Recent Posts

Pages: [1] 2 3 ... 10
1
Hi Jörg! Many thanks for the new defs, as usual!
2
Hello trid users,

some days ago i flashed my switchable power outlets, because i do not like
to send my data via eWeLink app in the cloud to servers belonging perhaps to
chinese if i just want to toggle an electric device some meters away.

Another fine feature of this installed alternative firmware named Tasmota is
the ability to write/read the configuration data (with values for NTP-server,
latitude, Timezone, etc.). These files are described by trid as "Unknown!" (
see appended output/trid-old.txt). Also annoying is that for that configuration
file name extension dmp is used. That extension is already used for memory
dumps on Windows.

So i start to create an definition file for TrID. First i run tridscan. My
used plugs and their configuration have similar variable values like
NTP-server and so on. So i got many pattern in definition file. But luckily
the source of the Tasmota firmware is available. So first i add website url
as reference by line:

   <RefURL>https://github.com/arendst/Sonoff-Tasmota</RefURL>

According to source data structure starts with variable cfg_holder with a
value of 0x1209. This gives with configuration size first pattern by
construct:

   <Bytes>09125C53</Bytes>
   <Pos>0</Pos>

The remaining settings are normally XORed with value of sum of 0x5A and
offset. So value like "0.de.pool.ntp.org" for NTP server do not occur as
readable string. Luckily since version 5.12.0e 20 bytes named free_1D5 at
position 469 inside structure are empty. This is expressed by construct:

   <Bytes>2F303132333435363738393A3B3C3D3E3F4041</Bytes>
   <Pos>469</Pos>

These 2 pattern are unique enough to recognise reliable configuration dump of
newer Tasmota firmware since version 5.y. So i named definition file
dmp-tasmota-v5.trid.xml.

I started my test with firmware version 6.2.1.0 (that is 0x06020100 for
*6.2.1*.dmp examples). So created definition file dmp-tasmota-v6.trid.xml for
that examples contains additional 4 bytes at offset 8 for that version. That
gives an additional construct like:

   <Bytes>62626663</Bytes>
   <ASCII> b b f c</ASCII>
   <Pos>8</Pos>


With these 2 trid definition all my configuration dumps of Tasmota firmware
including newer version examples *6.3.0*.dmp are now recognized by trid (
see appended output/trid-new.txt). TrID definition and output are stored in
archive dmp_trid.zip. I hope that the XML files can be used in future
version of triddefs.

With best wishes
Jörg Jenderek
3
Definitions DB change log / Re: Current
« Last post by Mark0 on November 19, 2018, 05:05:15 pm »
Updated:
  • Lotus Agenda data objects (v2.0) (AG)
Added:
  • Lotus Agenda Accessory (ACC)
  • Lotus Agenda data objects (v1.0) (AGA)
  • Fusion 360 shared project archive (F3Z)
  • Lotus Agenda Screen Driver (SDR)
  • Magic and Mayhem sprites (SPR)
  • Lotus Agenda Structured Text File (STF)
  • XYPad Drawing (XYD)
4
Definitions DB change log / Re: Current
« Last post by Mark0 on November 15, 2018, 01:22:53 pm »
Updated:
  • Acorn Draw vector image ()
Added:
  • ArtWorks drawing ()
  • AudioWorks sound sample ()
  • FileMaker Pro 64-bit plug-in (FMX64)
  • H2testw test data (H2W)
  • Floppy Diskette Copy disk image (IMG)
  • Music Assembler module (MA)
  • MultiMedia Sound module (MMS)
  • Paintpro bitmap (generic) (PPP)
  • Paintpro bitmap (v5.0) (TB1/PPP)
  • Paintpro bitmap (v6.0) (PPP)
Deleted:
  • Acorn Draw drawing ()
5
TrID File Identifier / Re: h2w.trid.xml for h2testw test data (*.h2w)
« Last post by Mark0 on November 14, 2018, 01:04:20 pm »
Thanks for the new def!
6
TrID File Identifier / h2w.trid.xml for h2testw test data (*.h2w)
« Last post by jenderek on November 14, 2018, 03:09:08 am »
Hello trid users,

some days ago i use software h2testw again to test some USB sticks for
faked capacity. This software writes and reads test data with file name
extension h2w. These data file are described by trid often as "Unknown!"
and some times as "Adobe PhotoShop Brush" ( see appended
output/trid-old.txt)

So i run tridscan to generate trid definition file h2w.trid.xml. The
original Windows software can be found for example at
https://www.heise.de/download/product/h2testw-50539 .

Luckily the Unix software package f3 (f3write f3read, etc.) also use this
file format. So i use the web site of that software as reference by line:

   <RefURL>http://oss.digirati.com.br/f3/</RefURL>

When the test data are written the data files can be read again to test
integrity of storage device again and again. If you are satisfied with
test scenario you can delete this files. So i mention this fact in remark
line. Because some times i test devices for other people and forget to
delete h2w files and then the other person probably do not know that this
files can be removed to gain more free space on inspected storage device.

With new trid definition all hundreds of inspected H2w examples are now
recognized ( see appended output/trid-new.txt). TrID definition and output
are stored in archive h2w_trid.zip. I hope that the XML file can be used
in future version of triddefs.

With best wishes
Jörg Jenderek
7
Definitions DB change log / Re: Current
« Last post by Mark0 on November 13, 2018, 02:58:57 pm »
Added:
  • Hippel module (HIP)
  • Hippel 7V module (HIP7)
  • Borland Turbo Vision Help (HLP)
  • JayTrax module (JXS)
  • Lionheart module (LION)
  • MegaStation module (MS)
  • MegaStation MIDI module (MSM)
  • Borland Turbo Vision Resource (RES)
  • GoatTracker chiptune (v2) (SNG)
  • Hippel ST module (SOG)
Deleted:
  • Game Music Creator Music (GMC)
8
Definitions DB change log / Re: Current
« Last post by Mark0 on November 12, 2018, 01:04:18 pm »
Updated:
Added:
  • Davex archived volume image ()
  • HyperStudio sampled sound ()
  • SoundSmith sequence ()
  • CustomMade module (CM)
  • Cramfs ROM filesystem package (little endian) (CMG)
  • Cybertracker module (CT)
  • Dave Lowe New module (DLN)
  • Delta Music 2 module (DM2)
  • Macrium Reflect backup definition (XML)
9
Thanks, will include it in the next update!
10
Hello trid users,

some days ago i run Sequoia on my disks to find files not known by
that program. I found many file with name extension
"automaticdestinations-ms". When i run TrID on these examples some are
not identified by automaticDestinations-ms.trid.xml as "Windows 7 Jump
List" ( See appended output/trid-old.txt)

So i run tridscan to refine the trid definition file. What has
changed?  The UTF string DestList appear also at other offset than
1280. So the corresponding XML construct vanish:

   <Bytes>44006500730074004C006900730074</Bytes>
   <ASCII> D . e . s . t . L . i . s . t</ASCII>
   <Pos>1280</Pos>

When i run the file command with -i option it reports
"application/CDFV2" for mime type ( See appended
output/file-i.txt). So express this now by additional line:

   <Mime>application/CDFV2</Mime>

As reference URL a sub page from Microsoft's Windows 7 was used. But
Microsoft say good by to Windows 7. So the used link now redirect to a
page with a request to upgrade to Windows 10. So i look for another
one.  Unfortunately there seems to do not exist an official page about
jump list on Microsoft web servers. So I look for another reliable
reference. So i finally used this one:

   <RefURL>https://www.forensicswiki.org/wiki/Jump_Lists</RefURL>

With new trid definition all inspected Windows Jump list are now
recognized (see appended output/trid-new.txt). TrID definition and
output are stored in archive automaticDestinations-ms.zip. I hope that
the XML file can be used in future version of triddefs

With best wishes
Jörg Jenderek
Pages: [1] 2 3 ... 10