Top
Best
New

Posted by carlos-menezes 2 days ago

Reverse Engineering Unknown File Formats with ImHex(werwolv.net)
149 points | 31 commentspage 2
polishdude20 7 hours ago|
I've always wondered how something like an Autodesk Inventor sldprt file was formatted so that I could write a program to manipulate those files.

I assumed it was proprietary and left it at that.

A few years later, I saw that Onshape allows importing sldprt files into their system and I wonder how they were able to provide that ability without some proprietary knowledge transferred

Lucasoato 7 hours ago||
I’m going to try that on the newest outlook binary format used to store the emails locally... why couldn’t they stick to the plain simple sqlite?
ChadNauseam 6 hours ago|
Actually one of the worst and most insane file formats of all time. I partially reverse engineered it a while ago. My parser is super janky and I can't share it, but I pasted the code into claude and had it summarize it: https://gist.github.com/anchpop/a14325cc451b04a5bf78c476ac20...
max979 5 hours ago||
ImHex makes tackling proprietary formats so much less painful. Seriously a lifesaver for quickly mapping out structures.
thataccount 7 hours ago||
If only it were BlackIce, it would be perfect.
throneitlol 2 hours ago||
One trick that saves a lot of time before you write any pattern: generate two saves that differ in exactly one known way (buy one item, then diff), and byte-diff them. The changed offsets are usually the field you care about, and the size of the changed run tells you the width. Doing this a few times gives you a rough field map without guessing at structure.

The other thing worth checking early is whether the file is compressed or checksummed. If entropy is flat and high across the whole file it is probably deflate or an encrypted blob, and hex staring will get you nowhere until you unwrap it. And if there is a 4 byte value near the header or footer that changes on every save even when the data is identical, treat it as a CRC or timestamp before assuming it is data. Writing back an edited file that fails the checksum is the classic reason a patched save silently refuses to load.

basil_io 4 hours ago||
[dead]
someperson 9 hours ago|
Damn a video game spoiler warning, guess I can't read the rest of the article.

I may feed it into an LLM to strip out the spoilers actually

monster_truck 8 hours ago||
spoilers aren't real, it's like declaring you're immune to propaganda only it actually works
xboxnolifes 5 hours ago||
what
odo1242 6 hours ago||
Unironically, this is a browser extension I wanna make lol