Reverse Engineering Unknown File Formats with ImHex

Over the years, many have asked a recurring question about reverse engineering custom file formats. The author of this post aims to answer that by demonstrating how to take a unique save file from the game FEZ and define it using the Pattern Language in ImHex, their free and open-source hex editor. The save file is uncompressed, unencrypted, lacks a magic number, and does not conform to standard formats, making it difficult to decipher.

The author locates the save file on the user's system, finds it is generated by a C# program, and identifies specific DLL files related to the game's functionality.

By examining the game's source code, the author finds a class named EasyStorage.PCSaveDevice, which contains a Save method responsible for creating the save file. The author constructs a FezSaveFile struct in ImHex to represent the save file format and highlights the timestamp written by the game. The timestamp is represented as a Windows File Time, a little-endian 64-bit value. The author suggests decoding this value or using a predefined type for a more readable representation.

Additionally, the Save method ensures the save file is always 0xA000 bytes long, padding with zeros if necessary. The author suggests using the [[fixed_size(0xA000)]] attribute to document the file format's behavior. The post concludes by demonstrating how to write a complete pattern in ImHex to decode the save file, marking the completion of the first pattern.