// HACKER NEWS — CYBERSECURITY
Reverse engineering the storage format for an undocumented database
We constantly work with different datasets that we normalize into our data lake. Recently we received CronosPro database files (CroBank.dat, CroIndex.dat, and CroStru.dat) that were thought to be broken because existing tooling could not parse them correctly.
Anyone who has worked with the CronosPro format, knows that its raw datafiles are notoriously difficult to convert into machine-readable formats such as CSV. A good amount of work has been put into the Cronos dump converter Cronodump alephdata/cronodump, but due to the version specific nuances of the database file structures, it doesn’t work 100% of the time. For the purpose of tackling this problem, we employed Codex for analyzing the dump structure and improved upon the Cronodump codebase to fix the parsing of the allegedly broken database.
Cronodump converter could read much of the format, but it could not decode this particular dump correctly. We had to understand how the files fit together, recover an obfuscated schema, fix several parser assumptions, and validate that parsed values still appeared under the correct schema columns.
This article explains that process from the beginning with no prior knowledge of Cronos assumed.
Cronos, also known as CronosPro, is a proprietary desktop database and information-management system. It has historically been used by organizations in Russia and other post-Soviet countries to build registries, searchable archives, document collections, and internal information systems.
A Cronos installation uses slightly different terminology from a conventional database:
A Cronos database is normally represented by several related binary files:
The .dat files contain data. Their corresponding .tad files act as directories, telling the software where records are located inside each .dat file.
This distinction became central to the recovery. The record data itself was readable, but the schema needed to interpret it was protected.
In this article, normalization does not mean relational database normalization into first, second, or third normal form.