This presentation explores the challenges and methods of reverse engineering undocumented file formats, specifically focusing on the detection and utilization of checksums. The speaker details their journey in analyzing IAR's proprietary "Ubra" firmware format for 8051 microcontrollers, which lacked explicit length indicators for its internal data blocks. The core technique involves comparing hex dumps of similar files to identify checksum locations, determining the specific checksum algorithm (often a CRC variant) using a custom tool (Dels), and critically, filtering out numerous false positives by searching for the "longest chain" of contiguous, valid checksum-protected segments. This approach allows for the accurate decomposition of the file into its constituent blocks, revealing hidden structural patterns and aiding in the overall reverse engineering process, driven by a fascination for the pervasive 8051 architecture in modern devices.
Understanding Undocumented File Formats: A Deep Dive into Checksums
0:19 Introduction to File Formats and Checksums: The presentation focuses on understanding file formats and the role of checksums within them, stemming from the speaker's efforts to reverse engineer 8051 firmware.
0:28 Reverse Engineering 8051 Firmware: The speaker needed to understand an undocumented "Ubra" file format from the IAR compiler, which presented challenges due to its lack of internal documentation, unlike the more common Kyle C150 compiler.
0:41 Checksums in File Blocks: Many file formats organize data into blocks, with each block typically ending with a checksum for data integrity verification. These blocks often contain fields indicating their type, length, and content.
3:49 Diverse Checksum Algorithms: Checksum algorithms are not standardized, ranging from simple bit additions to complex CRC (Cyclic Redundancy Check) algorithms with various parameters. The speaker used a custom program to identify these parameters.
4:35 Identifying Checksums: Checksums can be found by comparing hex dumps of slightly different files, looking for seemingly random 2- or 4-byte changes, often at the end of a block.
5:53Dels Tool Demonstration: A custom tool, Dels, is demonstrated, capable of calculating and identifying CRC16 checksums, which helps narrow down the possible algorithms.
6:29 The Role of Checksums in Reverse Engineering: Knowing the checksum algorithm allows for file modification, but more importantly, it helps validate segments within a file, confirming which areas are legitimate data blocks.
7:06 The "False Positive" Problem: A significant challenge arises from the vast number of possible checksum combinations in large files (e.g., 32 million accidental matches in a 2MB file with 16-bit checksums), leading to numerous "false positives."
11:01 The "Longest Chain" Solution: To overcome false positives, the speaker's innovative approach identifies the longest contiguous "chain" of checksum-validated segments. This method efficiently uncovers the true structural elements of the file format in linear time, rather than quadratically.
13:00 Practical Application and Insights: The technique effectively splits files into meaningful blocks, revealing hidden patterns like file version numbers (e.g., '0B' for version 11) and string encoding (e.g., Pascal strings with length prefixes) that would otherwise be missed. This was crucial as the file format did not encode lengths in its chunks.
17:10 Summary of Achievements: The process involves scanning similar files for checksum ranges, determining the checksum algorithm, breaking files into "chunks," and using these chunks for more effective reverse engineering.
19:02 Tool Availability and Motivation: The Dels tool is open-source and available on GitHub. The speaker's motivation for this deep dive stems from a personal fascination with the pervasive 8051 architecture found in everyday devices like mice and laptops, and a desire to understand the intricate details of PC components.