Help reverse engineering a data file??

Forums › Desktop computing › Help reverse engineering a data file??

cgreenwood

201 posts

Master Geek

#208363 8-Feb-2017 16:36

Hi all

Not sure if this is the correct forum for this sort of thing?

I work with some instruments that need to be updated with reference data from time to time. The instrument is controlled from a Windows 7 PC and the reference data comes from the overseas manufacturer in a file in a proprietary format (.qxn). The following link is an example of such a file

https://dl.dropboxusercontent.com/u/61363055/63611101.qxn

I would like to be able to open the file, change some of the data and re-save in the same format so the instrument can be updated with my own data.

Can anyone point me in the right direction of where to start with this? Have tried the obvious newbie things like trying to open with Excel, Word, notepad etc etc with no luck. Is there a program or application that might help me access the data in these files?

Any help appreciated.

Cheers

1 | 2

3946 posts

Uber Geek

Trusted

Lifetime subscriber

#1717280 8-Feb-2017 16:52

Have you asked the overseas manufacturer if they provide an editor?

gbwelly

1239 posts

Uber Geek

#1717282 8-Feb-2017 16:53

Looking at that file it isn't going to be straight forward. Try a hex editor like XVI32.

cgreenwood

201 posts

Master Geek

#1717286 8-Feb-2017 16:58

Have you asked the overseas manufacturer if they provide an editor?

Yes, its complicated as they come via a NZ distributor and the manufacturer is Japanese - I think there is a lot lost in translation when making a request of this nature.

tripp

3848 posts

Uber Geek

Trusted

Lifetime subscriber

#1717295 8-Feb-2017 17:11

So just a question, would the supplier of the file charge for a change to the data or adding your data?

There is a reason why things are normally proprietary format

Rikkitic

Awrrr
18612 posts

Uber Geek

Lifetime subscriber

#1717299 8-Feb-2017 17:32

Do you know what data in what location needs to be changed? You would have to overwrite it without altering the file size. As mentioned, a hex editor can do this.

Plesse igmore amd axxept applogies in adbance fir anu typos

cgreenwood

201 posts

Master Geek

#1717303 8-Feb-2017 17:50

OK, getting a sense for how this might work: if I can open the file in the hex editor, I might be able to search and replace the existing data with my own, provided it is the same format and length?

cgreenwood

201 posts

Master Geek

#1717317 8-Feb-2017 18:05

Have tried opening in the Hex editor

Just gobbledygook results :(

Any other ideas?

GoodSync

GoodSync. Easily back up and sync your files with GoodSync. Simple and secure file backup and synchronisation software will ensure that your files are never lost (affiliate link).

Rikkitic

Awrrr
18612 posts

Uber Geek

Lifetime subscriber

#1717318 8-Feb-2017 18:05

I have done this kind of thing in the past. The problem is if you don't know what the data you are changing does, you have to be very careful to put the right thing in the right place. The advantage of the hex editor is that it doesn't add any formatting or make any other changes to the file, it just does a byte-by-byte replacement of whatever you select. If you are careful to only replace exactly the right data in the right location, it might work. It depends on the program that uses the data and whether it will have problems with your changes.

Plesse igmore amd axxept applogies in adbance fir anu typos

Rikkitic

Awrrr
18612 posts

Uber Geek

Lifetime subscriber

#1717322 8-Feb-2017 18:13

The above isn't gobbledygook, it is a correct byte by byte representation of the contents of the file. The values to the left are hex codes, the ones to the right the ASCII representations that correspond to those codes. If you are expecting some kind of clear text result, then the file is obviously encrypted in some fashion or otherwise encoded. If you are just trying to change some plain text values, then you won't be able to do it this way. You need to know what the various hex values represent.

Plesse igmore amd axxept applogies in adbance fir anu typos

MadEngineer

4246 posts

Uber Geek

Trusted

#1717332 8-Feb-2017 18:45

Googling for the text from the start or end of the file may yield something useful, you might find its a compressed file that can be opened in an archive program for example

You're not on Atlantis anymore, Duncan Idaho.

sidefx

3706 posts

Uber Geek

Trusted

#1717340 8-Feb-2017 18:57

Yup, Hex editor is your best bet if there's no documentation available from manufacturer. I used to do similar with game files (terrain\saved game files\etc for modding)

Your best bet is to get or create a bunch of different files with minor but known differences if possible Then open them in a hex editor, then start comparing them to figure out how the data is stored and how to find the appropriate values to change... be warned though, it's a tedious process, requires a decent understanding of different ways data can be encoded, and yeah as above it can be further complicated if the files (or even parts of the files) are compressed in some way.

"I was born not knowing and have had only a little time to change that here and there." | Octopus Energy | Sharesies
- Richard Feynman

JayADee

2135 posts

Uber Geek

#1717348 8-Feb-2017 19:10

Google suggests it is a windows 3 Quicken file

JayADee

2135 posts

Uber Geek

#1717357 8-Feb-2017 19:28

Looks like you can freely get a version of Quiken that will open it here:
https://www.quicken.com/support/how-and-when-use-intermediate-version-convert-older-versions-quicken

frankv

5678 posts

Uber Geek

Lifetime subscriber

#1717364 8-Feb-2017 20:02

I've done a bit of this reverse engineering in the past, and had a look at your file.

There's nothing obvious... normally you would see some recognisable text string. Often, there will be several 00/01 bytes, or bytes with small values, but again nothing obvious. It could be that the file is encrypted, in which case I think you're stuffed. Or it could just be that there aren't any text strings or 0s and 1s in the configuration.

If you know some configuration values that are contained in the file, then maybe you have a shot at it.

For example, the first 4 bytes are 06 4F A7 49. These could represent 4 unsigned 8-bit numbers (6, 79, 167, 73), two unsigned 16-bit numbers (20230, 18855), or one unsigned 32-bit number (1235701510). Or they might be signed numbers. Or a single floating point number. Or 8 bytes could be a 64-bit number, signed or unsigned or floating point.

So, if you know there's a sequence of 6, 79, 167, 73 in the configuration data, you know that it's represented as unsigned bytes, and located in the first 4 bytes, and you could change one of those bytes to change the corresponding value in the configuration. Similarly if you know the values 20230 or 18855 or 1235701510 are in the config, then you know that it's represented as 16-bit or 32-bit unsigned.

You could also try changing likely-looking bytes (back up the original file first!) to see what effect that has... this can work if you have a way of reading the decoded config values e.g. using the program that talks to the instrument, or the instrument itself.

But really, you're probably better off to just give some money to the vendor and get them to do it... you have no idea what side-effects fiddling about with this stuff will have, and therefore how accurate your instrument measurements will be after fiddling. Worst case, you might even damage the instrument.

Rikkitic

Awrrr
18612 posts

Uber Geek

Lifetime subscriber

#1717366 8-Feb-2017 20:02

JayADee: Google suggests it is a windows 3 Quicken file

I have a feeling that may be just a coincidence. It seems unlikely (never impossible, of course) that a modern business would still be using a Windows 3 programme.

Plesse igmore amd axxept applogies in adbance fir anu typos

1 | 2