2

I would like to extract data from a register stored on a CD from the 90ies. The Windows executable on the CD allows one to browse the database with keywords and by specific variables. However, there is no manual option of exporting this data in a structured way. I guess that the .exe program accesses the information stored in the folder "DATABASE".

Content of CD

Opening the largest file with 21.7MBs in Xcode, this is what the first lines looks like:

=iulm?=ide?=uhumd?Ghsldo!eds!odtdo!Ctoedrm'"339:oeds=.uhumd?=.ide?=cnex?=i2?@cmrrds!Gs'"343:biuding!FlcI=.i2?=cs?Mdhrohfds!Bitrrdd!2-!15678!@cm'"332:=cs?=c?Ctoedrmoe;!=.c?Rbirdo=cs?=c?U;!=.c?)125273(!2!19!27!=c?Gy;!=.c?2!19!27=cs?=c?Csobido,Os;!=.c?=!isdg<#10020#?10020=.?=cs?=c?Ioedmrsdfhruds;!=.c?@lurfdshbiu!Mdhq{hf!ISC!2470=cs?=c?Coj)do(;!=.c?Shggdhrdocj!Fshll=cs?=c?Fs'"343:oetof;!=.c?0881!)33/!Ed{dlcds(=cs?=c?Fdrbi'"339:gurg'"343:isds;!=.c?Fsudoct,Hof/!Cdsoe!Mdiloo-!Limhr=cs?=c?Fdrdmmrbiguds;!=.c?Ncrumoe!E'"343:ssvdhu{rbido!@F!,!011!$=cs?=c?Fdrbi'"339:guru'"339:uhfjdhu;!=.c?Ds{dtftof!wno!Ncru!kdfmhbids!@su=cs?=c?Rull,Jqhum;!=.c?EL!1-14!Lhn=cs?=c?Cdrbi'"339:guhfud!0887;!=.c?6=cs?=c?Tlru{!0884;!=.c?EL!1-4!Lhn:!0885;!EL!0-0!Lhn=cs?=rlmm?Inqqdorudeu,Ghsldootllds;!209!672!703.86.O=.rl`mm?=.cnex?=.iulm?

How can I convert this and make sense of it?

  • Please give the first few bytes in hex. Then check magic numbers – Grimaldi Jun 9 '17 at 19:08
  • Something like that: 3D69756C 6D3F0C0B 3D696460 653F0C0B 3D756875 6D643F47 68736C64 6F216564 73216F64 74646F21 ? – moezelot Jun 9 '17 at 19:24
  • Can you provide an archive of the disk? Looks like it's tiny. Really this should be on the RE stackexchange. – TkTech Jun 10 '17 at 1:58
  • I only have the big .dat file at the moment. Someone suggested it could be xml with an xor encoding. Anyone knows how to decode that? And thanks, will post something like that at Reverse Engineering next time... – moezelot Jun 10 '17 at 19:29
3

I received some help on it. Something along these lines with xor in Python did the job:

with open('...dat', 'rb') as f:
    with open('...txt', 'w') as out:
        xor = 1
        s = ""

        while True:
            c = f.read(1)
            if c == "" or len(c) == 0:
                break

            c = chr(ord(c) ^ xor)

            s += str(c)
            if len(s) > 7:
                s = s[1:]

            out.write(c)

            if s == "</html>":
                xor = (xor + 1) % 163
                s = ""
                out.write('\n')

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.