24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,384
11
votes
Accepted
How to read NSCR1000 data files?
It is encrypted with AES so you will need the keys from windows.plist to decode.
The format is (all stored in big-endian):
offset value
0-3 magic ('NSCR' for PersistentUIRecord)
4-7 version ...
- 1,331
11
votes
Accepted
can someone help me with this map format?
You must have been looking at the wrong representation.
Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
- 126
9
votes
PDB v2.0 File Format documentation
Here is something directly from Microsoft.
https://github.com/Microsoft/microsoft-pdb
- 91
9
votes
Accepted
What are the steps, to extract an unknown archive file in this case?
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
...
- 2,354
8
votes
Accepted
DLL starting with DCD
Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages.
I found a project which claims to decompress such files:
...
- 36.4k
7
votes
Extracting textures from a file (Gamecube game)
This looks .. interesting.
When i open the first and second of your files in a hex editor, one has 20240 bytes, the other has 10240 bytes (all numbers in hex). So, 2^16+220 in one case, 2^17+220 in ...
- 12.9k
7
votes
How to identify the structure of this specific data file?
It's certainly not a well known format. A quick glance at the file with a hex viewer shows that it mainly consists of records that all have similar, but not identical, size and layout; the very end of ...
- 12.9k
7
votes
Accepted
Parsing/Rescuing corrupted IDA database
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have ...
- 1,829
7
votes
Accepted
Simple carving of zip file using binwalk
Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data.
The following steps should be performed to extract the zip files:...
- 1,759
7
votes
Accepted
7
votes
Accepted
Compression algorithm from very old tape backup?
Just to close the loop on this:
I ended up successfully reverse-engineering this compression format, which turned out to be written by an extremely obscure tape backup tool from the early 90s called ...
- 201
6
votes
Accepted
Reverse engineering Earthsiege 2 3D model format
To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's ...
- 911
6
votes
Accepted
How does a stripped XCOFF binary still remain usable?
COFF files were not designed to support relocation after link-time:
The binary format used initially for Linux was an a.out
variant. When introducing shared libraries certain design
decisions ...
- 7,078
6
votes
Accepted
What image format is this?
Without more information, as suggesting by the various comments, it's hard to be completely sure but, based on the information available, the format seems to be a very simple uncompressed vendor-...
- 2,503
6
votes
Deciphering the format of an unknown file
This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization.
Specifically, the FFFF is a 'new class tag' followed by -
0001 a ...
- 2,503
5
votes
Reading stp (Designaknit Stitch Pattern)-Files II
You should really learn some assembler, and x86 processor architecture, to attempt this.
To give you a bit of a start:
The var_* declarations correspond to local variables on the stack of the ...
- 12.9k
5
votes
Accepted
Replace section inside ELF file
I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). ...
- 36.4k
5
votes
Animal Crossing: Pocket Camp .zdat File
The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
- 326
5
votes
Accepted
Address to file offset
Subtract 0x400000 from st_value since the address is located in the first LOAD segment of the binary.
According to the System V ABI (generic), the meaning of the st_value symbol depends on what type ...
- 7,078
5
votes
Accepted
Unknown game file decompress
it seems to be compressed in some way because you can read some plain text there
This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
- 7,078
5
votes
Accepted
Extracting the contents of an unknown archive file format
I hope you'll find your experience in RE.SE enjoyable and educating :)
Reverse engineering is often studied as a hobby, so you're in good company!
IDA pro is a disassembler, which is focused on ...
- 11.7k
5
votes
Unknown archive format from QNX operating system
Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package.
...
- 36.4k
4
votes
Extract non-extractable private key from OS X Keychain
I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here.
In my case, I did the following:
$ pip2 install hexdump pycrypto pyopenssl
$ git clone ...
- 141
4
votes
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
- 141
4
votes
Accepted
Decoding an unknown image format with "DREK" signature (*.drk)
I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
- 56
4
votes
Does anyone know this encoding?
Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their ...
- 141
4
votes
Decrypt / Decode / Decompress Proprietary File
I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed.
The header in the file could be a lot of ...
- 171
4
votes
Find out how a program is reading a file
This is what I would do given the very limited information:
Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any "constants." For example, all Windows exe files start ...
- 1,830
4
votes
Accepted
Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk
The first 16 bytes are unknown (likely some kind of private data). After that, a regular PNG file follows, but the first 128 bytes have been XORed with the value 234. The rest of the file is unchanged....
- 2,354
Only top scored, non community-wiki answers of a minimum length are eligible