24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,384
11
votes
Accepted
can someone help me with this map format?
You must have been looking at the wrong representation.
Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
- 126
9
votes
Accepted
What are the steps, to extract an unknown archive file in this case?
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
...
- 2,374
8
votes
Accepted
DLL starting with DCD
Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages.
I found a project which claims to decompress such files:
...
- 36.9k
7
votes
Accepted
Parsing/Rescuing corrupted IDA database
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have ...
- 1,829
7
votes
Accepted
7
votes
Accepted
Simple carving of zip file using binwalk
Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data.
The following steps should be performed to extract the zip files:...
- 1,759
7
votes
Accepted
Compression algorithm from very old tape backup?
Just to close the loop on this:
I ended up successfully reverse-engineering this compression format, which turned out to be written by an extremely obscure tape backup tool from the early 90s called ...
- 201
6
votes
Accepted
How does a stripped XCOFF binary still remain usable?
COFF files were not designed to support relocation after link-time:
The binary format used initially for Linux was an a.out
variant. When introducing shared libraries certain design
decisions ...
- 7,246
6
votes
Accepted
What image format is this?
Without more information, as suggesting by the various comments, it's hard to be completely sure but, based on the information available, the format seems to be a very simple uncompressed vendor-...
- 2,558
6
votes
Deciphering the format of an unknown file
This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization.
Specifically, the FFFF is a 'new class tag' followed by -
0001 a ...
- 2,558
5
votes
Accepted
Replace section inside ELF file
I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). ...
- 36.9k
5
votes
Animal Crossing: Pocket Camp .zdat File
The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
- 326
5
votes
Accepted
Address to file offset
Subtract 0x400000 from st_value since the address is located in the first LOAD segment of the binary.
According to the System V ABI (generic), the meaning of the st_value symbol depends on what type ...
- 7,246
5
votes
Accepted
Unknown game file decompress
it seems to be compressed in some way because you can read some plain text there
This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
- 7,246
5
votes
Accepted
Determining endianness of PE files (Windows on ARM?)
Windows platforms have a fixed endianness and do not support running different endianness files. The file format itself uses always little-endian fields.
AFAIK the only Windows platform supporting ...
- 36.9k
5
votes
Accepted
Extracting the contents of an unknown archive file format
I hope you'll find your experience in RE.SE enjoyable and educating :)
Reverse engineering is often studied as a hobby, so you're in good company!
IDA pro is a disassembler, which is focused on ...
- 11.8k
5
votes
Unknown archive format from QNX operating system
Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package.
...
- 36.9k
4
votes
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
- 141
4
votes
Extract non-extractable private key from OS X Keychain
I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here.
In my case, I did the following:
$ pip2 install hexdump pycrypto pyopenssl
$ git clone ...
- 141
4
votes
Accepted
Reversing a 3D file format from 2001
Some preliminary notes only – may evolve into a complete answer.
My approach was the following. Clearly, the numbers at the end are floating point numbers. Also, they are not all floating point; the ...
- 2,374
4
votes
Accepted
Decoding an unknown image format with "DREK" signature (*.drk)
I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
- 56
4
votes
Does anyone know this encoding?
Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their ...
- 141
4
votes
Accepted
Interpret binary format of matrix files provided (*.mtx)
You've correctly identified the first four bytes as the header or matrix shape.
If you were to remove those shape bytes and realign the rest of the hex string, the identify matrix becomes very clear:
...
- 11.8k
4
votes
Decrypt / Decode / Decompress Proprietary File
I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed.
The header in the file could be a lot of ...
- 171
4
votes
Find out how a program is reading a file
This is what I would do given the very limited information:
Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any "constants." For example, all Windows exe files start ...
- 1,880
4
votes
Accepted
Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk
The first 16 bytes are unknown (likely some kind of private data). After that, a regular PNG file follows, but the first 128 bytes have been XORed with the value 234. The rest of the file is unchanged....
- 2,374
4
votes
I'm would like to view this malicious payload, but am having trouble decoding it
On a linux machine
Try:
$ cat enc_payload.txt|base64 -d > dec_payload
Then you'll get
$ file dec_payload
dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
- 395
4
votes
If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?
First, a couple of clarifications
The Import Address Table is a table that only consists of the imported function's addresses. Unlike the Import Table (which consists of IMAGE_IMPORT_DESCRIPTORs) that ...
- 11.8k
4
votes
Accepted
Converting 16 bit long Hex value to a color
It appears to be stored in byte-reversed order from what you gave with a standard 5-6-5 bit encoding and then scaled to a maximum of 255 for each.
0xC0CF (0b1100000011001111)
R: 24 (0b11000) * 255/31 =...
- 1,341
Only top scored, non community-wiki answers of a minimum length are eligible