Reverse Engineering Unknown File Formats with ImHex

In this account, we explore the process of reverse engineering an unknown file format using ImHex, a hex editor developed by the author. The task begins with obtaining a save file from the game FEZ, which is discovered to be uncompressed and unencrypted. This allows the identification of various file formats and libraries associated with the game.

The save file is generated by a C# program, which is relatively easy to reverse engineer due to its nature. The author identifies several interesting files, including EasyStorage - PCSaveDevice, which appears to be responsible for saving the game's data.

By analyzing the Save() function, the author discovers that the timestamp is written to the file as a Windows File Time, a 64-bit value representing the number of 100ns intervals since January 1, 1601. To facilitate analysis, a struct FezSaveFile is created in the Pattern Editor of ImHex, which allows for the decoding of this timestamp value.

Additionally, the Save() function ensures that the save file is always 0xA000 bytes long. To enforce this rule in the Pattern file, the [[fixed_size(0xA000)]] attribute is added to the FezSaveFile struct.

Overall, this account provides a step-by-step guide on how to reverse engineer an unknown file format using ImHex, showcasing the process of identifying key elements, creating a pattern, and ultimately decoding the data.