r/programming • u/WerWolv • 2d ago

Reverse Engineering Unknown File Formats with ImHex

https://werwolv.net/posts/file_format_reverse_engineering/
203 Upvotes

96% Upvoted

15 comments sorted by

24

u/Somepotato 2d ago

I need to give imhex another go. 010 always felt like a better experience, the language being similar to C being more familiar and friendly feeling than imhex's dsl, but I'm sure there's been improvements since then

11

u/wrecklord0 2d ago

I've used it quite a bit recently to reverse engineer a binary marshalled dump, I still prefer 010 but imhex is very capable and it solved my problem. And being open source is a real advantage, I prefer to invest my time and efforts towards tools that will be around forever without restrictions.

The pattern matcher, while not C, felt very C-like once you get over specificities.

7

u/WerWolv 2d ago

If there's any specifics that you didn't like about ImHex or the language, let me know!

Of course, I can't do anything about the language not feeling like C enough at this point but I'm always happy to improve the experience if I can :)

1

u/iTrooz_ 1d ago

Please tell us if there's anything that could improve the experience :)

7

u/Ytrog 2d ago

How does ImHex compare to GNU Poke?

14

u/WerWolv 2d ago

ImHex is the whole hex editor around it while GNU Poke is just a cli tool for decoding binaries. The Pattern Language that is part of ImHex solves the same purpose as GNU Poke but compared to it, it behaves more like a normal, high level programming language. You can take a look at the blog post or pattern files for existing file formats at https://github.com/WerWolv/ImHex-Patterns to get a feel for what it can do

1

u/Ytrog 2d ago

Ah thanks. Sounds interesting.

5

u/nelson-f 1d ago

Oh hey it's cool that you're the dev behind ImHex. I remember stumbling across ImHex via GitHub but I have yet to use it because a lot of this goes over my head. I still enjoyed the read though. I also like the overall look/design of your site.

-5

u/RandNho 2d ago

I would not call this reverse engineering. Mostly because I saw Lina doing things to live2d format without ever seeing source code at all.

32

u/WerWolv 2d ago

Keep in mind, this is directed to people that don't know anything about file formats or using ImHex yet. I deliberately chose a game that was pretty easy to decompile and read to keep the focus on learning how to write Patterns in ImHex instead of on understanding bad decompiler output

3

u/RandNho 2d ago

Yeah, for that it's well and good.

6

u/Iggyhopper 2d ago

This is great if the game is written in C#. If the game was written in unmanaged C or C++, it's a mess, and you'd most likely start by running strings on the .exe, looking for references to the in-game message ("saving game...", etc.).

Luckily the save file was unencrypted. If that was not the case, most beginners would give up and lose interest.

-5

u/fxfighter 1d ago

I was hoping this was going to be from an unmanaged app of some sort that'd require more specific tooling and reverse engineering know how.

If the file was generated by a managed language or scripting language piece of software, these are obvously easy to figure out how stuff works with standard knowledge of the language in question.

I'm not even sure ImHex hasn't anything particulaly noteworthy to do with this article.