Hot answers tagged

35 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
julian's user avatar
  • 7,108
7 votes
Accepted

Adding a new PE section for a code cave

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
NirIzr's user avatar
  • 11.8k
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
Willem Hengeveld's user avatar
6 votes
Accepted

Reverse engineering Earthsiege 2 3D model format

To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's ...
booto's user avatar
  • 931
6 votes
Accepted

Making changes in ELF file after dissassembly

Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
julian's user avatar
  • 7,108
6 votes

Deciphering the format of an unknown file

This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization. Specifically, the FFFF is a 'new class tag' followed by - 0001 a ...
Ian Cook's user avatar
  • 2,523
5 votes
Accepted

Do .NET functions have function prologs?

There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. However, the bytecode ...
Igor Skochinsky's user avatar
  • 36.5k
5 votes
Accepted

Unpack .apk file from a PC game (NOT Android related)

Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html These files aren't compressed, so don't worry about that. Since all you want to do ...
TkTech's user avatar
  • 326
5 votes
Accepted

Hex timestamp decode

import sys import os if(len(sys.argv) != 2): sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0])) if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )): sys.exit("0x ...
blabb's user avatar
  • 16.3k
4 votes
Accepted

Reversing a 3D file format from 2001

Some preliminary notes only – may evolve into a complete answer. My approach was the following. Clearly, the numbers at the end are floating point numbers. Also, they are not all floating point; the ...
Jongware's user avatar
  • 2,364
4 votes

Do .NET functions have function prologs?

I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues. Why not use a decompiler library for dnSpy/de4dot - dnlib to decompile ...
Sigtran's user avatar
  • 586
4 votes
Accepted

Basic question: how to input non-printable hex values in GDB / NC?

Well, you have several options to do so. These are the two simplest: Supplying the input through the pipeline: $ python -c "print '\xde\xad\xbe\xef'" | ./binary $ python -c "print 0xdeadbeef" | ./...
Megabeets's user avatar
  • 8,959
4 votes

Help with a pointer

It's different, because it isn't just 0x28FA190 + 0x374, but it's *(0x28FA190 + 0x374). 0x28FA190 is a base address, probably of a structure, and 0x374 is an offset, when you sum these values and ...
anx199's user avatar
  • 175
4 votes
Accepted

Decoding Hex Data

The data are floating point encoded on 32 bits Little_endian byte 0 to 3: 00 00 00 00 = 0 channel number byte 4 to 7: 1f 85 a3 41 = 0x41a3851f = 20.4400005341 etc .. https://www.h-schmidt.net/...
Gordon Freeman's user avatar
3 votes
Accepted

Problem with converting hex values to decimal

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
NirIzr's user avatar
  • 11.8k
3 votes

Bypassing av signature with Hex editing

I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
Paul's user avatar
  • 467
3 votes

Disassembling Hex to assembly, then what?

Write a program that would load that binary data to memory and jump with the execution to that area. If everything you assume is correct it will get executed (w/o problems) and you would be able to ...
Paweł Łukasik's user avatar
3 votes
Accepted

Router flash dump unknown filesystem

From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out ...
cimarron's user avatar
  • 1,331
3 votes
Accepted

Reversing unknown data in hex string

This is an encrypted message (hex-encoded, your guess is correct). The cipher is very weak. As far as I understand there is at least one more additional challenge after this one. If you want to learn ...
w s's user avatar
  • 8,448
3 votes
Accepted

How to calculate the checksum algorithm with data captures

The first byte starts as 0E is then 0F and then 10. This looks something like a sequential message id, not part of a checksum. The second byte has a pattern to it too and, taking into account the ...
Ian Cook's user avatar
  • 2,523
3 votes
Accepted

I want to modify the data

The first line of your file contains device information - it seems you are reading HT DataLogger's data. From the quick glance, I conclude, this device measures temperature. Subsequent data looks like ...
bart1e's user avatar
  • 3,369
2 votes

Parsing/Rescuing corrupted IDA database

In my instance the error was "Read error: read past end of file (file position 0x0, wanted 0x20X bytes, read 0x0". After trying different things for a while, I realised the .id2, .nam and the .til ...
Jeromy Adofo's user avatar
2 votes

Is there a tool to scan for code / functions that can account for different compilers?

There are several tools that achieve this. IDA First, IDA has mechanisms to identify compiler (and compiler properties). That's not a main feature but might provide what you are looking for. Options -&...
NirIzr's user avatar
  • 11.8k
2 votes

Editing a string in a native dll

You can find the string resources in the mui files under the folder contains resources dedicated to localization (e.g. c:\Windows\System32\en-US). The strings are in Unicode format.
ebux's user avatar
  • 1,759
2 votes
Accepted

Basic clarifications about .hex and .bin file

The .hex file contains the instructions that will be executed by the microcroller, and the format used is http://www.keil.com/support/docs/1584/ , am I right? You're right about the format. The ....
Nordwald's user avatar
  • 2,896
2 votes
Accepted

how to translate HEX values into X Y Z

The hex you posted is equivant to the float value * 10^3 That is 1085.597 == 0x4487b319 and so on Use any online calculator to check in both direction like https://www.h-schmidt.net/...
blabb's user avatar
  • 16.3k
2 votes

what is best forum to ask about hex reversing?

We call it data (file format) reverse engineering but, it is also bounded with software reverse engineering because you need to examine (if you have) actual software which creates, edits, extracts ...
Kerim Can Kalıpcıoğlu's user avatar
2 votes

Using HEX editor and making 4 chars from 3 chars

As Far As i Know there isn't another way assume you have a program like this the hex for this function will look like this 0:000> db main l21 00111260 55 8b ec 6a 00 eb 04 74-68 69 00 68 67 ...
blabb's user avatar
  • 16.3k
2 votes

How can I create an appropriate Japanese .tbl file for Hex Editing?

Windows executables can have text in one of two formats: UI resources. These are stored in a special format in the .rsrc section and include things like strings, menus, dialogs and some others. Text ...
Igor Skochinsky's user avatar
  • 36.5k
2 votes
Accepted

Invalid INDX entries for $I30 on NTFS harddisk

The INDEX_RECORD_ENTRY should be preceded by INDEX_HEADER with the magic signature INDX without the header deciphering the INDEX_RECORD_ENTRIES is difficult as shown in your screen shot the ...
blabb's user avatar
  • 16.3k

Only top scored, non community-wiki answers of a minimum length are eligible