6 ms·
Reverse Engineering Unknown File Formats with ImHex
- hmartin 1mo agoSpoiler: half the time, that unknown file format is a zip containing a sqlite db
- butvacuum 1mo agofor games its more often .net BinarySerializer.
- userbinator 1mo agoThe older the system/the more changes it's had, especially if it's "enterprise software", the more insane things tend to be; in one memorable case, it was a .zip containing JSON, which then contained base64-encoded XML, wrapping another base64-encoded .zip containing more XML, and in that XML was base16-encoded ASN.1 PER with the actual payload (encoded in a proprietary format). I won't disclose specifics, but perhaps someone may recognise that from its description; suffice to say the industry that was related to started using computers in the days of mainframes and punched cards.
- orphea 1mo agoUhm... a (g)zip - yes, but a sqlitedb inside - no, not that often, in my experience.
- someperson 1mo agoDamn a video game spoiler warning, guess I can't read the rest of the article. I may feed it into an LLM to strip out the spoilers actually
- monster_truck 1mo agospoilers aren't real, it's like declaring you're immune to propaganda only it actually works
- xboxnolifes 1mo agowhat
- subscribed 1mo agoCome again?
- odo1242 1mo agoUnironically, this is a browser extension I wanna make lol
- jonhohle 1mo agoI’ve had a lot of luck with ImHex looking at various binary formats and even using it to aid in writing some file magic. It would be really nice to be able to roundtrip C headers with it. The syntax is close, but often I older formats there is a 1:1 mapping with C structs that doesn’t quite match the imhex syntax.
- Charon77 1mo agoI use both ImHex and Kaitai struct, give it a try maybe you'll like it
- Lucasoato 1mo agoI’m going to try that on the newest outlook binary format used to store the emails locally... why couldn’t they stick to the plain simple sqlite?
- ChadNauseam 1mo agoActually one of the worst and most insane file formats of all time. I partially reverse engineered it a while ago. My parser is super janky and I can't share it, but I pasted the code into claude and had it summarize it: https://gist.github.com/anchpop/a14325cc451b04a5bf78c476ac20358c https://gist.github.com/anchpop/a14325cc451b04a5bf78c476ac20...
- nijave 1mo agoLLM and Google are suggesting it might be this https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxmsg/b046868c-9fbf-41ae-9ffb-8de2bd4eec82 https://learn.microsoft.com/en-us/openspecs/exchange_server_... A lot of Microsoft formats are open standards... Created by and only used by Microsoft...
- kstrauser 1mo agoStory time: I worked the night shift at a motel during college. "Bored to tears" was an understatement. I was poking around the front desk computer system one night, as one does, and found its data file. Lacking anything else to do, I wrote a little hex dumper in BASIC so I could explore the file. The first thing I noted was that customer names were spaced exactly N bytes apart. Oooh, fixed records! Then I spent the next week or so reverse engineering the DB file format. I'd twiddle a field in a random customer record then look at their record in the hex dump to see what changed, then update my notes. Eventually I wrote another little BASIC program to run analytics, like which customers spent the most with us, and auto-fix mistyped names ("This says 'Bb Jones'. Did you mean 'Bob Jones'?") by writing directly to the file. I got a pretty sweet little bonus for my hackery.
- inventor7777 1mo agoHow did your program suggest auto-fixed names? A manually entered list of common names, or did it go by previous records? BASIC is over 40 years older than me, and I have never played with it, thus my question :-)
- kstrauser 1mo agoBASIC, while not a language I'd use for any reason today, is Turing complete. You can write any program in BASIC that you could write in Rust. Of course, you'd mainly do that for the same reason you'd write something in, say, Brainfuck: mainly to see if you can. But when that's all we had, we could get pretty creative with it. It went by previous records. I'd read something about Levenshtein distance somewhere, and implemented my own half-assed version of it that was surely slower, more complicated, and less accurate. It still got the job done, though. I showed it to a coworker, who described it as "magic", and I floated on that compliment for a long time after. I was pretty proud of it, although the resulting QBasic code was pretty awful in retrospect. It was probably my first commercial-scale project, built with the software that happened to ship with the computer.
- inventor7777 1mo ago
- thataccount 1mo agoIf only it were BlackIce, it would be perfect.
- polishdude20 1mo agoI've always wondered how something like an Autodesk Inventor sldprt file was formatted so that I could write a program to manipulate those files. I assumed it was proprietary and left it at that. A few years later, I saw that Onshape allows importing sldprt files into their system and I wonder how they were able to provide that ability without some proprietary knowledge transferred
- xiej 1mo agoI've been reverse engineering some old Minecraft Legacy Console Edition save files with ImHex and the pattern templates work pretty well, though debugging is sometimes painful (e.g. reading runtime-sized arrays can just overflow the file and error without showing previously decoded structs). Great tool though. LLMs are, of course, scarily good at reverse engineering and spotting patterns that take me way too much effort to spot.
- yapfrog 1mo agoI tried to do a similar thing last year to datamine a gacha game's assets and somehow did it without knowing the existence of tools like IDA/Ghidra. They're using a custom db format that was XORed with a key. Iirc it was a bizarre format, it's actually an archive where each column is a file containing all the rows of that column. So a table is just a folder full of these files. Maybe it's a common thing idk. I got a partially working XOR key so I used ImHex to look at the partially decrypted db file and manually looked at the decrypted hex values to "correct" them. I wish I read something like this article at that time!
- butvacuum 1mo agolike apache parquet?
- max979 1mo agoImHex makes tackling proprietary formats so much less painful. Seriously a lifesaver for quickly mapping out structures.
- issung 1mo agoI finally dipped into using ImHex when doing some reversing of the PS2 memory card format for https://ps2iodb.com https://ps2iodb.com. The program is so good, and has enough of a reputation that I knew to reach for it even though I know nothing about reversing, and that was 3-4 years ago now! Also shoutout to the awesome GUI library is uses; https://github.com/ocornut/imgui https://github.com/ocornut/imgui
- pwdisswordfishq 1mo agoA few attempts using it over the years has usually resulted in frustration and giving up after determining it to be a non-starter. Past attempts to use after downloading and running it natively have revealed it to be very crashy. Trying the browser-based demo today and doing the first thing that comes to mind (loading a ZIP) produces an error that the pattern language interpreter can't resolve the "import std.mem" line, for which there seem to be no hits on Google. The poor font rendering is also not ideal, nor the fact that the "immediate mode" approach to the GUI (perversely favored by the kinds who tend to identify with software craftsmanship, including ostensible focus on performance, including opposition to bloat and unnecessary resource use) also means fans are constantly spinning up. Running these kinds of apps is basically the same as running a game...
- issung 1mo agoI... can't say I experienced any of these issues. I also had no idea there was a browser demo. Just opened it up and opened a zip with no issues. Are you using some obscure OS & experimental browser combo?
- basil_io 1mo ago[dead]
- truekonrads 1mo agoMy few rules are: 1) What's the entropy? This helps with encrypted/compressed. You probably need to overcome this? 2) What's the context? Apps are developed in context and context suggests formats. Is it C? Then expect structs. Does it need to go over the wire? Expect run-length encodings. Python/JS - JSON/pickle. 3) There are broadly speaking only a few ways you can read data back into memory: fixed layout, run-length encoding, terminators. A great case-study is ASN.1, once you've built an ASN.1 parser by hand no file format will ever daunt you.
- isaacbot 1mo ago[flagged]
- tyffanypastecf 1mo ago[dead]
- Noxwizard 1mo agoI'm always on the lookout for a good hex editor. I've tried ImHex a few times and it doesn't quite fit the need I have and I prefer HxD for the simple things. The Pattern Language is pretty neat, I hadn't looked into that before. For the complicated things, it's not always a linear process like in the case of the blog article. Mainly, there's often lots of gaps in my structure until I figure them out. Some tools like ImHex or Kaitai, you can put in placeholder fields between two known objects, but that's kind of annoying. 010 Editor lets you highlight and put colored bookmarks, which kind of works. The workflow I've ended up using for reversing in-memory data structures is to get a hexdump of the memory, take a screenshot and then put it in OneNote. Then I can draw colored boxes or highlight and put annotations off on the side with what things are or notes. If a field is a memory address to another related and unknown structure, I often will then get a short dump of that memory and put a screenshot of it on the same page with an arrow to it. It's pretty kludgy, but I like the freeform nature of it. It's basically a RE notebook, just without any useful RE built-ins. If anyone has ideas or recommendations on better discovery workflows, I'd love to hear them.
- vivzkestrel 1mo ago- stupid question: do you have any ideas how to go about doing this on a .unr file - it comes from a game called splinter cell conviction made in custom unreal 2.5 - I have neither been able to get UE-Explorer or UEViewer to work with it - I can send you the file, I just want to know how to change enemy AI spawn types on it
- NegativeLatency 1mo agoTry an LLM, either to do it directly or to guide your own explorations
- vivzkestrel 1mo agoas a guy who doesnt have experience fiddling with this kinda stuff, what is the step by step process if any to go about figuring out how an unknown file format is actually made of and modifying it? - the post itself quotes "I usually couldn’t really give them a good answer except, “Look at the decompiled code of whatever program reads/writes these files and work backwards from there.” - i dont have the program and that is the real challenge
- subscribed 1mo agoI would start with something like this: "Today's session will be a bit different and very exciting to me. I have this game, Game Name exact version, which I love and I logged hundreds of hours in it, however there's this little detail that bothers me like a pebble in a shoe: (details of the problem here). I think that it's all encoded in the file (file name), but it's binary and I have no idea how to access it :( Could you perhaps guide me how to analyse and "decode" this file so I could later change this behaviour? I don't have any experience with reverse engineering but I'm excited to try. All game files are in /full/path/to/the/game Thanks!" Works for me. Be excited, frame it as a learning opportunity, make sure it's obvious its for your own enjoyment (not for distribution).
- nijave 1mo agoClaude.ai, set to Opus xhigh, attach file, "Try to decode the file format of this save game from Name of Game. Do research if necessary" If the file's too big, you'll probably need to download a harness/local app. If you go local route, make sure you have a backup in case the LLM breaks the file The local route it can also try to poke at the binaries that read/write the file so it would have a bit more to work with going that route
- throneitlol 1mo agoOne trick that saves a lot of time before you write any pattern: generate two saves that differ in exactly one known way (buy one item, then diff), and byte-diff them. The changed offsets are usually the field you care about, and the size of the changed run tells you the width. Doing this a few times gives you a rough field map without guessing at structure. The other thing worth checking early is whether the file is compressed or checksummed. If entropy is flat and high across the whole file it is probably deflate or an encrypted blob, and hex staring will get you nowhere until you unwrap it. And if there is a 4 byte value near the header or footer that changes on every save even when the data is identical, treat it as a CRC or timestamp before assuming it is data. Writing back an edited file that fails the checksum is the classic reason a patched save silently refuses to load.
- shitcoder 1mo agoLove imhex and recognised the author straight away. Used it plenty of times got save file reverse engineering to develop save editors
- cdbattags 1mo agoprotobuf derivatives must be littered throughout tbt to reverse engineering the original PokemonGo rpc
- ta8903 1mo agoI like the idea of ImHex and tried using it for something, but there is some kind of limit to the parsers you write (IIRC it was some kind of memory limit) which feels very short for real, non-toy binary files.
- IChooseY0u 1mo agohttps://github.com/IChooseYou/Reclass https://github.com/IChooseYou/Reclass does this also
- VorpalWay 1mo agoThe DSL (domain specific language) for defining data formats in ImHex seems really cool. I have never seen a language that mixes logic into definitions of data structures quite like that before. It wouldn't at all suit a general purpose compiled programming language (the best you can do there is templates or similar), but here it seems really neat. I haven't looked into it (maybe this exists), but I would love to see this DSL as a library or a code generator, to help with parsing custom binary formats in my own programs. This is much easier for this specific purpose than even parser combinators (which is what I would typically use, e.g. winnow in Rust).
- georgefrowny 1mo agoKaitai Struct is also pretty good and will generate code in several languages.
- VorpalWay 1mo agoInteresting. Though after looking at the examples on their home page and skimming the examples it looks more limited than the imhex format. But that could just be because I don't know this library well enough.
- chicken-stew 1mo agobrew install imhex Error: imhex: Cask 'imhex' has been disabled because it does not pass the macOS Gatekeeper check! It was disabled on 2026-09-01.
- Agentlien 1mo agoOn a related note, how would one go about interpreting a video file using some long lost custom codec?