[help] Decoding file formats

[faceofdevil]

Hello, I'm working on decoding some .dat files that this game client runs. And I cant seem to find many tuts on decoding file formats. The only suggestion I can come up with is debugging the client and programming the data like the client does to read the .dat files.

this is the only thing i came up with off the top of my head but i believe it wont work..

unsigned char GetCharVal( char mychar )
{
	switch( mychar )
	{
		case '0':	return 0;
		case '1':	return 1;
		case '2':	return 2;
		case '3':	return 3;
		case '4':	return 4;
		case '5':	return 5;
		case '6':	return 6;
		case '7':	return 7;
		case '8':	return 8;
		case '9':	return 9;
		case 'a':	return 10;
		case 'b':	return 11;
		case 'c':	return 12;
		case 'd':	return 13;
		case 'e':	return 14;
		case 'f':	return 15;
		case 'A':	return 10;
		case 'B':	return 11;
		case 'C':	return 12;
		case 'D':	return 13;
		case 'E':	return 14;
		case 'F':	return 15;
	}
	return 0;
}
// MY Decoded class...
void DecodeBinary( char* encoded, unsigned char* data )
{
	unsigned curbit = 0;
	for( unsigned i = 0; i < (unsigned)strlen(encoded); i+=2 )
	{
		data[curbit] = GetCharVal( encoded[i] ) << 4;
		data[curbit] += GetCharVal( encoded[i+1] );
		curbit++;
	}
}

Of course i still need to add in the function that would convert this to a txt file or whatever file format I want.

So what suggestions do you have on reverse engineering file formats. (DECODE and ENCODE)....

[VvITylerIvV]

decrypt > right click > open with notepad


you can view the code in notepad but the file is encrypted, so unlock? the encryption and open with notepad

[faceofdevil]

I'm guessing you've never worked with file formats yet. Opening with notepad wont solve the issue with being able to read the data thats inside. Some data once decrypted has to be converted to say jpeg or whatever else format it is.

[VvITylerIvV]

I'm guessing you've never worked with file formats yet. Opening with notepad wont solve the issue with being able to read the data thats inside. Some data once decrypted has to be converted to say jpeg or whatever else format it is.

o, well my friend has made JPEG pictures via notepad, I'm not sure how but he says he has. Anyways, I understand that now and no, I haven't worked with file formats...

[Kallisti]

Im pretty sure nobody opened dat files

[Hell_Demon]

why not use atoi or whatever the function was to convert from text to int?

[faceofdevil]

Not really what I was asking for. More of the question how does one proceed to reverse engineer a file type. That is encrypted so that data can be read from it. The only few ways i know is with a hex editor or by debugging the calls in the (.exe) and reverse them that way.

Any suggestions one might have?

[-Raz0r-]

The first thing I'd do is try and identify the file 'header', and then search for a pattern within the file.

If I were to export, say, some path-finding data from my file, I'd want to know how to read it back in.
I'd write out the header, containing how many nodes there are in the level, etc, then the data would come straight after it.
This way I could safely read it back in without having to hack in checks for how many nodes were written out. (A good reference for file headers in games is maybe the Q3 BSP file format)
Then for the pattern, I'd assuming it would write out an array (node table) of type T (node data), so it might look like 'float float float unsigned int unsigned char' per node.

Hopefully this helps. I can't really do more without the file and game in question.
Good luck!

EDIT: And of-course using a disassembler/debugger on the function that reads in/writes out the file could give you some useful information
It also might be worth practising on your own file reading/writing test application so you know what to look for (This way you'll have source code to compare to)

[freedompeace]

You need to know the file format architecture, in order to create an algorithm that uses the algorithm (aka. rule) to encode or decode the your data.

For example, the BMP (bitmap image) file format is as follows:

Byte	Nr	Value
1-2	 66 77	Always BM
3-6	 X X X X	Filesize
7-10	 0 0 0 0	Always 0
11-14	 X X X X	Offset to pixeldata
15-18	 40 0 0 0	Always 40
19-22	 X X X X	Image width in pixels
23-26	 X X X X	Image height in pixels
27-28	 1 0	Always 1
29-32	 24 0 0 0	Bits per pixel
33-36	 0 0 0 0	Compression, usually 0
37-53	 4x(0 0 0 0)	No longer used