{"id":3829,"date":"2016-09-18T00:13:30","date_gmt":"2016-09-18T00:13:30","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3829"},"modified":"2016-09-18T00:18:07","modified_gmt":"2016-09-18T00:18:07","slug":"dexray-1-7-ccsubsdk-files-part-2","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2016\/09\/18\/dexray-1-7-ccsubsdk-files-part-2\/","title":{"rendered":"DeXRAY 1.7 \u2013 ccSubSdk files &#8211; part 2"},"content":{"rendered":"<p>I have added a buggy routine that attempts to interpret the content of the decrypted ccSubSdk files; this is based purely on looking at the file properties &#8211; at first I noticed that there are many GUID-like values that appear in the files many times and across many files. Then looking at the layout I tried to split the data by using these GUIDs as dividers &#8211; this was helpful and led to a better understanding of how these chunks are structured. Some patterns started emerging and in the end the serialization character of the file layout became more apparent. Walking through trial-and-error I put together a raw parser that attempts to make a better sense of the data records.<\/p>\n<p>The tool stores the hexadecimal dumps of the interpreted data in .met files that are now accompanying all decrypted out files for both submission.idx and actual submission files. You will find errors in some of the output files, but atm it&#8217;s the best it can do. Work in progress \ud83d\ude42<\/p>\n<p>The output is tagged using\u00a0 &#8216;###&#8217; f.ex.:<\/p>\n<pre><strong>### GUID<\/strong>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 21 A3 05 3F B7 43 78 45 93 C8 CD C5 F6 4A 14 9A\u00a0 !..?.CxE.....J..\r\n09\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 22 00 00 00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \"...\r\n\r\n06\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 01 00 00 00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ....\r\n\r\n06\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 01 00 00 00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ....\r\n\r\n07\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 13 00 00 00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ....\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 4D 72 43 6C 65 61 6E 20 53 75 62 6D 69 73 73 69\u00a0 MrClean Submissi\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 6F 6E 00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 on.\r\n\r\n<strong>### STRING-A<\/strong>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 MrClean Submission<\/pre>\n<p>The following identifiers are now being used:<\/p>\n<ul>\n<li>STRING-A &#8211; String ANSI<\/li>\n<li>STRING-W &#8211; String Wide (Unicode-16LE)<\/li>\n<li>BLOB &#8211; binary blob<\/li>\n<li>GUID &#8211; 16 bytes long GUID-like data<\/li>\n<\/ul>\n<p>The latest version of <a href=\"https:\/\/hexacorn.com\/download.php?f=DeXRAY.pl\">DeXRAY can be found here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I have added a buggy routine that attempts to interpret the content of the decrypted ccSubSdk files; this is based purely on looking at the file properties &#8211; at first I noticed that there are many GUID-like values that appear &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2016\/09\/18\/dexray-1-7-ccsubsdk-files-part-2\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[28,15,12,21,19,46,9,5],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3829"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3829"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3829\/revisions"}],"predecessor-version":[{"id":3833,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3829\/revisions\/3833"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}