// HACKER NEWS — CYBERSECURITY
Reverse Engineering Unknown File Formats with ImHex
An Introduction to File Formats and ImHex by Reverse Engineering FEZ's Save File Format
Over the years I’ve been asked the same question countless times:
I usually couldn’t really give them a good answer except, “Look at the decompiled code of whatever program reads/writes these files and work backwards from there.” This post is meant to change that. We’ll go from a completely custom binary save file for the game FEZ to a full definition written in the Pattern Language, which is part of ImHex, the hex editor I’ve been developing for the past few years. It is free, open source and available on any operating system (or even through the browser if you prefer that: ImHex Web).
At the time of writing, some features used here are not in a release yet but only available in the Nightly build (that can also be downloaded above from the same link).
If you’re on ImHex v1.38.1 or below and experiencing issues, consider upgrading to the Nightly build
FEZ was released all the way back in 2012. Still, if you haven’t played it yet and want to get the full experience, I highly recommend playing it before you continue reading. Some of the code shown here will contain heavy spoilers for secrets and endgame content that might ruin your experience. You have been warned.
The first thing we need is the save file. I downloaded the game from Steam (the latest full release currently available, released 2. December 2016), started it and played for a little bit until it saved. Then I went looking through my filesystem and found the save file under /home/werwolv/.local/share/FEZ/SaveSlot2. On Windows, it will be elsewhere.
This already reveals a few things. The file seems to be uncompressed and unencrypted, as seen by the plain-text strings and other patterns in the file that can be easily spotted by just looking at the bytes and characters. The data also doesn’t have a file magic (some readable text at the start of the file to make it more easily identifiable), and it doesn’t look like anything standard, as ImHex can’t identify its type directly either.
Without any more information, we’re basically stuck here. The data can mean anything, and only the program generating and parsing it can make sense of it.
Clicking on the gear icon on the Steam page and selecting Manage -> Browse local files brings us to the game’s binary location. What immediately sticks out are files like System.Core.dll or mscorlib.dll. The game is written in the C# programming language, which is generally really easy to reverse engineer. Tools like JetBrains Rider can decompile the binaries back to what looks like the original source code.
For that, we can open the game’s folder as a project and then simply Right Click -> View in Assembly Explorer for all the .dll files that look interesting. To me, particularly interesting were FEZ.exe, FezEngine.dll, Common.dll, ContentSerialization.dll and EasyStorage.dll. The rest are system libraries or external dependencies that look unrelated to what we’re trying to do here.