nneonneo
  • Member for 8 years, 10 months
  • Last seen more than a month ago
Where to find information about a file format?
Accepted answer
36 votes

I am a developer for the Hachoir project, which aims to describe the format of any file down to the bit-level. Currently it has parsers for a number of well-known formats, including Java classes, ...

View answer
Repackaging APK file using baksmali and smali
20 votes

I use apktool for this purpose, and a short little pair of shell scripts for decompiling and recompiling APKs: decompile-apk #!/bin/bash -e if ! [ "$1" ]; then echo "usage: $0 <file.apk>" ...

View answer
Fixing the checksum of a modified Android ELF
Accepted answer
8 votes

ELF itself doesn't specify any kind of checksum. Your link error is likely due to an incorrect edit which changed some offsets within the file. If you don't adjust the offsets, you have to replace a ...

View answer
What techniques are used in reverse engineering a serial protocol?
5 votes

The fact that some messages are different sizes leads me to think you might be using the wrong baud rate. J1708 is specified to be 9600/8-N-1, which means you need to ensure you are connecting at that ...

View answer
How should I determine the format of this audio file?
5 votes

In addition to the fine suggestions in the other answers, here are some suggestions specific to audio: If you know how long the playtime of the audio is (roughly), calculate the approximate bitrate ...

View answer
Format of .chk firmware package on WGR614v7
Accepted answer
3 votes

The file begins: 0000000: 4148 3030 4938 e66c 000e aa28 9835 0589 AH00I8.l...(.5.. 0000010: 3004 125a 1b39 65ff 47e4 b95c 0001 0014 0..Z.9e.G..\.... 0000020: 5531 3248 3036 3454 3030 5f4e 4554 4745 ...

View answer
While Loop Correct?
2 votes

Let's annotate the assembly. .L1 push ebp // standard function prologue mov ebp, esp push ebx // saved register sub esp, 20 // room for locals mov ...

View answer
Determine encrypted/hashed/compressed proprietary driver file
Accepted answer
2 votes

The file appears to be a binary-serialized .NET file (similar in concept to a Python pickle or a Java serialized stream), and does not appear to be obfuscated in any way. I manually parsed the first ...

View answer
Why ELF headers are included in the process memory
2 votes

ELF headers are included in the process memory because the program asked for them. The ELF file contains a number of "program headers" which specify how the program is to be loaded. The ELF loader on ...

View answer
debugging an older version of libc
0 votes

libc versions are tied to the corresponding ld.so (dynamic linker) versions. You have a few options: Run the program in a Docker container with an OS that corresponds to the target libc. (For example,...

View answer
memset() in malware
0 votes

You told OllyDBG to jump to 0012F8A3, which will cause Olly to show it in the disassembly listing. As you can see from the listing: 0012F8A3 0000 ADD BYTE PTR DS: [EAX], AL On the left is the ...

View answer