Hot answers tagged

33 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
user avatar
  • 6,859
14 votes
Accepted

"Raw" offsets to "disassembler" offsets?

To convert a raw offset in a PE file to its corresponding "disassembler offset" (known as the virtual address or VA), you need to perform the following steps: Step 1 Using a PE editor, look at the ...
user avatar
7 votes
Accepted

Replacing small length instruction with larger length instruction

As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try: It's very likely you have a function or 2 in your text segment that are present in ...
user avatar
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
user avatar
7 votes
Accepted

Adding a new PE section for a code cave

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
user avatar
  • 11.4k
6 votes

Reverse-engineering a tough-to-crack video game save-file checksum

Like others I would recommend trying to get the assembly code that computes the checksum. If you obtain that the rest is easy. However sometimes that can be very hard to obtain, so here are some tips ...
user avatar
  • 231
6 votes
Accepted

Reverse engineering Earthsiege 2 3D model format

To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's ...
user avatar
  • 871
6 votes
Accepted

Making changes in ELF file after dissassembly

Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
user avatar
  • 6,859
5 votes
Accepted

Unpack .apk file from a PC game (NOT Android related)

Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html These files aren't compressed, so don't worry about that. Since all you want to do ...
user avatar
  • 326
5 votes

Parsing/Rescuing corrupted IDA database

Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces. But I ...
user avatar
  • 275
5 votes
Accepted

Do .NET functions have function prologs?

There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. However, the bytecode ...
user avatar
  • 34.7k
5 votes
Accepted

Hex timestamp decode

import sys import os if(len(sys.argv) != 2): sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0])) if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )): sys.exit("0x ...
user avatar
  • 14.9k
5 votes

Deciphering the format of an unknown file

This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization. Specifically, the FFFF is a 'new class tag' followed by - 0001 a ...
user avatar
  • 2,164
4 votes
Accepted

Modifying a binary save-data file for a video game with a CRC/Checksum check

This is quite hard question to answer due to variables within reverse engineering. I would recommend you start off with: Start game Get some coins or whatever is saved then save the game. Restart ...
user avatar
  • 467
4 votes
Accepted

Decoding binary - basics

Converted to binary with 010 Editor, extracted the strings with Strings, and used some clever regex work with Notepad++ to remove some obvious bad strings. Results below. free premium shuffle all ...
user avatar
4 votes

Do .NET functions have function prologs?

I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues. Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
user avatar
  • 586
4 votes
Accepted

Basic question: how to input non-printable hex values in GDB / NC?

Well, you have several options to do so. These are the two simplest: Supplying the input through the pipeline: $ python -c "print '\xde\xad\xbe\xef'" | ./binary $ python -c "print 0xdeadbeef" | ./...
user avatar
  • 8,629
4 votes

Help with a pointer

It's different, because it isn't just 0x28FA190 + 0x374, but it's *(0x28FA190 + 0x374). 0x28FA190 is a base address, probably of a structure, and 0x374 is an offset, when you sum these values and ...
user avatar
  • 175
4 votes
Accepted

Decoding Hex Data

The data are floating point encoded on 32 bits Little_endian byte 0 to 3: 00 00 00 00 = 0 channel number byte 4 to 7: 1f 85 a3 41 = 0x41a3851f = 20.4400005341 etc .. https://www.h-schmidt.net/...
user avatar
3 votes
Accepted

Reversing unknown data in hex string

This is an encrypted message (hex-encoded, your guess is correct). The cipher is very weak. As far as I understand there is at least one more additional challenge after this one. If you want to learn ...
user avatar
  • 7,720
3 votes
Accepted

Reversing a 3D file format from 2001

Some preliminary notes only – may evolve into a complete answer. My approach was the following. Clearly, the numbers at the end are floating point numbers. Also, they are not all floating point; the ...
user avatar
  • 2,274
3 votes

Decoding binary - basics

One of the close reasons on Reverse Engineering is: Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved ...
user avatar
  • 2,274
3 votes
Accepted

Problem with converting hex values to decimal

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
user avatar
  • 11.4k
3 votes
Accepted

Router flash dump unknown filesystem

From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out ...
user avatar
  • 1,321
3 votes

Bypassing av signature with Hex editing

I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
user avatar
  • 467
3 votes

Disassembling Hex to assembly, then what?

Write a program that would load that binary data to memory and jump with the execution to that area. If everything you assume is correct it will get executed (w/o problems) and you would be able to ...
user avatar
3 votes
Accepted

How to calculate the checksum algorithm with data captures

The first byte starts as 0E is then 0F and then 10. This looks something like a sequential message id, not part of a checksum. The second byte has a pattern to it too and, taking into account the ...
user avatar
  • 2,164
3 votes
Accepted

I want to modify the data

The first line of your file contains device information - it seems you are reading HT DataLogger's data. From the quick glance, I conclude, this device measures temperature. Subsequent data looks like ...
user avatar
  • 3,189
2 votes
Accepted

Extra bytes between clusters in FAT12

Your files aren't plain disk images, they are using the Encase File Format. Your repetitive bytes seem to be artifacts of that file format. There's a newer specification of the file format as well, ...
user avatar
2 votes

"Raw" offsets to "disassembler" offsets?

ollydbg 1.10 if you have the binary loaded in ollydbg disasm window is in the correct module the binary is also open in hexeditor Right Click -> View -> Executable File In the New Window do ...
user avatar
  • 14.9k

Only top scored, non community-wiki answers of a minimum length are eligible