Help reverse engineering a data file??

Forums › Desktop computing › Help reverse engineering a data file??

cgreenwood

196 posts

Master Geek
+1 received by user: 7

# 208363 8-Feb-2017 16:36

Hi all

Not sure if this is the correct forum for this sort of thing?

I work with some instruments that need to be updated with reference data from time to time. The instrument is controlled from a Windows 7 PC and the reference data comes from the overseas manufacturer in a file in a proprietary format (.qxn). The following link is an example of such a file

https://dl.dropboxusercontent.com/u/61363055/63611101.qxn

I would like to be able to open the file, change some of the data and re-save in the same format so the instrument can be updated with my own data.

Can anyone point me in the right direction of where to start with this? Have tried the obvious newbie things like trying to open with Excel, Word, notepad etc etc with no luck. Is there a program or application that might help me access the data in these files?

Any help appreciated.

Cheers

1 | 2

3300 posts

Uber Geek
+1 received by user: 1083

Trusted

Lifetime subscriber

# 1717280 8-Feb-2017 16:52

Have you asked the overseas manufacturer if they provide an editor?

gbwelly

784 posts

Ultimate Geek
+1 received by user: 344

Subscriber

# 1717282 8-Feb-2017 16:53

One person supports this post

Looking at that file it isn't going to be straight forward. Try a hex editor like XVI32.

cgreenwood

196 posts

Master Geek
+1 received by user: 7

# 1717286 8-Feb-2017 16:58

Have you asked the overseas manufacturer if they provide an editor?

Yes, its complicated as they come via a NZ distributor and the manufacturer is Japanese - I think there is a lot lost in translation when making a request of this nature.

tripp

3262 posts

Uber Geek
+1 received by user: 872

Trusted

Lifetime subscriber

# 1717295 8-Feb-2017 17:11

So just a question, would the supplier of the file charge for a change to the data or adding your data?

There is a reason why things are normally proprietary format

Rikkitic

Fat bottom Trump
9950 posts

Uber Geek
+1 received by user: 4797

Subscriber

# 1717299 8-Feb-2017 17:32

Do you know what data in what location needs to be changed? You would have to overwrite it without altering the file size. As mentioned, a hex editor can do this.

I reject your reality and substitute my own. - Adam Savage

cgreenwood

196 posts

Master Geek
+1 received by user: 7

# 1717303 8-Feb-2017 17:50

OK, getting a sense for how this might work: if I can open the file in the hex editor, I might be able to search and replace the existing data with my own, provided it is the same format and length?

cgreenwood

196 posts

Master Geek
+1 received by user: 7

# 1717317 8-Feb-2017 18:05

Have tried opening in the Hex editor

Just gobbledygook results :(

Any other ideas?

Rikkitic

Fat bottom Trump
9950 posts

Uber Geek
+1 received by user: 4797

Subscriber

# 1717318 8-Feb-2017 18:05

I have done this kind of thing in the past. The problem is if you don't know what the data you are changing does, you have to be very careful to put the right thing in the right place. The advantage of the hex editor is that it doesn't add any formatting or make any other changes to the file, it just does a byte-by-byte replacement of whatever you select. If you are careful to only replace exactly the right data in the right location, it might work. It depends on the program that uses the data and whether it will have problems with your changes.

I reject your reality and substitute my own. - Adam Savage

Rikkitic

Fat bottom Trump
9950 posts

Uber Geek
+1 received by user: 4797

Subscriber

# 1717322 8-Feb-2017 18:13

One person supports this post

The above isn't gobbledygook, it is a correct byte by byte representation of the contents of the file. The values to the left are hex codes, the ones to the right the ASCII representations that correspond to those codes. If you are expecting some kind of clear text result, then the file is obviously encrypted in some fashion or otherwise encoded. If you are just trying to change some plain text values, then you won't be able to do it this way. You need to know what the various hex values represent.

I reject your reality and substitute my own. - Adam Savage

MadEngineer

1816 posts

Uber Geek
+1 received by user: 525

# 1717332 8-Feb-2017 18:45

Googling for the text from the start or end of the file may yield something useful, you might find its a compressed file that can be opened in an archive program for example

sidefx

3279 posts

Uber Geek
+1 received by user: 982

Trusted

# 1717340 8-Feb-2017 18:57

3 people support this post

Yup, Hex editor is your best bet if there's no documentation available from manufacturer. I used to do similar with game files (terrain\saved game files\etc for modding)

Your best bet is to get or create a bunch of different files with minor but known differences if possible Then open them in a hex editor, then start comparing them to figure out how the data is stored and how to find the appropriate values to change... be warned though, it's a tedious process, requires a decent understanding of different ways data can be encoded, and yeah as above it can be further complicated if the files (or even parts of the files) are compressed in some way.

JayADee

1639 posts

Uber Geek
+1 received by user: 239

# 1717348 8-Feb-2017 19:10

Google suggests it is a windows 3 Quicken file

JayADee

1639 posts

Uber Geek
+1 received by user: 239

# 1717357 8-Feb-2017 19:28

Looks like you can freely get a version of Quiken that will open it here:
https://www.quicken.com/support/how-and-when-use-intermediate-version-convert-older-versions-quicken

frankv

2750 posts

Uber Geek
+1 received by user: 1328

Lifetime subscriber

# 1717364 8-Feb-2017 20:02

One person supports this post

I've done a bit of this reverse engineering in the past, and had a look at your file.

There's nothing obvious... normally you would see some recognisable text string. Often, there will be several 00/01 bytes, or bytes with small values, but again nothing obvious. It could be that the file is encrypted, in which case I think you're stuffed. Or it could just be that there aren't any text strings or 0s and 1s in the configuration.

If you know some configuration values that are contained in the file, then maybe you have a shot at it.

For example, the first 4 bytes are 06 4F A7 49. These could represent 4 unsigned 8-bit numbers (6, 79, 167, 73), two unsigned 16-bit numbers (20230, 18855), or one unsigned 32-bit number (1235701510). Or they might be signed numbers. Or a single floating point number. Or 8 bytes could be a 64-bit number, signed or unsigned or floating point.

So, if you know there's a sequence of 6, 79, 167, 73 in the configuration data, you know that it's represented as unsigned bytes, and located in the first 4 bytes, and you could change one of those bytes to change the corresponding value in the configuration. Similarly if you know the values 20230 or 18855 or 1235701510 are in the config, then you know that it's represented as 16-bit or 32-bit unsigned.

You could also try changing likely-looking bytes (back up the original file first!) to see what effect that has... this can work if you have a way of reading the decoded config values e.g. using the program that talks to the instrument, or the instrument itself.

But really, you're probably better off to just give some money to the vendor and get them to do it... you have no idea what side-effects fiddling about with this stuff will have, and therefore how accurate your instrument measurements will be after fiddling. Worst case, you might even damage the instrument.

Rikkitic

Fat bottom Trump
9950 posts

Uber Geek
+1 received by user: 4797

Subscriber

# 1717366 8-Feb-2017 20:02

JayADee: Google suggests it is a windows 3 Quicken file

I have a feeling that may be just a coincidence. It seems unlikely (never impossible, of course) that a modern business would still be using a Windows 3 programme.

I reject your reality and substitute my own. - Adam Savage

1 | 2