Help Me Understand This Binary File Format

Question

I am attempting to write a small utility to produce a binary file that will mimic the one produced by another closed application. I've used hex editors to decrypt the format by I'm stuck trying to understand what the format/encoding is so that I can produce it using C++ or C#.

The file starts with the first four bytes: 01 00 followed by FF FE. My understanding is that the file begins with SOH followed by the byte order mark for little endian. After these four bytes, the program appears to write BSTR's for each of the string fields from the app's GUI.

Using C#, I have produced a unicode file that starts with FF FE, but I'm not sure how to insert the SOH character first.

I would be forever grateful if someone could offer insight to the file format or encoding and why the file starts with the SOH character.

Thank you in advance.

Answer 1

Reverse engineering a binary file format can be a challenging task. On the surface, I don't recognize this as an obvious, well-known file format ... but there are thousands out there, so who knows.

Legal issues aside, I would suggest you look at some of the following resources that talk about approaches to such an endeavor:

• How To Crack a Binary File Format
• Tools to Reverse Engineer Binary Files
• Basics of Reverse Engineering File Formats
• File Format Reverse Engineering