Hot answers tagged

35 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
  • 6,948
16 votes
Accepted

"Raw" offsets to "disassembler" offsets?

To convert a raw offset in a PE file to its corresponding "disassembler offset" (known as the virtual address or VA), you need to perform the following steps: Step 1 Using a PE editor, look at the ...
7 votes
Accepted

Adding a new PE section for a code cave

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
  • 11.5k
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
7 votes
Accepted

Replacing small length instruction with larger length instruction

As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try: It's very likely you have a function or 2 in your text segment that are present in ...
6 votes
Accepted

Reverse engineering Earthsiege 2 3D model format

To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's ...
  • 881
6 votes
Accepted

Making changes in ELF file after dissassembly

Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
  • 6,948
6 votes

Deciphering the format of an unknown file

This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization. Specifically, the FFFF is a 'new class tag' followed by - 0001 a ...
  • 2,374
5 votes
Accepted

Unpack .apk file from a PC game (NOT Android related)

Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html These files aren't compressed, so don't worry about that. Since all you want to do ...
  • 326
5 votes

Parsing/Rescuing corrupted IDA database

Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces. But I ...
  • 275
5 votes
Accepted

Do .NET functions have function prologs?

There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. However, the bytecode ...
  • 35.5k
5 votes
Accepted

Hex timestamp decode

import sys import os if(len(sys.argv) != 2): sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0])) if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )): sys.exit("0x ...
  • 15.6k
4 votes

Decoding binary - basics

One of the close reasons on Reverse Engineering is: Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved ...
  • 2,324
4 votes
Accepted

Decoding binary - basics

Converted to binary with 010 Editor, extracted the strings with Strings, and used some clever regex work with Notepad++ to remove some obvious bad strings. Results below. free premium shuffle all ...
4 votes

Do .NET functions have function prologs?

I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues. Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
  • 586
4 votes
Accepted

Basic question: how to input non-printable hex values in GDB / NC?

Well, you have several options to do so. These are the two simplest: Supplying the input through the pipeline: $ python -c "print '\xde\xad\xbe\xef'" | ./binary $ python -c "print 0xdeadbeef" | ./...
  • 8,759
4 votes

Help with a pointer

It's different, because it isn't just 0x28FA190 + 0x374, but it's *(0x28FA190 + 0x374). 0x28FA190 is a base address, probably of a structure, and 0x374 is an offset, when you sum these values and ...
  • 175
4 votes
Accepted

Decoding Hex Data

The data are floating point encoded on 32 bits Little_endian byte 0 to 3: 00 00 00 00 = 0 channel number byte 4 to 7: 1f 85 a3 41 = 0x41a3851f = 20.4400005341 etc .. https://www.h-schmidt.net/...
3 votes
Accepted

Reversing unknown data in hex string

This is an encrypted message (hex-encoded, your guess is correct). The cipher is very weak. As far as I understand there is at least one more additional challenge after this one. If you want to learn ...
  • 8,125
3 votes
Accepted

Reversing a 3D file format from 2001

Some preliminary notes only – may evolve into a complete answer. My approach was the following. Clearly, the numbers at the end are floating point numbers. Also, they are not all floating point; the ...
  • 2,324
3 votes
Accepted

Problem with converting hex values to decimal

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
  • 11.5k
3 votes
Accepted

Router flash dump unknown filesystem

From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out ...
  • 1,331
3 votes

Bypassing av signature with Hex editing

I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
  • 467
3 votes

Disassembling Hex to assembly, then what?

Write a program that would load that binary data to memory and jump with the execution to that area. If everything you assume is correct it will get executed (w/o problems) and you would be able to ...
3 votes
Accepted

How to calculate the checksum algorithm with data captures

The first byte starts as 0E is then 0F and then 10. This looks something like a sequential message id, not part of a checksum. The second byte has a pattern to it too and, taking into account the ...
  • 2,374
3 votes
Accepted

I want to modify the data

The first line of your file contains device information - it seems you are reading HT DataLogger's data. From the quick glance, I conclude, this device measures temperature. Subsequent data looks like ...
  • 3,289
2 votes
Accepted

Extra bytes between clusters in FAT12

Your files aren't plain disk images, they are using the Encase File Format. Your repetitive bytes seem to be artifacts of that file format. There's a newer specification of the file format as well, ...
2 votes

"Raw" offsets to "disassembler" offsets?

ollydbg 1.10 if you have the binary loaded in ollydbg disasm window is in the correct module the binary is also open in hexeditor Right Click -> View -> Executable File In the New Window do ...
  • 15.6k
2 votes

Parsing/Rescuing corrupted IDA database

In my instance the error was "Read error: read past end of file (file position 0x0, wanted 0x20X bytes, read 0x0". After trying different things for a while, I realised the .id2, .nam and the .til ...
2 votes
Accepted

Calculating check sum of m-bus data frame

just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns so looking at the linked pdf it seems it is clear enough skip the start and ...
  • 15.6k

Only top scored, non community-wiki answers of a minimum length are eligible