Disassemble help - File Structure

[WillT]

I've disassembled a program to attempt to understand the application's structure for importing the data files. I have an extensive background is Java and C++ but I can't find any resources explaining importing files and reading them in assembly. What I'm hoping to find is someone who can simply tell me what the headers of the data file are. Any help would be greatly appreciated.

[AceStryker]

I really didn't understand but, i think you want to know how we Dissassembly a file, well, if you want to dissassembly a closed file, you can try using the WindowsAPIs CreateFile(), WriteFile() and ReadFile()...
If you want to dissassembly a opened file i would use a OpenProcess(), WriteProcessMemory() and ReadProcessMemory(), this functions return a sequence of bytes, if you want to see for example if an address if NOPed you need to check if the returned byte is $90 (byte that represents NOP)

[gusano79]

I've disassembled a program to attempt to understand the application's structure for importing the data files. I have an extensive background is Java and C++ but I can't find any resources explaining importing files and reading them in assembly. What I'm hoping to find is someone who can simply tell me what the headers of the data file are. Any help would be greatly appreciated.

If by "headers" you mean the header files from a C/C++ program, you're not going to find them in a disassembly. A structure/class definition provides the compiler information about the shape of an object, but the compiler doesn't save that information anywhere; it's implicit in how the resulting native executable handles data. There are disassemblers that provide tools to help you manage structure definitions, but you'll generally have to do the work of figuring out what they are on your own--at least, that's my experience.

Do you know what language the original application was written in? What platform it was compiled for? Can you post the disassembly or the original application? I'm assuming you're not breaking any software license agreements by disassembling it; if you are, don't post them.

[WillT]

I've completely disassembled the file using IDA Pro Advanced. The application I've disassembled loads in approximately 15 different binary files. I want to use the disassembled code to find the structure of the binary files.

When I said headers I meant the short value that identifies each block in the binary files.

[NotNull]

Headers - A C/C++ program is a compiled program, if by headers you mean prefixed
program format information that is used by the operating systems loader,
typically.

Data Structures are just that, 'data'. They are interpreted by program code.
If the executable is already compiled, you will have to reverse engineer
the program to determine how the data files binary formats are being interpreted.

Besides the thought of reverse engineering a bunch of compiled C code,
for the aforementioned program, have you looked up any data format reference
information online, or any software for creating data files that may be
imported into the application?

Let it be noted 'assembly' here refers to assembled languages that
are turned into machine code.
So, the assembly source of a program would simply be it's machine code
translated into a human readable format, that is, assembly language.

In assembler each statement (besides assembler directives) mirrors a
specific machine instruction, it is then assembled into binary values
that exercise logic circuitry in the CPU. The sequence of these particular
binary values constitute the machine source of a program, including
it's data. Therefore whenever you have an executable program you already
have it's machine source.

[WillT]

I guess Chunk identifier would better suit the word I'm looking for. I'm almost certain the data files are hybrid 3DS MAX files. I'm trying to find someone who can look through the assembly code and find chunk identifiers and explain them a little. I promise this is 100% assembly. If you would like you can view the code through team viewer?

[gusano79]

Ah, okay, that makes more sense. As far as I know, 3ds Max binary files are proprietary, so it won't be obvious what the chunk IDs are even supposed to be... I suppose that's why you're posting, right? :) Are you looking for insight into the 3ds format, or do you want to see what the disassembled application is actually doing with the files? Or is it something else you're after?

If you're able to post/link something I can examine offline, that would be best--I can only check DW sporadically.

[WillT]

I've written an application in Java that works with 3ds files. The chunk ids are available online.
http://en.wikipedia.org/wiki/.3ds

I want to see how the application uses the files.
I presume uploading these files in winRAR will be fine and do you have any messaging software that would make it easier for us to collaborate?

What format should I save the disassembled files as?

[WillT]

http://www.mediafire.com/?4sru8y3xxcuu5kf

PM me for the password.
Code is in a .asm file

[gusano79]

Got it.

That's enormous. I'm familiar with IDA and I have the free version installed already. It looks like it's a standard x86 PE, so it should work... if you post the IDA database, that would make it easier to navigate.

As for finding the code that handles the data files, I'd start by searching for ".dat", and that shows up on line 543257 in the .asm file... then look for references to labels like "aDataCsg1_dat". There don't appear to be any, but that line has its own offset label, which IDA must have put there because something else referenced it... yep, on line 56323. Looks like "sub_42F280" (line 56304) is a procedure that returns data file names, and it's called in a variety of places. Anyway, that's off the top of my head... the IDA DB will help immensely.

So. The data file you bundled with the disassembly isn't 3ds-related at all--it's a standard WAVE file. Just rename it from "css11.dat" to "css11.wav" and play it in whatever media player you like. Are there specific media files you're interested in? That will help focus our investigation.

[WillT]

Would it be possible for you to distinguish between the audio files and the graphics files. I've included more in this upload

http://www.mediafire.com/?t2h8gsndergjpwa

PM for the password.

-- I had more typed than that but my computer decided to refresh the page wiping it all. :\

[WillT]

Bump

[AceStryker]

I searched a little and found a DLL named DbgHelp.dll, you can use it if you want.
http://msdn.microsoft.com/en-us/library/ms679294.aspx