35
votes
Accepted
Approach to extract useful information from binary file
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
- 7,236
7
votes
Accepted
Parsing/Rescuing corrupted IDA database
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have ...
- 1,829
7
votes
Accepted
Adding a new PE section for a code cave
Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
- 11.8k
6
votes
Accepted
Making changes in ELF file after dissassembly
Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
- 7,236
6
votes
Deciphering the format of an unknown file
This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization.
Specifically, the FFFF is a 'new class tag' followed by -
0001 a ...
- 2,633
5
votes
Accepted
Hex timestamp decode
import sys
import os
if(len(sys.argv) != 2):
sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0]))
if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )):
sys.exit("0x ...
- 16.7k
5
votes
Accepted
Unpack .apk file from a PC game (NOT Android related)
Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/reading-airstrike-3d-ii-datafiles.html
These files aren't compressed, so don't worry about that. Since ...
- 326
5
votes
Accepted
Do .NET functions have function prologs?
There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code.
However, the bytecode ...
- 36.9k
4
votes
Do .NET functions have function prologs?
I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues.
Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
- 586
4
votes
Accepted
Basic question: how to input non-printable hex values in GDB / NC?
Well, you have several options to do so. These are the two simplest:
Supplying the input through the pipeline:
$ python -c "print '\xde\xad\xbe\xef'" | ./binary
$ python -c "print 0xdeadbeef" | ./...
- 9,019
4
votes
Help with a pointer
It's different, because it isn't just 0x28FA190 + 0x374, but it's *(0x28FA190 + 0x374).
0x28FA190 is a base address, probably of a structure, and 0x374 is an offset, when you sum these values and ...
- 175
4
votes
Accepted
Decoding Hex Data
The data are floating point encoded on 32 bits Little_endian
byte 0 to 3: 00 00 00 00 = 0 channel number
byte 4 to 7: 1f 85 a3 41 = 0x41a3851f = 20.4400005341
etc ..
https://www.h-schmidt.net/...
- 416
3
votes
Accepted
Problem with converting hex values to decimal
This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields.
It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
- 11.8k
3
votes
Disassembling Hex to assembly, then what?
Write a program that would load that binary data to memory and jump with the execution to that area. If everything you assume is correct it will get executed (w/o problems) and you would be able to ...
- 4,952
3
votes
Bypassing av signature with Hex editing
I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
- 467
3
votes
Accepted
Router flash dump unknown filesystem
From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out ...
- 1,341
3
votes
Accepted
How to calculate the checksum algorithm with data captures
The first byte starts as 0E is then 0F and then 10.
This looks something like a sequential message id, not part of a checksum.
The second byte has a pattern to it too and, taking into account the ...
- 2,633
3
votes
Accepted
I want to modify the data
The first line of your file contains device information - it seems you are reading HT DataLogger's data. From the quick glance, I conclude, this device measures temperature.
Subsequent data looks like ...
- 3,419
2
votes
Accepted
Basic clarifications about .hex and .bin file
The .hex file contains the instructions that will be executed by the
microcroller, and the format used is
http://www.keil.com/support/docs/1584/ , am I right?
You're right about the format. The ....
- 2,906
2
votes
Accepted
how to translate HEX values into X Y Z
The hex you posted is equivant to the float value * 10^3
That is 1085.597 == 0x4487b319 and so on
Use any online calculator to check in both direction like
https://www.h-schmidt.net/...
- 16.7k
2
votes
what is best forum to ask about hex reversing?
We call it data (file format) reverse engineering but, it is also bounded with software reverse engineering because you need to examine (if you have) actual software which creates, edits, extracts ...
2
votes
Parsing/Rescuing corrupted IDA database
In my instance the error was "Read error: read past end of file (file position 0x0, wanted 0x20X bytes, read 0x0".
After trying different things for a while, I realised the .id2, .nam and the .til ...
- 121
2
votes
Is there a tool to scan for code / functions that can account for different compilers?
There are several tools that achieve this.
IDA
First, IDA has mechanisms to identify compiler (and compiler properties). That's not a main feature but might provide what you are looking for.
Options -&...
- 11.8k
2
votes
Accepted
Invalid INDX entries for $I30 on NTFS harddisk
The INDEX_RECORD_ENTRY should be preceded by INDEX_HEADER with the magic signature INDX
without the header deciphering the INDEX_RECORD_ENTRIES is difficult as shown in your screen shot
the ...
- 16.7k
2
votes
Accepted
What does this sequence of numbers mean?
Asked this to a person who has more knowledge than me and he was able to answer!
This is the Moser-de Bruijn sequence and looks like it's used for binary interleaving which is really important in this ...
- 193
2
votes
How can I create an appropriate Japanese .tbl file for Hex Editing?
Windows executables can have text in one of two formats:
UI resources. These are stored in a special format in the .rsrc section and include things like strings, menus, dialogs and some others. Text ...
- 36.9k
2
votes
How to extract an unknown archive file? Currently Im trying to open *.pak (P5CK)
Xentax is a good reference on game format RE in general and they seem to already have some info on this one, as well as a QickBMS script:
http://wiki.xentax.com/index.php/...
- 36.9k
2
votes
Problem with converting hex values to decimal
This looks like the LEB128 encoding.
Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not ...
- 2,633
2
votes
Accepted
Decipher variable length serial protocol
I understand your Arduino serves as a relay in the middle between the controller and the LCD. What you could do (not extremely exciting, but you did not mention whether you made similar experiments ...
- 1,974
2
votes
CyberChef Challenge #21
Run a histogram. Use the known text as a crib.
int chr count
48 0 0
49 1 8
50 2 11
51 3 12
52 4 7
53 5 13
54 6 11
55 7 9
56 8 17
57 9 9
58 : 0
59 ; 0
...
- 878
Only top scored, non community-wiki answers of a minimum length are eligible