35
votes
Accepted
Approach to extract useful information from binary file
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
- 7,078
7
votes
Accepted
Adding a new PE section for a code cave
Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
- 11.7k
7
votes
Accepted
Parsing/Rescuing corrupted IDA database
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have ...
- 1,829
6
votes
Accepted
Reverse engineering Earthsiege 2 3D model format
To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's ...
- 911
6
votes
Accepted
Making changes in ELF file after dissassembly
Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
- 7,078
6
votes
Deciphering the format of an unknown file
This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization.
Specifically, the FFFF is a 'new class tag' followed by -
0001 a ...
- 2,503
5
votes
Accepted
Unpack .apk file from a PC game (NOT Android related)
Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html
These files aren't compressed, so don't worry about that. Since all you want to do ...
- 326
5
votes
Accepted
Do .NET functions have function prologs?
There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code.
However, the bytecode ...
- 36.4k
5
votes
Accepted
Hex timestamp decode
import sys
import os
if(len(sys.argv) != 2):
sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0]))
if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )):
sys.exit("0x ...
- 16.3k
4
votes
Do .NET functions have function prologs?
I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues.
Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
- 586
4
votes
Accepted
Basic question: how to input non-printable hex values in GDB / NC?
Well, you have several options to do so. These are the two simplest:
Supplying the input through the pipeline:
$ python -c "print '\xde\xad\xbe\xef'" | ./binary
$ python -c "print 0xdeadbeef" | ./...
- 8,919
4
votes
Help with a pointer
It's different, because it isn't just 0x28FA190 + 0x374, but it's *(0x28FA190 + 0x374).
0x28FA190 is a base address, probably of a structure, and 0x374 is an offset, when you sum these values and ...
- 175
4
votes
Accepted
Decoding Hex Data
The data are floating point encoded on 32 bits Little_endian
byte 0 to 3: 00 00 00 00 = 0 channel number
byte 4 to 7: 1f 85 a3 41 = 0x41a3851f = 20.4400005341
etc ..
https://www.h-schmidt.net/...
- 416
3
votes
Accepted
Problem with converting hex values to decimal
This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields.
It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
- 11.7k
3
votes
Bypassing av signature with Hex editing
I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
- 467
3
votes
Accepted
Router flash dump unknown filesystem
From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out ...
- 1,331
3
votes
Accepted
Reversing a 3D file format from 2001
Some preliminary notes only – may evolve into a complete answer.
My approach was the following. Clearly, the numbers at the end are floating point numbers. Also, they are not all floating point; the ...
- 2,354
3
votes
Accepted
Reversing unknown data in hex string
This is an encrypted message (hex-encoded, your guess is correct). The cipher is very weak.
As far as I understand there is at least one more additional challenge after this one.
If you want to learn ...
- 8,408
3
votes
Disassembling Hex to assembly, then what?
Write a program that would load that binary data to memory and jump with the execution to that area. If everything you assume is correct it will get executed (w/o problems) and you would be able to ...
- 4,912
3
votes
Accepted
How to calculate the checksum algorithm with data captures
The first byte starts as 0E is then 0F and then 10.
This looks something like a sequential message id, not part of a checksum.
The second byte has a pattern to it too and, taking into account the ...
- 2,503
3
votes
Accepted
I want to modify the data
The first line of your file contains device information - it seems you are reading HT DataLogger's data. From the quick glance, I conclude, this device measures temperature.
Subsequent data looks like ...
- 3,369
2
votes
Accepted
Basic clarifications about .hex and .bin file
The .hex file contains the instructions that will be executed by the
microcroller, and the format used is
http://www.keil.com/support/docs/1584/ , am I right?
You're right about the format. The ....
- 2,896
2
votes
Accepted
how to translate HEX values into X Y Z
The hex you posted is equivant to the float value * 10^3
That is 1085.597 == 0x4487b319 and so on
Use any online calculator to check in both direction like
https://www.h-schmidt.net/...
- 16.3k
2
votes
what is best forum to ask about hex reversing?
We call it data (file format) reverse engineering but, it is also bounded with software reverse engineering because you need to examine (if you have) actual software which creates, edits, extracts ...
2
votes
Using HEX editor and making 4 chars from 3 chars
As Far As i Know there isn't another way
assume you have a program like this
the hex for this function will look like this
0:000> db main l21
00111260 55 8b ec 6a 00 eb 04 74-68 69 00 68 67 ...
- 16.3k
2
votes
Parsing/Rescuing corrupted IDA database
In my instance the error was "Read error: read past end of file (file position 0x0, wanted 0x20X bytes, read 0x0".
After trying different things for a while, I realised the .id2, .nam and the .til ...
- 121
2
votes
Accepted
Calculating check sum of m-bus data frame
just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns
so looking at the linked pdf it seems it is clear enough
skip the start and ...
- 16.3k
2
votes
Accepted
End of central directory signature not found after extracting an embedded zip file
If you consider the actual PKZipformat
Each PKZIP trealer is composed by 0x506B0506 AND followed by 18 bytes handling other information like number of disk, total number of central directories, their ...
- 259
2
votes
Is there a tool to scan for code / functions that can account for different compilers?
There are several tools that achieve this.
IDA
First, IDA has mechanisms to identify compiler (and compiler properties). That's not a main feature but might provide what you are looking for.
Options -&...
- 11.7k
2
votes
Editing a string in a native dll
You can find the string resources in the mui files under the folder contains resources dedicated to localization (e.g. c:\Windows\System32\en-US). The strings are in Unicode format.
- 1,759
Only top scored, non community-wiki answers of a minimum length are eligible