Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering Unknown File Formats with ImHex

werwolv.net

Post reply on HN
Print view View original

51–55 of 55 posts

Re: Reverse Engineering Unknown File Formats with ImHex

#51

Post by nijave »

vivzkestrel wrote: post #34
NegativeLatency wrote: post #27

Earlier quoted context omitted.

Try an LLM, either to do it directly or to guide your own explorations

as a guy who doesnt have experience fiddling with this kinda stuff, what is the step by step process if any to go about figuring out how an unknown file format is actually made of and modifying it? - the post itself quotes "I usually couldn’t really give them a good answer except, “Look at the decompiled code of whatever program reads/writes these files and work backwards from there.” - i dont have the program and th…

Claude.ai, set to Opus xhigh, attach file, "Try to decode the file format of this save game from Name of Game. Do research if necessary"

If the file's too big, you'll probably need to download a harness/local app. If you go local route, make sure you have a backup in case the LLM breaks the file

The local route it can also try to poke at the binaries that read/write the file so it would have a bit more to work with going that route

Re: Reverse Engineering Unknown File Formats with ImHex

#53

Post by nijave »

ChadNauseam wrote: post #12
Lucasoato wrote: post #5

I’m going to try that on the newest outlook binary format used to store the emails locally... why couldn’t they stick to the plain simple sqlite?

Actually one of the worst and most insane file formats of all time. I partially reverse engineered it a while ago. My parser is super janky and I can't share it, but I pasted the code into claude and had it summarize it: https://gist.github.com/anchpop/a14325cc451b04a5bf78c476ac20...

LLM and Google are suggesting it might be this https://learn.microsoft.com/en-us/openspecs/exchange_server_...

A lot of Microsoft formats are open standards... Created by and only used by Microsoft...

Re: Reverse Engineering Unknown File Formats with ImHex

#54

Post by issung »

pwdisswordfishq wrote: post #49
issung wrote: post #19

I finally dipped into using ImHex when doing some reversing of the PS2 memory card format for https://ps2iodb.com . The program is so good, and has enough of a reputation that I knew to reach for it even though I know nothing about reversing, and that was 3-4 years ago now! Also shoutout to the awesome GUI library is uses; https://github.com/ocornut/imgui

A few attempts using it over the years has usually resulted in frustration and giving up after determining it to be a non-starter. Past attempts to use after downloading and running it natively have revealed it to be very crashy. Trying the browser-based demo today and doing the first thing that comes to mind (loading a ZIP) produces an error that the pattern language interpreter can't resolve the "import std.mem" li…

I... can't say I experienced any of these issues. I also had no idea there was a browser demo. Just opened it up and opened a zip with no issues. Are you using some obscure OS & experimental browser combo?

Re: Reverse Engineering Unknown File Formats with ImHex

#55

Post by butvacuum »

Charon77 wrote: post #22
butvacuum wrote: post #18

Earlier quoted context omitted.

for games its more often .net BinarySerializer.

A lot of unity games does it, especially the 'legacy' serializer

I've not done unity3d dev- but yea, all I've seen from it are games using XML, or BinarySerializer. sometimes its compressed.
Post reply on HN