确定加密/散列/压缩的专有驱动程序文件

逆向工程 司机
2021-06-19 11:18:52

我有一个文件，我正在尝试了解其结构和格式。它是 NEC LT380 投影机控制系统的专有驱动程序文件，其中包含基本信息，如 TCP 端口号和投影机接受的可用命令，如电源开/关、开关输入和纵横比等。

我对文件进行了一些测试，并能够确定一些事情：

  1. 文件内容如下：http : //codepad.org/0pzGkLgT（需要将内容保存成文件，然后用gzip软件打开）
  2. 我能够确定文件是 gzip 压缩的，并且在提取时，zip 包含一个没有扩展名的文件。
  3. 这是解压文件的内容：http : //codepad.org/yvuceZcD（要阅读此内容，请使用十六进制查看器打开）
  4. Online TrID File Identifier 似乎将提取的文件识别为 ABR 或 Adob​​e Photoshop Brush，这当然是不正确的。
  5. 然后我使用文本编辑器打开提取的文件，它只显示一堆十六进制字符串。
  6. 这让我在 HexEdit 中打开了 hex 文件。这一次，我能够看到一些人类可读的语法和代码。

  7. 文件的开头和结尾包含一些不可读的字符串和一些语法，例如“ Culture=neutral, PublicKeyToken=null ”。这些语法似乎暗示了它的 .NET 相关，但我不太确定究竟是哪种 .NET 文件。在文件的中间部分，有一堆代码，经过进一步调查，看起来像 python 代码。例子：

    def ReadAspectRatio(self, qualifier, context):

  8. 此外，在同一个文件中，我发现了一些标签：**<</Type/Catalog/Pages 2 0 R/Lang(en-US) >>**通常在 PDF 文件中找到。使用 PDF 修复工具，我能够将该文件的流恢复并重建为一个正确的 PDF 文件，其中包含几页投影仪命令和端口信息。

问题：

  1. 你有办法确定这是什么类型的文件吗？或者对这个文件做了什么，因为在一个文件中似乎有 3 种不同的东西：.NET 东西（可能是清单文件或对 .NET 程序集的引用），对设备执行设置/读/写命令的 Python 代码和最后是PDF流。在文件的开头和结尾是否进行了混淆或文件连接方法或哈希处理？
  2. 我正在寻找重新创建和模拟文件。目前，如果我只是打开提取的文件，通过在适当的 python 代码中添加一些简单的额外选项/命令来编辑文件的中间部分，保存它并 gzip 回它，它不起作用。

谢谢！

2个回答

该文件似乎是二进制序列化的 .NET 文件（在概念上类似于 Python pickle 或 Java 序列化流），并且似乎没有以任何方式进行混淆。我使用Microsoft 的流格式规范中的参考手动解析了前几条记录，并检查了格式。该文件存储类型为“Extron.Configuration.Drivers.DriverFileAsset”的单个对象，具有 18 个不同类型的类成员。

我猜测这种格式是基于它在标头中包含 .NET 类库标识符的事实，然后通过检查文件格式规范来验证猜测。

我为这种格式编写了一个解析器，尽管它不完整。文件的转储如下所示：

Binary Serialization Format
@0
  SerializedStreamHeader(TopId=1, HeaderId=-1, MajorVersion=1, MinorVersion=0)
@17
  BinaryLibrary(LibraryId=2, LibraryName='Extron.Configuration.Drivers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')
@106
  BinaryLibrary(LibraryId=3, LibraryName='Extron.Configuration.Core, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')
@192
  BinaryLibrary(LibraryId=4, LibraryName='Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')
@283
  BinaryLibrary(LibraryId=5, LibraryName='WindowsBase, Version=3.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35')
@367
  ClassWithMembersAndTypes LibraryId=2 ObjectId=1 Name=Extron.Configuration.Drivers.DriverFileAsset:
      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _manifest
          MemberReference(IdRef=6)
      Extron.Configuration.Contracts.Enumeration.DriverPackageStateEnum _packageState
          ClassWithMembers LibraryId=4 ObjectId=-7 Name=Extron.Configuration.Contracts.Enumeration.DriverPackageStateEnum:
              value__ = 0
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=8)
      System.Version DriverDescriptorAsset+_fileVersion
          MemberReference(IdRef=9)
      System.Version DriverDescriptorAsset+_schemaVersion
          MemberReference(IdRef=10)
      System.Version DriverDescriptorAsset+_minAPIVersion
          MemberReference(IdRef=11)
      String DriverDescriptorAsset+_manufacturerName
          BinaryObjectString(ObjectId=12, Value='NEC')
      String DriverDescriptorAsset+_deviceTypeName
          BinaryObjectString(ObjectId=13, Value='Video Projector')
      String DriverDescriptorAsset+_filename
          BinaryObjectString(ObjectId=14, Value='\\\\usa-home10\\home\\wes minner\\programming\\reviews\\nec_1_548 [nec lt280]\\finished\\nec_1_548_v1_0_0.pkp')
      Int32 DriverDescriptorAsset+_contentHashCode
          0
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] DriverDescriptorAsset+_internalChildCollection
          MemberReference(IdRef=8)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=8)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=16, Value='nec_1_548')
      String AssetBase+_name
          MemberReference(IdRef=16)
      System.Guid AssetBase+_guid
          SystemClassWithMembers ObjectId=-17 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Contracts.Assets.IAsset AssetBase+_parentAsset
          ObjectNull()
@2396
  ClassWithMembersAndTypes LibraryId=3 ObjectId=6 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=18)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          ObjectNull()
      String AssetBase+_name
          ObjectNull()
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-19 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Contracts.Assets.IAsset AssetBase+_parentAsset
          ObjectNull()
@3412
  ClassWithMembers LibraryId=5 ObjectId=8 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=20)
      Collection`1+items = MemberReference(IdRef=21)
@3653
  SystemClassWithMembers ObjectId=9 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@3724
  ClassWithId ObjectId=10 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@3749
  ClassWithId ObjectId=11 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@3774
  ClassWithMembers LibraryId=5 ObjectId=18 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=22)
      Collection`1+items = MemberReference(IdRef=23)
@4023
  ClassWithMembers LibraryId=5 ObjectId=20 Name=System.Collections.ObjectModel.ObservableCollection`1+SimpleMonitor[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _busyCount = 0
@4255
  SystemClassWithMembers ObjectId=21 Name=System.Collections.Generic.List`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _items = MemberReference(IdRef=24)
      _size = 6
      _version = 6
@4469
  ClassWithMembers LibraryId=5 ObjectId=22 Name=System.Collections.ObjectModel.ObservableCollection`1+SimpleMonitor[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _busyCount = 0
@4709
  SystemClassWithMembers ObjectId=23 Name=System.Collections.Generic.List`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _items = MemberReference(IdRef=25)
      _size = 2
      _version = 2
@4931
  BinaryArray(ObjectId=24, BinaryArrayTypeEnum=<BinaryArrayType.Single: 0>, Rank=1, Lengths=(8,), LowerBounds=None, TypeEnum=<BinaryType.Class: 4>, AdditionalTypeInfo=ClassTypeInfo(TypeName='Extron.Configuration.Contracts.Assets.IAsset', LibraryId=4))
      MemberReference(IdRef=26)
      MemberReference(IdRef=27)
      MemberReference(IdRef=28)
      MemberReference(IdRef=29)
      MemberReference(IdRef=30)
      MemberReference(IdRef=31)
      ObjectNullMultiple256(NullCount=2)
@5027
  BinaryArray(ObjectId=25, BinaryArrayTypeEnum=<BinaryArrayType.Single: 0>, Rank=1, Lengths=(4,), LowerBounds=None, TypeEnum=<BinaryType.Class: 4>, AdditionalTypeInfo=ClassTypeInfo(TypeName='Extron.Configuration.Contracts.Assets.IResourceAsset', LibraryId=4))
      MemberReference(IdRef=32)
      MemberReference(IdRef=33)
      ObjectNullMultiple256(NullCount=2)
@5111
  ClassWithMembersAndTypes LibraryId=3 ObjectId=26 Name=Extron.Configuration.Core.Assets.RevisionHistoryAsset:
      DateTime _date
          2014-08-01 02:08:28.537000
      String _author
          BinaryObjectString(ObjectId=34, Value='ngupta')
      System.Version _version
          MemberReference(IdRef=35)
      String _notes
          BinaryObjectString(ObjectId=36, Value='')
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=37)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=37)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=38, Value='Creation')
      String AssetBase+_name
          MemberReference(IdRef=38)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-39 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@6090
  ClassWithId ObjectId=27 Name=Extron.Configuration.Core.Assets.RevisionHistoryAsset:
      DateTime _date
          2014-08-01 02:08:28.537000
      String _author
          BinaryObjectString(ObjectId=34, Value='ngupta')
      System.Version _version
          MemberReference(IdRef=35)
      String _notes
          BinaryObjectString(ObjectId=36, Value='')
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=37)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=37)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=38, Value='Creation')
      String AssetBase+_name
          MemberReference(IdRef=38)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-39 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@6195
  ClassWithMembersAndTypes LibraryId=3 ObjectId=28 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=48)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=49, Value='DriverCommands')
      String AssetBase+_name
          MemberReference(IdRef=49)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-50 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@7264
  ClassWithMembersAndTypes LibraryId=3 ObjectId=29 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=52)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=53, Value='SupportedProtocols')
      String AssetBase+_name
          MemberReference(IdRef=53)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-54 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@8331
  ClassWithMembersAndTypes LibraryId=3 ObjectId=30 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=56)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=57, Value='SupportedModels')
      String AssetBase+_name
          MemberReference(IdRef=57)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-58 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@9397
  ClassWithMembersAndTypes LibraryId=3 ObjectId=31 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=60)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          ObjectNull()
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=61, Value='DriverParams')
      String AssetBase+_name
          MemberReference(IdRef=61)
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-62 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset
          MemberReference(IdRef=1)
@10454
  ClassWithMembersAndTypes LibraryId=3 ObjectId=32 Name=Extron.Configuration.Core.Assets.Resource.StreamResourceAsset:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=64)
      String ResourceAssetBase+_key
          BinaryObjectString(ObjectId=65, Value='nec_1_548_v1_0_0.pdf')
      Object ResourceAssetBase+_content
          MemberReference(IdRef=66)
      Object ResourceAssetBase+_tag
          BinaryObjectString(ObjectId=67, Value='nec_1_548_v1_0_0.pdf')
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] ResourceAssetBase+_internalChildCollection
          MemberReference(IdRef=64)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=64)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=69, Value='nec_1_548_v1_0_0.pdf')
      String AssetBase+_name
          BinaryObjectString(ObjectId=70, Value='nec_1_548_v1_0_0.pdf')
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-71 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_parentAsset
          MemberReference(IdRef=6)
@11913
  ClassWithId ObjectId=33 Name=Extron.Configuration.Core.Assets.Resource.StreamResourceAsset:
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection
          MemberReference(IdRef=64)
      String ResourceAssetBase+_key
          BinaryObjectString(ObjectId=65, Value='nec_1_548_v1_0_0.pdf')
      Object ResourceAssetBase+_content
          MemberReference(IdRef=66)
      Object ResourceAssetBase+_tag
          BinaryObjectString(ObjectId=67, Value='nec_1_548_v1_0_0.pdf')
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] ResourceAssetBase+_internalChildCollection
          MemberReference(IdRef=64)
      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection
          MemberReference(IdRef=64)
      String AssetBase+_defaultName
          BinaryObjectString(ObjectId=69, Value='nec_1_548_v1_0_0.pdf')
      String AssetBase+_name
          BinaryObjectString(ObjectId=70, Value='nec_1_548_v1_0_0.pdf')
      System.Guid AssetBase+_guid
          ClassWithId ObjectId=-71 Name=System.Guid:
              _a = 2458436383
              _b = 50071
              _c = 18042
              _d = 169
              _e = 134
              _f = 255
              _g = 167
              _h = 142
              _i = 29
              _j = 19
              _k = 168
      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount
          ObjectNull()
      Boolean AssetBase+_disableChildAssetParenting
          False
      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_parentAsset
          MemberReference(IdRef=6)
@12046
  ClassWithId ObjectId=35 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@12071
  ClassWithId ObjectId=37 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=20)
      Collection`1+items = MemberReference(IdRef=21)
@12090
  ClassWithId ObjectId=42 Name=System.Version:
      _Major = 1
      _Minor = 0
      _Build = 0
      _Revision = -1
@12115
  ClassWithId ObjectId=44 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=20)
      Collection`1+items = MemberReference(IdRef=21)
@12134
  ClassWithMembers LibraryId=5 ObjectId=48 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=86)
      Collection`1+items = MemberReference(IdRef=87)
@12396
  ClassWithMembers LibraryId=5 ObjectId=52 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=88)
      Collection`1+items = MemberReference(IdRef=89)
@12655
  ClassWithMembers LibraryId=5 ObjectId=56 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=90)
      Collection`1+items = MemberReference(IdRef=91)
@12915
  ClassWithMembers LibraryId=5 ObjectId=60 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=92)
      Collection`1+items = MemberReference(IdRef=93)
@13172
  ClassWithId ObjectId=64 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:
      _monitor = MemberReference(IdRef=20)
      Collection`1+items = MemberReference(IdRef=21)

如果您首先导入驱动程序库，您或许能够使用某些 .NET 函数加载文件。否则，您可以使用规范（非常易于阅读）来反汇编文件并提取您想要的内容。

正如您所指出的，里面嵌套了更多文件。因此，您的第一步应该是解析序列化流以提取所有内容，然后解析每个类成员的内容（其中一些是完整的文件，如 PDF 和 PKP 文件）。

通常，我不相信谷歌搜索“xyz 文件格式”，因为它们会返回各种不道德的“如果您有 xyz 文件，请在此处下载我们的注册表清理器”站点。但在这种情况下，其中一个链接是http://extension.nirsoft.net/pkp，它声称 .pkp 文件可能是一个 Visual Studio 打包项目——考虑到文件的内容，这实际上听起来很合理。

此外，文件中的一个字符串是它曾经拥有的完整路径：\\usa-home10\home\wes minner\programming\reviews\nec_1_548 [nec lt280]\finished\nec_1_548_v 1_0_0.pkp，并且许多字符串包含公司名称 Extron。谷歌搜索wes minner extron找到了一个人的LinkedIn 个人资料，他的工作描述是“用 Python 编写和审查设备驱动程序”。

我建议您尝试以下方法之一：

  • 获取一份 Visual Studio 并检查它是否可以将您的文件作为项目文件导入
  • 使用 LinkedIn 个人资料联系创建您文件的人，并询问他文件的类型；这可能比使用公司的官方渠道之一产生更好的结果。

似乎有时也有非技术性的逆向工程方法......

其它你可能感兴趣的问题
上一篇定义可移植可执行位数 64 与 32 的方法 下一篇如何重新调整 IDA 以匹配 GDB