http://www.outflux.net/blog/archives/2005/02/25/tivo-file-format/ code is freedom -- patching my itch Tue, 06 Jan 2009 09:27:18 +0000 http://wordpress.org/?v=2.5.1 http://www.outflux.net/blog/archives/2005/02/25/tivo-file-format/#comment-46 codeblog » pattern visualization Thu, 14 Jul 2005 02:59:37 +0000 http://outflux.net/blog/archives/2005/02/25/tivo-file-format/#comment-46 [...] So, frequently, I’m faced with streams of bytes of unknown origin/purpose. (For example, the .TiVo file format, RTMP streams, and most recently, Outlook “NK2″ address autocompletion cache files.) I’ve had experience finding patterns, but it’s always so time-consuming. Usually I’m compiling some little C program over and over, slowly tweaking some guessed-at structure. This is basically the advice I got from Andrew Tridgell when I asked how he went about reverse engineering protocols. His methods deal more with sending/receiving, so it’s much more interactive. Most of what I’ve mucked with are just unknown file formats. [...] [...] So, frequently, I’m faced with streams of bytes of unknown origin/purpose. (For example, the .TiVo file format, RTMP streams, and most recently, Outlook “NK2″ address autocompletion cache files.) I’ve had experience finding patterns, but it’s always so time-consuming. Usually I’m compiling some little C program over and over, slowly tweaking some guessed-at structure. This is basically the advice I got from Andrew Tridgell when I asked how he went about reverse engineering protocols. His methods deal more with sending/receiving, so it’s much more interactive. Most of what I’ve mucked with are just unknown file formats. [...]

]]>