24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
user avatar
  • 1,374
11 votes
Accepted

How to read NSCR1000 data files?

It is encrypted with AES so you will need the keys from windows.plist to decode. The format is (all stored in big-endian): offset value 0-3 magic ('NSCR' for PersistentUIRecord) 4-7 version ...
user avatar
  • 1,331
11 votes
Accepted

can someone help me with this map format?

You must have been looking at the wrong representation. Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
user avatar
  • 126
10 votes
Accepted

What is this way of representing color in this unknown image format

You asked this a couple of months ago, but I'm going to answer anyway. First, I fear that your decompression code is buggy. There are several horizontal lines of noise, and I'm pretty sure they're ...
user avatar
  • 276
9 votes

PDB v2.0 File Format documentation

Here is something directly from Microsoft. https://github.com/Microsoft/microsoft-pdb
user avatar
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
user avatar
  • 2,274
8 votes
Accepted

DLL starting with DCD

Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages. I found a project which claims to decompress such files: ...
user avatar
  • 34.7k
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
user avatar
7 votes

Help reversing a EDB database file for Pioneers Rekordbox software

The precise BPMs are actually in the data files (filename).DAT (may the overall BPM is in the edb.. but I can't confirm) So I have reversed both data files created by RekordBox: file.DAT -------- /...
user avatar
7 votes

How to identify the structure of this specific data file?

It's certainly not a well known format. A quick glance at the file with a hex viewer shows that it mainly consists of records that all have similar, but not identical, size and layout; the very end of ...
user avatar
7 votes

Extracting textures from a file (Gamecube game)

This looks .. interesting. When i open the first and second of your files in a hex editor, one has 20240 bytes, the other has 10240 bytes (all numbers in hex). So, 2^16+220 in one case, 2^17+220 in ...
user avatar
7 votes
Accepted

Simple carving of zip file using binwalk

Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data. The following steps should be performed to extract the zip files:...
user avatar
  • 1,731
7 votes
Accepted

Does anyone know this encoding?

This seems to be UUencoded data.
user avatar
6 votes

Extract non-extractable private key from OS X Keychain

I've arrived at a solution by researching an answer for one of my Keychain subquestions. https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x. According to ...
user avatar
  • 299
6 votes
Accepted

Reverse engineering Earthsiege 2 3D model format

To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's ...
user avatar
  • 871
6 votes
Accepted

How does a stripped XCOFF binary still remain usable?

COFF files were not designed to support relocation after link-time: The binary format used initially for Linux was an a.out variant. When introducing shared libraries certain design decisions ...
user avatar
  • 6,859
6 votes
Accepted

What image format is this?

Without more information, as suggesting by the various comments, it's hard to be completely sure but, based on the information available, the format seems to be a very simple uncompressed vendor-...
user avatar
  • 2,164
5 votes

Parsing/Rescuing corrupted IDA database

Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces. But I ...
user avatar
  • 275
5 votes
Accepted

Ancient number formats (probably fixed-point)

if you reverse the byte order, and assume signed numbers you get these triplets: -2468488 976475 146741 732616 976475 146741 732616 976475 -1238346 -2468488 976475 -1238346 -2468488 -...
user avatar
5 votes
Accepted

What is an indicator that a PE section definitely contains stuff of a specific type?

I can only definitely recognize code sections by looking if the IMAGE_SCN_MEM_EXECUTE flag is set, as other sections should not have this flag set. The presence of this flag doesn't "definitely" ...
user avatar
5 votes
Accepted

Unknown Mac OSX 10.10 HFS+ compression

OK... it seems to be LZVN compression. Following on from Igor's suggestions I ran kextstat on my Mac, however that only listed: com.apple.AppleFSCompression.AppleFSCompressionTypeZlib com.apple....
user avatar
5 votes
Accepted

What could this time format be?

This seems very much like the IEEE754 format, and i'd assume each of your two byte timecodes to be preceded by two zero-bytes, which make a 4 byte (32 bit) value. You can calculate the exponent using ...
user avatar
5 votes

Reading stp (Designaknit Stitch Pattern)-Files II

You should really learn some assembler, and x86 processor architecture, to attempt this. To give you a bit of a start: The var_* declarations correspond to local variables on the stack of the ...
user avatar
5 votes
Accepted

Replace section inside ELF file

I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). ...
user avatar
  • 34.7k
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
user avatar
  • 326
5 votes
Accepted

Address to file offset

Subtract 0x400000 from st_value since the address is located in the first LOAD segment of the binary. According to the System V ABI (generic), the meaning of the st_value symbol depends on what type ...
user avatar
  • 6,859
5 votes
Accepted

Unknown game file decompress

it seems to be compressed in some way because you can read some plain text there This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
user avatar
  • 6,859
5 votes

Unknown archive format from QNX operating system

Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package. ...
user avatar
  • 34.7k
5 votes

Deciphering the format of an unknown file

This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization. Specifically, the FFFF is a 'new class tag' followed by - 0001 a ...
user avatar
  • 2,164
4 votes

Extract non-extractable private key from OS X Keychain

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone ...
user avatar
  • 141

Only top scored, non community-wiki answers of a minimum length are eligible