RE-LAB Project
A little shy joint efforts project of the GIMP.RU and Giadram Inc.



            Reverse-engineering of proprietary file formats




      Alexandre Prokoudine & Valek Filippov
TOOOOLZ
                                    “I'm not a programmer”



       OLE Toy                             colupatr


               https://gitorious.org/re-lab/

  abr_struct
                                               matcap
                           exp
OLE Toy
Started as a tool to research MS Publisher files

Mutated into a little monster who digested its predecessors:
mfview, cdrvu, fhstruct, vsdump/vsdviewer etc.


“Supports”:

               WMF        SVM        CMX      CDR        CPL
      PPT           XLS     VBA              FH WLD
                                    EMF+
  VSD       EMF                                          CDW
                     DOC          CFB      “Escher”
              CLP           ICC                    ZIP
    PUB              MDB                QPW
OLE Toy
OLE Toy features
●   Search for ASCII, Unicode string or Hex value

●   Copy tree path, go to leaf by path

●   Scroll hexdump to addr (abs or +/-)

●   Search for leaf (with ASCII/Unicode/Hex)

●   Collect «dictionaries» for CDR, FH

●   Specific searches for XLS and CDR

●   Hints on selected bytes

●   Parse some formats at selected position
colupatr
Hexviewer on ster^W LSD

Made to reduce r.engineering pains with normal
hexviewers:

●   Variable lengths of lines

●   Comments

●   CLI commands to change lines

●   Parse hexdump from clipboard
YIELD

Photoshop ABR/GRD specs     (Krita, SwatchBooker)


MS Publisher (98,2k-2k7) (LibreOffice GSoC 2012 Project)


Troubleshooting of XLS/WMF/EMF/CLP-related issues in
LibreOffice, Gnumeric
YIELD
        Embroidery file formats
YIELD
MS Visio VSD specs   LibreOffice GSoC 2011: libvisio
YIELD
  Corel DRAW CDR   LibreOffice libcdr
YIELD
  Aldus/Macromedia FH   fh2svg PoC
Live demo
Tomatoes


Q&A

Re-lab project. Formats reverse engineering: tools and results

  • 1.
  • 2.
    A little shyjoint efforts project of the GIMP.RU and Giadram Inc. Reverse-engineering of proprietary file formats Alexandre Prokoudine & Valek Filippov
  • 3.
    TOOOOLZ “I'm not a programmer” OLE Toy colupatr https://gitorious.org/re-lab/ abr_struct matcap exp
  • 4.
    OLE Toy Started asa tool to research MS Publisher files Mutated into a little monster who digested its predecessors: mfview, cdrvu, fhstruct, vsdump/vsdviewer etc. “Supports”: WMF SVM CMX CDR CPL PPT XLS VBA FH WLD EMF+ VSD EMF CDW DOC CFB “Escher” CLP ICC ZIP PUB MDB QPW
  • 5.
  • 6.
    OLE Toy features ● Search for ASCII, Unicode string or Hex value ● Copy tree path, go to leaf by path ● Scroll hexdump to addr (abs or +/-) ● Search for leaf (with ASCII/Unicode/Hex) ● Collect «dictionaries» for CDR, FH ● Specific searches for XLS and CDR ● Hints on selected bytes ● Parse some formats at selected position
  • 7.
    colupatr Hexviewer on ster^WLSD Made to reduce r.engineering pains with normal hexviewers: ● Variable lengths of lines ● Comments ● CLI commands to change lines ● Parse hexdump from clipboard
  • 9.
    YIELD Photoshop ABR/GRD specs (Krita, SwatchBooker) MS Publisher (98,2k-2k7) (LibreOffice GSoC 2012 Project) Troubleshooting of XLS/WMF/EMF/CLP-related issues in LibreOffice, Gnumeric
  • 10.
    YIELD Embroidery file formats
  • 11.
    YIELD MS Visio VSDspecs LibreOffice GSoC 2011: libvisio
  • 12.
    YIELD CorelDRAW CDR LibreOffice libcdr
  • 13.
  • 14.
  • 15.