解密文件的二进制格式
我有一个我正在尝试写入的二进制文件，但是我没有文件格式规范，也没有使用谷歌找到它，我一直在使用十六进制编辑器查看该文件，但到目前为止只让我头疼，有没有更好的方法来破译文件的格式，以便我可以向其中附加数据？
I have a binary file to which I'm trying to write however I dont have the file format specification nor have found it using google, I've been looking at the file using a hex editor but so far has only give me a headache, is there a better way to decipher the format of the file so that I can append data to it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
手术刀等文件雕刻工具在这里并没有多大帮助。它们用于从内存转储或一些较大的复合文件中提取具有已知页眉和/或页脚签名的文件。
对于您的场景，我建议使用具有模板功能的十六进制编辑器，例如 010 编辑器。当您详细了解文件每个部分的功能时，这将允许您命名和注释二进制文件中的“字段”。不幸的是，找出每个字段的作用的过程主要是手动的。作为一种方法论，就开始尝试吧。更改当前二进制文件中的一些值，看看会发生什么。预计会花费大量时间，但也要享受这个过程！
File carving tools such as scalpel won't really help here. They're made for extracting files with known header and/or footer signatures from a memory dump or some larger, composite file.
For your scenario, I would recommend a hex editor with templating capability, like the 010 Editor. This will allow you to name and annotate "fields" in the binary as you learn more about what each part of the file does. Unfortunately, the process of finding out what each field does is mostly manual. As a methodology, just start playing with it. Change some values in your current binary and see what happens. Expect to spend significant time on it, but also enjoy the process!
您可能想使用开源取证应用程序（例如mostorest或scalpel）来搜索它。他们会为你做大部分繁重的工作，你很可能不会学到任何东西。
you may want to search it with a open source forensic application like foremost or scalpel. They will do most of the grunt work for you, you just likely wont learn anything.