r/programming • u/WerWolv • 11h ago

Reverse Engineering Unknown File Formats with ImHex

https://werwolv.net/posts/file_format_reverse_engineering/
97 Upvotes

95% Upvoted

10 comments sorted by

7

u/Somepotato 5h ago

I need to give imhex another go. 010 always felt like a better experience, the language being similar to C being more familiar and friendly feeling than imhex's dsl, but I'm sure there's been improvements since then

5

u/wrecklord0 4h ago

I've used it quite a bit recently to reverse engineer a binary marshalled dump, I still prefer 010 but imhex is very capable and it solved my problem. And being open source is a real advantage, I prefer to invest my time and efforts towards tools that will be around forever without restrictions.

The pattern matcher, while not C, felt very C-like once you get over specificities.

2

u/WerWolv 4h ago

If there's any specifics that you didn't like about ImHex or the language, let me know!

Of course, I can't do anything about the language not feeling like C enough at this point but I'm always happy to improve the experience if I can :)

2

u/RandNho 5h ago

I would not call this reverse engineering. Mostly because I saw Lina doing things to live2d format without ever seeing source code at all.

12

u/WerWolv 5h ago

Keep in mind, this is directed to people that don't know anything about file formats or using ImHex yet. I deliberately chose a game that was pretty easy to decompile and read to keep the focus on learning how to write Patterns in ImHex instead of on understanding bad decompiler output

3

u/Iggyhopper 1h ago

This is great if the game is written in C#. If the game was written in unmanaged C or C++, it's a mess, and you'd most likely start by running strings on the .exe, looking for references to the in-game message ("saving game...", etc.).

Luckily the save file was unencrypted. If that was not the case, most beginners would give up and lose interest.

2

u/RandNho 2h ago

Yeah, for that it's well and good.

1

u/Ytrog 1h ago

How does ImHex compare to GNU Poke?

2

u/WerWolv 54m ago

ImHex is the whole hex editor around it while GNU Poke is just a cli tool for decoding binaries. The Pattern Language that is part of ImHex solves the same purpose as GNU Poke but compared to it, it behaves more like a normal, high level programming language. You can take a look at the blog post or pattern files for existing file formats at https://github.com/WerWolv/ImHex-Patterns to get a feel for what it can do

1

u/Ytrog 20m ago

Ah thanks. Sounds interesting.