Skip to main content
24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
Spektre's user avatar
  • 1,384
11 votes
Accepted

can someone help me with this map format?

You must have been looking at the wrong representation. Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
guest's user avatar
  • 126
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
Jongware's user avatar
  • 2,364
8 votes
Accepted

DLL starting with DCD

Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages. I found a project which claims to decompress such files: ...
Igor Skochinsky's user avatar
  • 36.7k
7 votes
Accepted

Does anyone know this encoding?

This seems to be UUencoded data.
Guntram Blohm's user avatar
7 votes
Accepted

Simple carving of zip file using binwalk

Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data. The following steps should be performed to extract the zip files:...
ebux's user avatar
  • 1,759
7 votes

Extracting textures from a file (Gamecube game)

This looks .. interesting. When i open the first and second of your files in a hex editor, one has 20240 bytes, the other has 10240 bytes (all numbers in hex). So, 2^16+220 in one case, 2^17+220 in ...
Guntram Blohm's user avatar
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
Willem Hengeveld's user avatar
7 votes
Accepted

Compression algorithm from very old tape backup?

Just to close the loop on this: I ended up successfully reverse-engineering this compression format, which turned out to be written by an extremely obscure tape backup tool from the early 90s called ...
Dmitry Brant's user avatar
6 votes
Accepted

How does a stripped XCOFF binary still remain usable?

COFF files were not designed to support relocation after link-time: The binary format used initially for Linux was an a.out variant. When introducing shared libraries certain design decisions ...
julian's user avatar
  • 7,158
6 votes
Accepted

What image format is this?

Without more information, as suggesting by the various comments, it's hard to be completely sure but, based on the information available, the format seems to be a very simple uncompressed vendor-...
Ian Cook's user avatar
  • 2,548
6 votes

Deciphering the format of an unknown file

This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization. Specifically, the FFFF is a 'new class tag' followed by - 0001 a ...
Ian Cook's user avatar
  • 2,548
5 votes

Reading stp (Designaknit Stitch Pattern)-Files II

You should really learn some assembler, and x86 processor architecture, to attempt this. To give you a bit of a start: The var_* declarations correspond to local variables on the stack of the ...
Guntram Blohm's user avatar
5 votes
Accepted

Replace section inside ELF file

I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
TkTech's user avatar
  • 326
5 votes
Accepted

Address to file offset

Subtract 0x400000 from st_value since the address is located in the first LOAD segment of the binary. According to the System V ABI (generic), the meaning of the st_value symbol depends on what type ...
julian's user avatar
  • 7,158
5 votes
Accepted

Unknown game file decompress

it seems to be compressed in some way because you can read some plain text there This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
julian's user avatar
  • 7,158
5 votes
Accepted

Extracting the contents of an unknown archive file format

I hope you'll find your experience in RE.SE enjoyable and educating :) Reverse engineering is often studied as a hobby, so you're in good company! IDA pro is a disassembler, which is focused on ...
NirIzr's user avatar
  • 11.8k
5 votes

Unknown archive format from QNX operating system

Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package. ...
Igor Skochinsky's user avatar
  • 36.7k
4 votes

Extract non-extractable private key from OS X Keychain

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone ...
standy's user avatar
  • 141
4 votes

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
byteptr's user avatar
  • 141
4 votes
Accepted

Decoding an unknown image format with "DREK" signature (*.drk)

I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
K-Adam's user avatar
  • 56
4 votes
Accepted

Reversing a 3D file format from 2001

Some preliminary notes only – may evolve into a complete answer. My approach was the following. Clearly, the numbers at the end are floating point numbers. Also, they are not all floating point; the ...
Jongware's user avatar
  • 2,364
4 votes
Accepted

Interpret binary format of matrix files provided (*.mtx)

You've correctly identified the first four bytes as the header or matrix shape. If you were to remove those shape bytes and realign the rest of the hex string, the identify matrix becomes very clear: ...
NirIzr's user avatar
  • 11.8k
4 votes

Does anyone know this encoding?

Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their ...
Luc's user avatar
  • 141
4 votes

Decrypt / Decode / Decompress Proprietary File

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed. The header in the file could be a lot of ...
Gogeta70's user avatar
  • 171
4 votes

Find out how a program is reading a file

This is what I would do given the very limited information: Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any "constants." For example, all Windows exe files start ...
the_endian's user avatar
  • 1,870
4 votes
Accepted

Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk

The first 16 bytes are unknown (likely some kind of private data). After that, a regular PNG file follows, but the first 128 bytes have been XORed with the value 234. The rest of the file is unchanged....
Jongware's user avatar
  • 2,364
4 votes

I'm would like to view this malicious payload, but am having trouble decoding it

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
rustam Shirinov's user avatar
4 votes

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

First, a couple of clarifications The Import Address Table is a table that only consists of the imported function's addresses. Unlike the Import Table (which consists of IMAGE_IMPORT_DESCRIPTORs) that ...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible