FBin File

June 12, 2008 10:38 pm

 So a quick recap was dumping the largest CMbT section from the s14v101.bin file. I removed what I thought to be the header (everything before FBIN). I renamed this file s14v101.fbin.

Now, I’ll use the parsebin script to dump all the BINS sections. How do I know to do this? I took a look at the file and found a handful of occurrences of the string “BINS”.

So, the steps, create a new sections.txt file that contains one section: “BINS”. Call it fbinsections.txt. Now, run this through the parsebin.pl file like this:

./parsebin.pl s14v101.fbin fbinsec.txt > info-fbin-101.txt

This gets us the follwing information:

*****************************************************
BINS:
*****************************************************
Num	Hex Length	Dec Length	Hex Position	Dec Position
0:	0x00000a4c		2636	0x00000018	24
1:	0x000002a0		672	0x00000a64	2660
2:	0x000001a0		416	0x00000d04	3332
3:	0x00063c54		408660	0x00000ea4	3748
4:	0x00003db0		15792	0x00064af8	412408
5:	0x00000fc0		4032	0x000688a8	428200
6:	0x00000024		36	0x00069868	432232
7:	0x000002f4		756	0x0006988c	432268
8:	0x00000034		52	0x00069b80	433024
9:	0x00000230		560	0x00069bb4	433076
10:	0x000001a4		420	0x00069de4	433636
11:	0x0000bef8		48888	0x00069f88	434056
12:	0x00000fc0		4032	0x00075e80	482944
13:	0x001e4508		1983752	0x00076e40	486976

Interesting. 14 sections of greatly varying length. A sanity check right about now would be a good idea. Lets see if we can make any sense of this quickly. We can examine the BINS 0×069b80, dumping the hex:

 42 49 4E 53 34 00 00 00 00 03 40 FF 00 00 00 00 .....

It continues, but I chose to leave the rest off. The text in  red is “BINS”. According to parsebins.pl, the hexadecimal length of this section is 0×34. Hey, there is the length!! I’ll leave it as a homework assignment to verify the rest of the sections. Looks like we’ve found an embedded file type, that has at least some structure. What are all the sections? Whats that really big BINS section? We’ll leave that for next time.

No Responses to “FBin File”

Care to comment?