Live data from Hacker News

Parsing an Undocumented File Format

blog.vivekpanyam.com

21–30 of 65 posts

Re: Parsing an Undocumented File Format

#21

This is something I've been interested in for a while. I've collected a few links people have already posted to their own projects or write-ups here and elsewhere, but is there any single excellent resource for learning how to do this? I've a number of dead and/or proprietary formats that I've always wanted to crack open, but I'm totally overwhelmed with where to start.

I had reversed engineered some ASCII file formats. While probably overkill, my background parsing simple programming languages (for which there are many good educational resources) was really helpful (in the approach I use). I tokenize, and try figuring out syntax structures from the order of token types, then from there, extract the information I need into my program's data representation. I'm not sure if this is the approach used by everyone else, but it seems plausible for someone with a CS/PL implementation background.

But first, it helps to have sample files to see recurring structures. Ideally, you also have access to software that generates these files. This allows you to deal with simpler files containing less information to reason about, make small changes within the program and compare the corresponding change(s) in the file.

Re: Parsing an Undocumented File Format

#22

Reminds me of a situation I ran into years ago. I worked at a fintech startup where we were reverse engineering the mobile APIs of retail stock brokerages. Eventually we ran out of brokers in the US and began looking overseas. The first one we looked at was a large broker in Singapore. Their API responses were in some absolutely insane markup language that I'd never seen before. I actually had to spend a good deal of…

You are not alone. I did a project to upgrade "sort of XML" to standard XML. Your example content gave me flashback shivers.

Re: Parsing an Undocumented File Format

#23
post #8

Just watch out for the encrypted file formats. Need a debugger to figure out what it's doing.

They are relatively easier to detect though. Compressed file formats or virtual machine codes in disguise tend to be more annoying, especially since they can look like somehow structured and waste your time.

Meanwhile for ZLIB compressed files, just look for the 'x' after headers.

Re: Parsing an Undocumented File Format

#24
Doing this with text files used to be a big part of my job. I had to write Java (well, mainly Java... ) (cf. the ingredients of scumble on Discworld) programs to parse the files school districts had that described bus stops, from depot to school in the AM and from school to depot in the PM among other arrangements, and, often, the best you could say about some files is that someone had likely worked fairly hard to make them look like they were software-generated. They had just enough structure that parsing them with a program was the correct option, but they had enough irregularities that the program was never going to be pretty, because there's no pretty way to parse an ugly file.

It's a wonderful example of inductive reasoning, or generating general rules from a collection of specific examples.

Re: Parsing an Undocumented File Format

#25
post #2

Reverse engineering a file format or protocol is almost a rite of passage for programmers, it is incredibly fun and rewarding, something I'd recommend for all medium/senior programmers get into at least once. A few years ago I was using LiDAR scanners from a manufacturer that didn't provide a linux driver, only windows - the way it worked is that you programmed the firmware to fire UDP packets at a specified IP and p…

> is almost a rite of passage for programmers, it is incredibly fun and rewarding, Only when you are doing it for yourself or when it's a known undertaking. It can be very frustrating when you are integrating with some hardware and you are 99% complete and you've told everyone you are ready to ship and the last 1% is a surprise reverse protocol engineering project.

Lesson is to not say it's ready before it's ready.

Re: Parsing an Undocumented File Format

#27
Brings back memories of a similar task I have with importing MS Access files (the MS Access file format is undocumented).

I am trying to parse the MS Access files using NodeJS/Javascript. I last tried about 3 years ago and it was really tough going, so there is a lot of trial and error. I am able to parse some basic MS Access files, but need to figure out a way to get the whole database more reliably. My effort was here:

https://github.com/yazz/noaccess

Re: Parsing an Undocumented File Format

#30
My experience with parsing undocumented binary formats is with Skia's skp files. Unfortunately they don’t publish any docs regarding the format. Instead I relied on their source code (which is very convoluted), and in that process I discovered two tools which proved pretty useful:

- Kaitai [1], which takes as input a YAML file and can parse binary files based on it (and even generate parsers).

- ImHex [2], which has a pattern language [3] which allows parsing, and it seems more powerful than what Kaitai offers. I stumbled upon some limitations with it but it was still useful.

[1]: https://kaitai.io/

[2]: https://github.com/WerWolv/ImHex

[3]: https://docs.werwolv.net/pattern-language/

Post reply on HN