# Analyze GeViSet configuration file format $filePath = "C:\Users\Administrator\Desktop\GeViSoft.set" Write-Host "=" * 80 Write-Host "GEVISET FILE STRUCTURE ANALYSIS" Write-Host "=" * 80 Write-Host "" $file = Get-Item $filePath Write-Host "File: $($file.FullName)" Write-Host "Size: $($file.Length) bytes" Write-Host "" # Read all bytes $data = [System.IO.File]::ReadAllBytes($filePath) # Hex dump of first 512 bytes Write-Host "First 512 bytes (hex dump):" Write-Host ("-" * 80) for ($i = 0; $i -lt [Math]::Min(512, $data.Length); $i += 16) { $offset = "{0:x8}" -f $i $hexBytes = @() $asciiBytes = "" for ($j = 0; $j -lt 16 -and ($i + $j) -lt $data.Length; $j++) { $byte = $data[$i + $j] $hexBytes += "{0:x2}" -f $byte if ($byte -ge 32 -and $byte -lt 127) { $asciiBytes += [char]$byte } else { $asciiBytes += "." } } $hexStr = $hexBytes -join ' ' Write-Host ("{0} {1,-48} {2}" -f $offset, $hexStr, $asciiBytes) } Write-Host "" Write-Host "Searching for text patterns..." Write-Host ("-" * 80) # Convert to text (Latin-1 encoding to preserve all bytes) $text = [System.Text.Encoding]::GetEncoding("ISO-8859-1").GetString($data) # Find checksums (32 hex chars) Write-Host "" Write-Host "MD5-like checksums found:" $checksumPattern = [regex]'[0-9a-f]{32}' $matches = $checksumPattern.Matches($text) foreach ($match in $matches) { $offset = $match.Index $checksum = $match.Value $beforeStart = [Math]::Max(0, $offset - 30) $beforeText = $text.Substring($beforeStart, $offset - $beforeStart) $afterText = $text.Substring($offset + 32, [Math]::Min(30, $text.Length - $offset - 32)) Write-Host (" Offset 0x{0:x8}: {1}" -f $offset, $checksum) Write-Host (" Before: {0}" -f ($beforeText.Substring([Math]::Max(0, $beforeText.Length - 30)) -replace '[^\x20-\x7E]', '.')) Write-Host (" After: {0}" -f ($afterText -replace '[^\x20-\x7E]', '.')) Write-Host "" } # Look for structure patterns Write-Host "" Write-Host "Section markers (length-prefixed strings):" Write-Host ("-" * 80) $pos = 0 $sections = @() while ($pos -lt ($data.Length - 4)) { # Try reading as little-endian 16-bit length if ($pos + 2 -le $data.Length) { $length = [BitConverter]::ToUInt16($data, $pos) # Reasonable string length if ($length -ge 2 -and $length -le 100 -and ($pos + 2 + $length) -le $data.Length) { try { $textBytes = $data[($pos + 2)..($pos + 2 + $length - 1)] $decodedText = [System.Text.Encoding]::UTF8.GetString($textBytes) # Check if printable and looks like a section name if ($decodedText -match '^[\x20-\x7E]+$' -and ($decodedText -match ' ' -or $decodedText -match '^[A-Z]')) { $nextBytes = "" for ($k = 0; $k -lt [Math]::Min(10, $data.Length - ($pos + 2 + $length)); $k++) { $nextBytes += "{0:x2}" -f $data[$pos + 2 + $length + $k] } $sections += [PSCustomObject]@{ Offset = $pos Length = $length Name = $decodedText NextBytes = $nextBytes } $pos += 2 + $length continue } } catch { # Not valid UTF-8, continue } } } $pos++ } Write-Host "Found $($sections.Count) potential sections (showing first 50):" $sections | Select-Object -First 50 | ForEach-Object { Write-Host (" 0x{0:x8}: len={1,3} name='{2}' next={3}" -f $_.Offset, $_.Length, $_.Name, $_.NextBytes) } Write-Host "" Write-Host "Analysis complete."