SlideShare ist ein Scribd-Unternehmen logo

Re-lab project. Formats reverse engineering: tools and results

L

Insight on re-lab's reverse engineering tools and their usage to implement/improve support for proprietary file formats in your program. Progress report on latest achievements.

Re-lab project. Formats reverse engineering: tools and results

L

Insight on re-lab's reverse engineering tools and their usage to implement/improve support for proprietary file formats in your program. Progress report on latest achievements.

Re-lab project. Formats reverse engineering: tools and results

1 von 15
Downloaden Sie, um offline zu lesen
RE-LAB Project
A little shy joint efforts project of the GIMP.RU and Giadram Inc.



            Reverse-engineering of proprietary file formats




      Alexandre Prokoudine & Valek Filippov
TOOOOLZ
                                    “I'm not a programmer”



       OLE Toy                             colupatr


               https://gitorious.org/re-lab/

  abr_struct
                                               matcap
                           exp
OLE Toy
Started as a tool to research MS Publisher files

Mutated into a little monster who digested its predecessors:
mfview, cdrvu, fhstruct, vsdump/vsdviewer etc.


“Supports”:

               WMF        SVM        CMX      CDR        CPL
      PPT           XLS     VBA              FH WLD
                                    EMF+
  VSD       EMF                                          CDW
                     DOC          CFB      “Escher”
              CLP           ICC                    ZIP
    PUB              MDB                QPW
OLE Toy
OLE Toy features
●   Search for ASCII, Unicode string or Hex value

●   Copy tree path, go to leaf by path

●   Scroll hexdump to addr (abs or +/-)

●   Search for leaf (with ASCII/Unicode/Hex)

●   Collect «dictionaries» for CDR, FH

●   Specific searches for XLS and CDR

●   Hints on selected bytes

●   Parse some formats at selected position

Más contenido relacionado

Ähnlich wie Re-lab project. Formats reverse engineering: tools and results

SD, a P2P bug tracking system
SD, a P2P bug tracking systemSD, a P2P bug tracking system
SD, a P2P bug tracking systemJesse Vincent
 
Jslab rssh: JS as language platform
Jslab rssh:  JS as language platformJslab rssh:  JS as language platform
Jslab rssh: JS as language platformRuslan Shevchenko
 
JSLab.Руслан Шевченко."JavaScript как платформа компиляции"
JSLab.Руслан Шевченко."JavaScript как платформа компиляции"JSLab.Руслан Шевченко."JavaScript как платформа компиляции"
JSLab.Руслан Шевченко."JavaScript как платформа компиляции"GeeksLab Odessa
 
Exciting JavaScript - Part II
Exciting JavaScript - Part IIExciting JavaScript - Part II
Exciting JavaScript - Part IIEugene Lazutkin
 
Minko stage3d 20130222
Minko stage3d 20130222Minko stage3d 20130222
Minko stage3d 20130222Minko3D
 
SE 20016 - programming languages landscape.
SE 20016 - programming languages landscape.SE 20016 - programming languages landscape.
SE 20016 - programming languages landscape.Ruslan Shevchenko
 
Scalding big ADta
Scalding big ADtaScalding big ADta
Scalding big ADtab0ris_1
 
Crystal internals (part 1)
Crystal internals (part 1)Crystal internals (part 1)
Crystal internals (part 1)Ary Borenszweig
 
Crystal internals (part 1)
Crystal internals (part 1)Crystal internals (part 1)
Crystal internals (part 1)Ary Borenszweig
 
Crystal internals (part 1)
Crystal internals (part 1)Crystal internals (part 1)
Crystal internals (part 1)Crystal Language
 
Specialized Compiler for Hash Cracking
Specialized Compiler for Hash CrackingSpecialized Compiler for Hash Cracking
Specialized Compiler for Hash CrackingPositive Hack Days
 
Gdc 14 bringing unreal engine 4 to open_gl
Gdc 14 bringing unreal engine 4 to open_glGdc 14 bringing unreal engine 4 to open_gl
Gdc 14 bringing unreal engine 4 to open_glchangehee lee
 
Pragmatic Model Driven Development using openArchitectureWare
Pragmatic Model Driven Development using openArchitectureWarePragmatic Model Driven Development using openArchitectureWare
Pragmatic Model Driven Development using openArchitectureWareMichael Vorburger
 
Amazing KDE (K Desktop Environment)
Amazing KDE (K Desktop Environment)Amazing KDE (K Desktop Environment)
Amazing KDE (K Desktop Environment)anandvaidya
 
Linux and Open Source in Math, Science and Engineering
Linux and Open Source in Math, Science and EngineeringLinux and Open Source in Math, Science and Engineering
Linux and Open Source in Math, Science and EngineeringPDE1D
 
2013.02.02 지앤선 테크니컬 세미나 - Xcode를 활용한 디버깅 팁(OSXDEV)
2013.02.02 지앤선 테크니컬 세미나 - Xcode를 활용한 디버깅 팁(OSXDEV)2013.02.02 지앤선 테크니컬 세미나 - Xcode를 활용한 디버깅 팁(OSXDEV)
2013.02.02 지앤선 테크니컬 세미나 - Xcode를 활용한 디버깅 팁(OSXDEV)JiandSon
 
20150716 introduction to apache spark v3
20150716 introduction to apache spark v3 20150716 introduction to apache spark v3
20150716 introduction to apache spark v3 Andrey Vykhodtsev
 

Ähnlich wie Re-lab project. Formats reverse engineering: tools and results (20)

SD, a P2P bug tracking system
SD, a P2P bug tracking systemSD, a P2P bug tracking system
SD, a P2P bug tracking system
 
Jslab rssh: JS as language platform
Jslab rssh:  JS as language platformJslab rssh:  JS as language platform
Jslab rssh: JS as language platform
 
JSLab.Руслан Шевченко."JavaScript как платформа компиляции"
JSLab.Руслан Шевченко."JavaScript как платформа компиляции"JSLab.Руслан Шевченко."JavaScript как платформа компиляции"
JSLab.Руслан Шевченко."JavaScript как платформа компиляции"
 
Exciting JavaScript - Part II
Exciting JavaScript - Part IIExciting JavaScript - Part II
Exciting JavaScript - Part II
 
Os Lattner
Os LattnerOs Lattner
Os Lattner
 
Minko stage3d 20130222
Minko stage3d 20130222Minko stage3d 20130222
Minko stage3d 20130222
 
SE 20016 - programming languages landscape.
SE 20016 - programming languages landscape.SE 20016 - programming languages landscape.
SE 20016 - programming languages landscape.
 
Scalding big ADta
Scalding big ADtaScalding big ADta
Scalding big ADta
 
Crystal internals (part 1)
Crystal internals (part 1)Crystal internals (part 1)
Crystal internals (part 1)
 
Crystal internals (part 1)
Crystal internals (part 1)Crystal internals (part 1)
Crystal internals (part 1)
 
Crystal internals (part 1)
Crystal internals (part 1)Crystal internals (part 1)
Crystal internals (part 1)
 
Couchdb Nosql
Couchdb NosqlCouchdb Nosql
Couchdb Nosql
 
Specialized Compiler for Hash Cracking
Specialized Compiler for Hash CrackingSpecialized Compiler for Hash Cracking
Specialized Compiler for Hash Cracking
 
Gdc 14 bringing unreal engine 4 to open_gl
Gdc 14 bringing unreal engine 4 to open_glGdc 14 bringing unreal engine 4 to open_gl
Gdc 14 bringing unreal engine 4 to open_gl
 
A
AA
A
 
Pragmatic Model Driven Development using openArchitectureWare
Pragmatic Model Driven Development using openArchitectureWarePragmatic Model Driven Development using openArchitectureWare
Pragmatic Model Driven Development using openArchitectureWare
 
Amazing KDE (K Desktop Environment)
Amazing KDE (K Desktop Environment)Amazing KDE (K Desktop Environment)
Amazing KDE (K Desktop Environment)
 
Linux and Open Source in Math, Science and Engineering
Linux and Open Source in Math, Science and EngineeringLinux and Open Source in Math, Science and Engineering
Linux and Open Source in Math, Science and Engineering
 
2013.02.02 지앤선 테크니컬 세미나 - Xcode를 활용한 디버깅 팁(OSXDEV)
2013.02.02 지앤선 테크니컬 세미나 - Xcode를 활용한 디버깅 팁(OSXDEV)2013.02.02 지앤선 테크니컬 세미나 - Xcode를 활용한 디버깅 팁(OSXDEV)
2013.02.02 지앤선 테크니컬 세미나 - Xcode를 활용한 디버깅 팁(OSXDEV)
 
20150716 introduction to apache spark v3
20150716 introduction to apache spark v3 20150716 introduction to apache spark v3
20150716 introduction to apache spark v3
 

Último

AMS_00 FTBE_0126_2024. .pptx
AMS_00 FTBE_0126_2024.             .pptxAMS_00 FTBE_0126_2024.             .pptx
AMS_00 FTBE_0126_2024. .pptxFinTech Belgium
 
Intra-body nano-network - Brief summary by Mik Andersen
Intra-body nano-network - Brief summary by Mik AndersenIntra-body nano-network - Brief summary by Mik Andersen
Intra-body nano-network - Brief summary by Mik Andersenkrcdnsqxswifzizvzs
 
Go Programming by Example_ Nho Vĩnh Share.pdf
Go Programming by Example_ Nho Vĩnh Share.pdfGo Programming by Example_ Nho Vĩnh Share.pdf
Go Programming by Example_ Nho Vĩnh Share.pdfNho Vĩnh
 
Embracing Disruption: Adding a Bit of Chaos to Help You Grow
Embracing Disruption: Adding a Bit of Chaos to Help You GrowEmbracing Disruption: Adding a Bit of Chaos to Help You Grow
Embracing Disruption: Adding a Bit of Chaos to Help You GrowPaul Balogh
 
research powerpoint on the science fiction tv series manifest.
research powerpoint on the science fiction tv series manifest.research powerpoint on the science fiction tv series manifest.
research powerpoint on the science fiction tv series manifest.17pmat213
 
web accessibility: why should I care? - with notes
web accessibility: why should I care? - with notesweb accessibility: why should I care? - with notes
web accessibility: why should I care? - with notesMana Sugiyoshi
 
GM Series Detailed service manual 6864115B62-C.pdf
GM Series Detailed service manual 6864115B62-C.pdfGM Series Detailed service manual 6864115B62-C.pdf
GM Series Detailed service manual 6864115B62-C.pdfFajarHarianto5
 
Developer Special: How to Prepare Applications for Notes 64-bit Clients
Developer Special: How to Prepare Applications for Notes 64-bit ClientsDeveloper Special: How to Prepare Applications for Notes 64-bit Clients
Developer Special: How to Prepare Applications for Notes 64-bit Clientspanagenda
 
Smartphone-Based Teaching System for Neonate Soothing Motions
Smartphone-Based Teaching System for Neonate Soothing MotionsSmartphone-Based Teaching System for Neonate Soothing Motions
Smartphone-Based Teaching System for Neonate Soothing Motionssugiuralab
 
Onboarding slides for UiPath Meetup - Welcome
Onboarding slides for UiPath Meetup - WelcomeOnboarding slides for UiPath Meetup - Welcome
Onboarding slides for UiPath Meetup - WelcomeAndreeaTom
 
Dataliva Company Brief 2024
Dataliva Company Brief 2024Dataliva Company Brief 2024
Dataliva Company Brief 2024Mustafa Kuğu
 
HHUG-Jan-2024-Can AI help meet your 2024 challenges_.pptx
HHUG-Jan-2024-Can AI help meet your 2024 challenges_.pptxHHUG-Jan-2024-Can AI help meet your 2024 challenges_.pptx
HHUG-Jan-2024-Can AI help meet your 2024 challenges_.pptxHampshireHUG
 
AI Literacy -Undergrad_Graduate Course
AI Literacy -Undergrad_Graduate CourseAI Literacy -Undergrad_Graduate Course
AI Literacy -Undergrad_Graduate Coursetadimalla sri yeswanth
 
The Top Outages of 2023: Analysis and Takeaways
The Top Outages of 2023: Analysis and TakeawaysThe Top Outages of 2023: Analysis and Takeaways
The Top Outages of 2023: Analysis and TakeawaysThousandEyes
 
K8 Meetup_ K8s secrets management best practices (Git Guardian).pdf
K8 Meetup_ K8s secrets management best practices (Git Guardian).pdfK8 Meetup_ K8s secrets management best practices (Git Guardian).pdf
K8 Meetup_ K8s secrets management best practices (Git Guardian).pdfMichaelOLeary82
 
MySQL for Python_ Nho Vĩnh Share.pdf
MySQL for Python_ Nho Vĩnh Share.pdfMySQL for Python_ Nho Vĩnh Share.pdf
MySQL for Python_ Nho Vĩnh Share.pdfNho Vĩnh
 
WEB 3.0 & IDENTITY: THE NEW ERA OF DIGITAL IDENTITY
WEB 3.0 & IDENTITY: THE NEW ERA OF DIGITAL IDENTITYWEB 3.0 & IDENTITY: THE NEW ERA OF DIGITAL IDENTITY
WEB 3.0 & IDENTITY: THE NEW ERA OF DIGITAL IDENTITYLiveplex
 
Stage 1 Tradecraft
Stage 1 TradecraftStage 1 Tradecraft
Stage 1 Tradecraftmatt806068
 

Último (20)

AMS_00 FTBE_0126_2024. .pptx
AMS_00 FTBE_0126_2024.             .pptxAMS_00 FTBE_0126_2024.             .pptx
AMS_00 FTBE_0126_2024. .pptx
 
Intra-body nano-network - Brief summary by Mik Andersen
Intra-body nano-network - Brief summary by Mik AndersenIntra-body nano-network - Brief summary by Mik Andersen
Intra-body nano-network - Brief summary by Mik Andersen
 
Go Programming by Example_ Nho Vĩnh Share.pdf
Go Programming by Example_ Nho Vĩnh Share.pdfGo Programming by Example_ Nho Vĩnh Share.pdf
Go Programming by Example_ Nho Vĩnh Share.pdf
 
Embracing Disruption: Adding a Bit of Chaos to Help You Grow
Embracing Disruption: Adding a Bit of Chaos to Help You GrowEmbracing Disruption: Adding a Bit of Chaos to Help You Grow
Embracing Disruption: Adding a Bit of Chaos to Help You Grow
 
research powerpoint on the science fiction tv series manifest.
research powerpoint on the science fiction tv series manifest.research powerpoint on the science fiction tv series manifest.
research powerpoint on the science fiction tv series manifest.
 
web accessibility: why should I care? - with notes
web accessibility: why should I care? - with notesweb accessibility: why should I care? - with notes
web accessibility: why should I care? - with notes
 
GM Series Detailed service manual 6864115B62-C.pdf
GM Series Detailed service manual 6864115B62-C.pdfGM Series Detailed service manual 6864115B62-C.pdf
GM Series Detailed service manual 6864115B62-C.pdf
 
Developer Special: How to Prepare Applications for Notes 64-bit Clients
Developer Special: How to Prepare Applications for Notes 64-bit ClientsDeveloper Special: How to Prepare Applications for Notes 64-bit Clients
Developer Special: How to Prepare Applications for Notes 64-bit Clients
 
Smartphone-Based Teaching System for Neonate Soothing Motions
Smartphone-Based Teaching System for Neonate Soothing MotionsSmartphone-Based Teaching System for Neonate Soothing Motions
Smartphone-Based Teaching System for Neonate Soothing Motions
 
Onboarding slides for UiPath Meetup - Welcome
Onboarding slides for UiPath Meetup - WelcomeOnboarding slides for UiPath Meetup - Welcome
Onboarding slides for UiPath Meetup - Welcome
 
The Ethics of AI
The Ethics of AIThe Ethics of AI
The Ethics of AI
 
Dataliva Company Brief 2024
Dataliva Company Brief 2024Dataliva Company Brief 2024
Dataliva Company Brief 2024
 
HHUG-Jan-2024-Can AI help meet your 2024 challenges_.pptx
HHUG-Jan-2024-Can AI help meet your 2024 challenges_.pptxHHUG-Jan-2024-Can AI help meet your 2024 challenges_.pptx
HHUG-Jan-2024-Can AI help meet your 2024 challenges_.pptx
 
Bespoke Balajisms
Bespoke BalajismsBespoke Balajisms
Bespoke Balajisms
 
AI Literacy -Undergrad_Graduate Course
AI Literacy -Undergrad_Graduate CourseAI Literacy -Undergrad_Graduate Course
AI Literacy -Undergrad_Graduate Course
 
The Top Outages of 2023: Analysis and Takeaways
The Top Outages of 2023: Analysis and TakeawaysThe Top Outages of 2023: Analysis and Takeaways
The Top Outages of 2023: Analysis and Takeaways
 
K8 Meetup_ K8s secrets management best practices (Git Guardian).pdf
K8 Meetup_ K8s secrets management best practices (Git Guardian).pdfK8 Meetup_ K8s secrets management best practices (Git Guardian).pdf
K8 Meetup_ K8s secrets management best practices (Git Guardian).pdf
 
MySQL for Python_ Nho Vĩnh Share.pdf
MySQL for Python_ Nho Vĩnh Share.pdfMySQL for Python_ Nho Vĩnh Share.pdf
MySQL for Python_ Nho Vĩnh Share.pdf
 
WEB 3.0 & IDENTITY: THE NEW ERA OF DIGITAL IDENTITY
WEB 3.0 & IDENTITY: THE NEW ERA OF DIGITAL IDENTITYWEB 3.0 & IDENTITY: THE NEW ERA OF DIGITAL IDENTITY
WEB 3.0 & IDENTITY: THE NEW ERA OF DIGITAL IDENTITY
 
Stage 1 Tradecraft
Stage 1 TradecraftStage 1 Tradecraft
Stage 1 Tradecraft
 

Re-lab project. Formats reverse engineering: tools and results

  • 2. A little shy joint efforts project of the GIMP.RU and Giadram Inc. Reverse-engineering of proprietary file formats Alexandre Prokoudine & Valek Filippov
  • 3. TOOOOLZ “I'm not a programmer” OLE Toy colupatr https://gitorious.org/re-lab/ abr_struct matcap exp
  • 4. OLE Toy Started as a tool to research MS Publisher files Mutated into a little monster who digested its predecessors: mfview, cdrvu, fhstruct, vsdump/vsdviewer etc. “Supports”: WMF SVM CMX CDR CPL PPT XLS VBA FH WLD EMF+ VSD EMF CDW DOC CFB “Escher” CLP ICC ZIP PUB MDB QPW
  • 6. OLE Toy features ● Search for ASCII, Unicode string or Hex value ● Copy tree path, go to leaf by path ● Scroll hexdump to addr (abs or +/-) ● Search for leaf (with ASCII/Unicode/Hex) ● Collect «dictionaries» for CDR, FH ● Specific searches for XLS and CDR ● Hints on selected bytes ● Parse some formats at selected position
  • 7. colupatr Hexviewer on ster^W LSD Made to reduce r.engineering pains with normal hexviewers: ● Variable lengths of lines ● Comments ● CLI commands to change lines ● Parse hexdump from clipboard
  • 9. YIELD Photoshop ABR/GRD specs (Krita, SwatchBooker) MS Publisher (98,2k-2k7) (LibreOffice GSoC 2012 Project) Troubleshooting of XLS/WMF/EMF/CLP-related issues in LibreOffice, Gnumeric
  • 10. YIELD Embroidery file formats
  • 11. YIELD MS Visio VSD specs LibreOffice GSoC 2011: libvisio
  • 12. YIELD Corel DRAW CDR LibreOffice libcdr
  • 13. YIELD Aldus/Macromedia FH fh2svg PoC