How to analyze binary file?

Question

I have a binary file. I don't know how it's formatted, I only know it comes from a delphi code.

Does it exist any way to analyze a binary file?

Does it exist any "pattern" to analyze and deserialize the binary content of a file with unknown format?

Answer 1

Try to open it in a hex editor and analyse.

Answer 2

If the data represents serialized Delphi objects, you should start reading about the Delphi serialization process. If that's the case, I think your best bet would be to load it using Delphi and continue your analysis from the IDE. Some informations about Delphi serialization can be found here.

EDIT: if the file does contain serialized delphi objects, then you should write a small delphi program that loads it, and "convert" the data yourself to something neutral, like xml. If you manage to do this, you should check and see if delphi supports serializing to xml. Then, you could access those objects from any language.

Answer 3

Do you know the program that uses it? If so you can hook that programs write to file function and get an idea of what data its writing, the size of the data and where.

More Info: http://www.codeproject.com/KB/DLL/Win32APIHooking_Trouble.aspx

Answer 4

I've developed Hexinator (Window & Linux) and Synalyze It! (macOS) exactly for this purpose. These applications allow you to see the binary files like in other hex editors but additionally you can create a "grammar" with the specifics of a binary file format. The grammar contains all the building blocks and is used to parse the file automatically.

Thus you can keep the knowledge you gain in the analysis and apply it to multiple files simultaneously. You can also color-code the bits and pieces of file formats for a quick overview in the hex editor. The parsing results are displayed in a tree view where you can also modify the files easily (applying endianness et cetera).

Answer 5

If file does not give a meaningful answer, you may want to try TRiD by Marco Pontello to determine whether your data is stored in a known format.

Answer 6

Try these:

1. Deserialize data: analyze how it's compiled your exe (try File Analyzer). Try to deserialize the binary data with the language discovered. Then serialize it in a xml format (language-indipendent) that every programming language can understand
2. Analyze the binary data: try to save various versions of the file with little variation and use a diff program to analyze the meaning of every bit with an hex editor. Use it in conjunction with binary hacking techniques (like How to crack a Binary File Format by Frans Faase)
3. Reverse Engineer the application: try getting code using reverse engineering tools for the programming language used for build the app (found with File Analyzer). Otherwise use disassembler analysis tool like IDA Pro Disassembler