex bytes, or 64 hex digits I000000 the address (note ...


6

Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer) The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform reverse() on the function. We can domnstrate it using python's maketrans method: The method maketrans() returns a translation table that maps each ...


5

In case you're still trying to figure this out, I've made some progress. With assistance from u/jccool5000 on reddit (post), who has a collection of over 900 samples mostly from Ontario. AFAIK, Ontario and NJ share the same encoding - Quebec, not so sure. I did some data manipulation to figure this out. Starting with the numbers of the last name, 1st of 4 ...


5

I don't see this above, but male or female is coded in as well. in the last five digits, the first 2 are month of birth. Males are 01-12. Females 50 is added. so the run from 51 (january) to 62 (december) Also, my name is Alexandra, which is also 019 as is your example of alexander. The absence of a middle name is reflected as 00 i know a friend with ...


5

To call an interrupt, you'll probably want to use int imm8 which is encoded as 0xcd, 0xnn (0x10 in this case). For bootloaders, it's pretty common to stick the data in between the jmp at the start of the bootloader and its target. You don't really need to mess around with ds unless you're making a very large bootloader (which loads additional sectors from ...


5

Select the first byte, Edit -> Strings -> Unicode.


5

I would start with checking the first bytes of a file after base64 decoding. Those would indicate what file format is. MZ(5A4D) - meaning this is an executable file and you can start with executing it in save (virtual) environment with SysInternals utilities open - ProcMon and Process explorer. In addition, calculate its MD5 value and look it in the Net, ...


5

These are binary representation of double numbers encoded with base64. To understand the encoding lets see an example (I used to convert numbers to binary double representation with this page): 0.03 = 0x3F9EB851EB851EB8 (binary representation of the double number) With little endian encoding it is stored in the memory in the following form: B8 1E 85 EB ...


5

81 c0 40 00 can be broken down as follows 10 00000 111000 00001 0 0000000000000 ^--op1 ^--rd ^--op3 ^--rs1 ^--i ^--rs2/simmm13 To change the target from %g1 to %g2, just change the rs1 field from 00001 to 00010. The 'L' is simply an artifact of at&t syntax vs intel syntax....


4

When I looked into the URL, I can see that the base64 encoded data is having newline character. When you remove newline characters and present that as one single line to openssl, you need the -A option. The below will work fine. $openssl enc -A -d -base64 <<< /9j/...


4

You could give a shot at dynamic binary visualization. There's an excellent presentation given by Christopher Domas at REcon as well at BlackHat 2013. The deck for REcon is available here. I believe the tool is out now in beta so you could give a try at it.


4

If you think the encoding is wrong then you can try these 2 things: Try using x/hs as described here Each time you specify a unit size with x, that size becomes the default unit the next time you use x ... Use x /hs to display 16-bit char strings set the character set in gdb as described here gdb has no way to automatically recognize which ...


4

Regarding (2), you don't load the entire string into the segment register, you take the selector for the memory region that holds the string, and place that into the segment register. For 16-bit bootloader environment, it's probably going to be the same as CS, so you just push cs, pop ds (though usually cs=ds=es=ss already on startup, anyway). To write to ...


4

Many states use something called SoundEx to generate license numbers (sometimes you even see SoundEx on government forms and/or computer screens when they ask for drivers license numbers.) The soundex system was designed to phonetically map names that sound similar to close values, even though they might be spelled wildly differently eg Pheiffer vs Fifer) ...


4

This might be base64, Although it is missing the required padding. base64 encoded string lengths are 4*(n/3) where n is the original string. Padding is done with one or two equal (=) marks. Since your string is 110 bytes long, it should end with two padding bytes. Manually adding the two padding bytes (which are sometimes omitted because they're predictable)...


4

Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their "magic" mime, i.e. markers left in the file (like you see %PDF in PDFs and PK in zip files). file accepts as argument a filename, like file /tmp/unknown-file. ...


4

Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this: perl -lne 'print reverse($_) ^ ("\x04" x length($_))' and what happens when you apply it to your test strings: $ cat test.txt AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz 1234567890 1 2 123 ? ...


4

This is what I would do given the very limited information: Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any "constants." For example, all Windows exe files start with the bytes 4D 5A or "MZ". Do these files start with a consistent byte signature? Scroll down in the hex editor and find out what other patterns you can find....


4

Answer Consider a "gap" to be a "low" interval between two consecutive "high" interval, ignoring the first longest one. Then, a bit 1 corresponds to a long gap, and a bit 0 corresponds to a short gap. Therefore, the messages decoded that way are: 88 14 4b 00 ee : Light 84 14 4b 00 de : Beep 81 14 4b 00 7e : Zap 82 14 4b ...


3

Those are 16-bit USB keyboard/Keypad scan codes. Please see Keyboard Scan Code Specification for details. Appendix C contains the complete mapping


3

If you can, you should post links to 2-3 of your real targa images, and the corresponding game targa images (beware of license issues though). Sometimes, looking at the files rings a bell, and i could have checked much of what i'm going to say if it works for your files or not. That said: Are some of the tga files referenced from Lua? There is Lua source ...


Only top voted, non community-wiki answers of a minimum length are eligible