That's gone well*
Next up is AOMEI which looks like this and has shown me several popup ads already.
AOMEI seems to be running okay, but the "ADI" file format starts with a header of "BIFH" instead of anything I'd expect. I can't easily find a file format description.
**
Stopping for now, there's still too much I don't understand in even the uncompressed files. Samples at https://static.voltagex.org/aomei/sample.7z, 100kb download, 100MB unpacked.
Files created with qemu 7 and https://www2.aomeisoftware.com/download/adb/AOMEIBackupperStd.exe (7.4.0)
**
Can someone ask the EU to mandate that all file formats are described publicly so I don't have to do this, as fun as it is?
#ReverseEngineering Start of ADI file format:
Spent way too long chasing compressed data that was actually Unicode. All strings written by the application are unicode.
Header BIFH
Trailer BIFT
Bytes between 10h and 2Fh change dramatically per file
Drive ID at 3984789 [3CCD95h] probably depends on length of file but needs more investigation because it might be a *destination* drive ID
Comment at 3984432 [3CCC30h]
Filename / Backup name at 44h
Data is going to take a lot more work but if you have UNCOMPRESSED ADI files (not the default!) you MAY be able to carve your data straight out of the file.
If the backup is compressed, it's zlib.
Edited 189d ago