35
votes
Accepted
Approach to extract useful information from binary file
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
- 6,948
16
votes
Accepted
"Raw" offsets to "disassembler" offsets?
To convert a raw offset in a PE file to its corresponding "disassembler offset" (known as the virtual address or VA), you need to perform the following steps:
Step 1
Using a PE editor, look at the ...
- 20.5k
7
votes
Accepted
Adding a new PE section for a code cave
Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
- 11.5k
7
votes
Accepted
Parsing/Rescuing corrupted IDA database
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have ...
- 1,809
7
votes
Accepted
Replacing small length instruction with larger length instruction
As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try:
It's very likely you have a function or 2 in your text segment that are present in ...
- 12.7k
6
votes
Accepted
Reverse engineering Earthsiege 2 3D model format
To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's ...
- 881
6
votes
Accepted
Making changes in ELF file after dissassembly
Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
- 6,948
6
votes
Deciphering the format of an unknown file
This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization.
Specifically, the FFFF is a 'new class tag' followed by -
0001 a ...
- 2,374
5
votes
Accepted
Unpack .apk file from a PC game (NOT Android related)
Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html
These files aren't compressed, so don't worry about that. Since all you want to do ...
- 326
5
votes
Parsing/Rescuing corrupted IDA database
Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces.
But I ...
- 275
5
votes
Accepted
Do .NET functions have function prologs?
There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code.
However, the bytecode ...
- 35.5k
5
votes
Accepted
Hex timestamp decode
import sys
import os
if(len(sys.argv) != 2):
sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0]))
if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )):
sys.exit("0x ...
- 15.6k
4
votes
Decoding binary - basics
One of the close reasons on Reverse Engineering is:
Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved ...
- 2,324
4
votes
Accepted
Decoding binary - basics
Converted to binary with 010 Editor, extracted the strings with Strings, and used some clever regex work with Notepad++ to remove some obvious bad strings. Results below.
free
premium
shuffle
all
...
- 20.5k
4
votes
Do .NET functions have function prologs?
I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues.
Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
- 586
4
votes
Accepted
Basic question: how to input non-printable hex values in GDB / NC?
Well, you have several options to do so. These are the two simplest:
Supplying the input through the pipeline:
$ python -c "print '\xde\xad\xbe\xef'" | ./binary
$ python -c "print 0xdeadbeef" | ./...
- 8,759
4
votes
Help with a pointer
It's different, because it isn't just 0x28FA190 + 0x374, but it's *(0x28FA190 + 0x374).
0x28FA190 is a base address, probably of a structure, and 0x374 is an offset, when you sum these values and ...
- 175
4
votes
Accepted
Decoding Hex Data
The data are floating point encoded on 32 bits Little_endian
byte 0 to 3: 00 00 00 00 = 0 channel number
byte 4 to 7: 1f 85 a3 41 = 0x41a3851f = 20.4400005341
etc ..
https://www.h-schmidt.net/...
- 406
3
votes
Accepted
Reversing unknown data in hex string
This is an encrypted message (hex-encoded, your guess is correct). The cipher is very weak.
As far as I understand there is at least one more additional challenge after this one.
If you want to learn ...
- 8,125
3
votes
Accepted
Reversing a 3D file format from 2001
Some preliminary notes only – may evolve into a complete answer.
My approach was the following. Clearly, the numbers at the end are floating point numbers. Also, they are not all floating point; the ...
- 2,324
3
votes
Accepted
Problem with converting hex values to decimal
This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields.
It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
- 11.5k
3
votes
Accepted
Router flash dump unknown filesystem
From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out ...
- 1,331
3
votes
Bypassing av signature with Hex editing
I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
- 467
3
votes
Disassembling Hex to assembly, then what?
Write a program that would load that binary data to memory and jump with the execution to that area. If everything you assume is correct it will get executed (w/o problems) and you would be able to ...
- 4,652
3
votes
Accepted
How to calculate the checksum algorithm with data captures
The first byte starts as 0E is then 0F and then 10.
This looks something like a sequential message id, not part of a checksum.
The second byte has a pattern to it too and, taking into account the ...
- 2,374
3
votes
Accepted
I want to modify the data
The first line of your file contains device information - it seems you are reading HT DataLogger's data. From the quick glance, I conclude, this device measures temperature.
Subsequent data looks like ...
- 3,289
2
votes
Accepted
Extra bytes between clusters in FAT12
Your files aren't plain disk images, they are using the Encase File Format. Your repetitive bytes seem to be artifacts of that file format.
There's a newer specification of the file format as well, ...
- 12.7k
2
votes
"Raw" offsets to "disassembler" offsets?
ollydbg 1.10
if you have
the binary loaded in ollydbg
disasm window is in the correct module
the binary is also open in hexeditor
Right Click -> View -> Executable File
In the New Window do ...
- 15.6k
2
votes
Parsing/Rescuing corrupted IDA database
In my instance the error was "Read error: read past end of file (file position 0x0, wanted 0x20X bytes, read 0x0".
After trying different things for a while, I realised the .id2, .nam and the .til ...
- 121
2
votes
Accepted
Calculating check sum of m-bus data frame
just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns
so looking at the linked pdf it seems it is clear enough
skip the start and ...
- 15.6k
Only top scored, non community-wiki answers of a minimum length are eligible