How to analyze binary file?

Question

I have a binary file. I don't know how it's formatted, I only know it comes from a delphi code.

Does it exist any way to analyze a binary file?

Does it exist any "pattern" to analyze and deserialize the binary content of a file with unknown format?

Answer 1

If you have access to the application that creates the file, you can apply changes to the application, then save the file and see the effects (Keep in mind that numbers are probably stored in little endian):

• First create the file repeatedly. If the files are not binary equal, the current date/time is probably stored in the area where hte differences occur.
• Maybe you want to repeat that with the software running under different environments, to see if OS version etc are stored, but this is rather unusual.
• Next you can try to change single variables and create several files that only differ in the value of this variable. This helps you identify where this variable is stored.
• That way you can also exclude variables that are not stored in the file: If you change them, but the files created are identical, they are not stored.

In order to test the hypotheses you worked out with the steps above, edit one of the files and have the application read it.

If you don't have access to the application itself, I suggest that you forget about it and find another way to solve your problem. There is a very high probability that it will be faster...

Answer 2

For my hobby project I had to reverse engineer some old game files. My approaches were:

• Have a good hex editor.
• Look for readable words in the binary file. Note how their distribution is. If the distance between them is constant you know it is a listing.
• Look for 2-3 consequent zeros. Might indicate an int32 value.
• Some dwords might be pointers into the file.
• Try to identify reoccurring patterns in the file.
• Seeing lots of C0-CF might indicate RLE compressed data.

Answer 3

Get the Delphi application and open it in IDA Pro freeware version, and find where it writes the file, and decode how it writes the file that way.

Unless it's plan text.

Answer 4

Reverse engineering a binary file when you have some idea of what it represents is a very time consuming process. If you have no idea what it is then it will be even harder.

It is possible though, but you have to have a pretty good reason for doing so.

The first step would be to open it up in a hex editor of your choice and see if you can find any English text to point you in the direction of what the file is even supposed to represent. From there, Google "Reverse Engineering binary files", there are much more knowledgeable people than me that have written guides about it.

Answer 5

Unlike traditional hex editors which only display the raw hex bytes of a file, 010 Editor can also parse a file into a hierarchical structure using a Binary Template. The results of running a Binary Template are much easier to understand and edit than using just the raw hex bytes.

http://www.sweetscape.com/010editor/

Answer 6

The unix "file" command is really useful - I don't know if there is anything like it in windows. You run it like this:

file myfile.ext

And it spits out a text description based on the magic numbers and data contained therein.

Probably it is contained within cygwin.