24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
Spektre's user avatar
  • 1,384
11 votes
Accepted

How to read NSCR1000 data files?

It is encrypted with AES so you will need the keys from windows.plist to decode. The format is (all stored in big-endian): offset value 0-3 magic ('NSCR' for PersistentUIRecord) 4-7 version ...
cimarron's user avatar
  • 1,331
11 votes
Accepted

can someone help me with this map format?

You must have been looking at the wrong representation. Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
guest's user avatar
  • 126
9 votes

PDB v2.0 File Format documentation

Here is something directly from Microsoft. https://github.com/Microsoft/microsoft-pdb
user1961213's user avatar
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
Jongware's user avatar
  • 2,354
8 votes
Accepted

DLL starting with DCD

Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages. I found a project which claims to decompress such files: ...
Igor Skochinsky's user avatar
  • 36.4k
7 votes

Extracting textures from a file (Gamecube game)

This looks .. interesting. When i open the first and second of your files in a hex editor, one has 20240 bytes, the other has 10240 bytes (all numbers in hex). So, 2^16+220 in one case, 2^17+220 in ...
Guntram Blohm's user avatar
7 votes

How to identify the structure of this specific data file?

It's certainly not a well known format. A quick glance at the file with a hex viewer shows that it mainly consists of records that all have similar, but not identical, size and layout; the very end of ...
Guntram Blohm's user avatar
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
Willem Hengeveld's user avatar
7 votes
Accepted

Simple carving of zip file using binwalk

Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data. The following steps should be performed to extract the zip files:...
ebux's user avatar
  • 1,759
7 votes
Accepted

Does anyone know this encoding?

This seems to be UUencoded data.
Guntram Blohm's user avatar
7 votes
Accepted

Compression algorithm from very old tape backup?

Just to close the loop on this: I ended up successfully reverse-engineering this compression format, which turned out to be written by an extremely obscure tape backup tool from the early 90s called ...
Dmitry Brant's user avatar
6 votes
Accepted

Reverse engineering Earthsiege 2 3D model format

To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's ...
booto's user avatar
  • 911
6 votes
Accepted

How does a stripped XCOFF binary still remain usable?

COFF files were not designed to support relocation after link-time: The binary format used initially for Linux was an a.out variant. When introducing shared libraries certain design decisions ...
julian's user avatar
  • 7,078
6 votes
Accepted

What image format is this?

Without more information, as suggesting by the various comments, it's hard to be completely sure but, based on the information available, the format seems to be a very simple uncompressed vendor-...
Ian Cook's user avatar
  • 2,503
6 votes

Deciphering the format of an unknown file

This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization. Specifically, the FFFF is a 'new class tag' followed by - 0001 a ...
Ian Cook's user avatar
  • 2,503
5 votes

Reading stp (Designaknit Stitch Pattern)-Files II

You should really learn some assembler, and x86 processor architecture, to attempt this. To give you a bit of a start: The var_* declarations correspond to local variables on the stack of the ...
Guntram Blohm's user avatar
5 votes
Accepted

Replace section inside ELF file

I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). ...
Igor Skochinsky's user avatar
  • 36.4k
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
TkTech's user avatar
  • 326
5 votes
Accepted

Address to file offset

Subtract 0x400000 from st_value since the address is located in the first LOAD segment of the binary. According to the System V ABI (generic), the meaning of the st_value symbol depends on what type ...
julian's user avatar
  • 7,078
5 votes
Accepted

Unknown game file decompress

it seems to be compressed in some way because you can read some plain text there This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
julian's user avatar
  • 7,078
5 votes
Accepted

Extracting the contents of an unknown archive file format

I hope you'll find your experience in RE.SE enjoyable and educating :) Reverse engineering is often studied as a hobby, so you're in good company! IDA pro is a disassembler, which is focused on ...
NirIzr's user avatar
  • 11.7k
5 votes

Unknown archive format from QNX operating system

Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package. ...
Igor Skochinsky's user avatar
  • 36.4k
4 votes

Extract non-extractable private key from OS X Keychain

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone ...
standy's user avatar
  • 141
4 votes

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
byteptr's user avatar
  • 141
4 votes
Accepted

Decoding an unknown image format with "DREK" signature (*.drk)

I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
K-Adam's user avatar
  • 56
4 votes

Does anyone know this encoding?

Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their ...
Luc's user avatar
  • 141
4 votes

Decrypt / Decode / Decompress Proprietary File

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed. The header in the file could be a lot of ...
Gogeta70's user avatar
  • 171
4 votes

Find out how a program is reading a file

This is what I would do given the very limited information: Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any "constants." For example, all Windows exe files start ...
the_endian's user avatar
  • 1,830
4 votes
Accepted

Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk

The first 16 bytes are unknown (likely some kind of private data). After that, a regular PNG file follows, but the first 128 bytes have been XORed with the value 234. The rest of the file is unchanged....
Jongware's user avatar
  • 2,354

Only top scored, non community-wiki answers of a minimum length are eligible