geutebruck/analyze_geviset.py

#!/usr/bin/env python3
"""
Analyze GeViSet configuration file format
"""
import struct
import hashlib
from pathlib import Path

def hex_dump(data, offset=0, length=512):
    """Create a hex dump of binary data"""
    for i in range(0, min(length, len(data)), 16):
        hex_str = ' '.join(f'{b:02x}' for b in data[i:i+16])
        ascii_str = ''.join(chr(b) if 32 <= b < 127 else '.' for b in data[i:i+16])
        print(f'{offset+i:08x}  {hex_str:<48}  {ascii_str}')

def analyze_structure(data):
    """Analyze the binary structure of the .set file"""
    print("=" * 80)
    print("GEVISET FILE STRUCTURE ANALYSIS")
    print("=" * 80)
    print()

    # First, let's dump the beginning
    print("First 512 bytes (hex dump):")
    print("-" * 80)
    hex_dump(data, 0, 512)
    print()

    # Try to identify sections
    print("\nSearching for section markers...")
    print("-" * 80)

    pos = 0
    sections = []

    while pos < len(data) - 4:
        # Check if this looks like a length-prefixed string
        try:
            # Try reading as 2-byte length prefix
            if pos + 2 <= len(data):
                length = struct.unpack('<H', data[pos:pos+2])[0]

                # Reasonable string length (not too long, not zero)
                if 2 <= length <= 100 and pos + 2 + length <= len(data):
                    # Try to decode as string
                    try:
                        text = data[pos+2:pos+2+length].decode('utf-8', errors='strict')
                        # Check if it looks like a section name
                        if text.isprintable() and ' ' in text or text[0].isupper():
                            sections.append({
                                'offset': pos,
                                'length': length,
                                'name': text,
                                'next_bytes': data[pos+2+length:pos+2+length+10].hex()
                            })
                            pos += 2 + length
                            continue
                    except UnicodeDecodeError:
                        pass
        except:
            pass

        pos += 1

    print(f"Found {len(sections)} potential sections:")
    for i, sec in enumerate(sections[:50]):  # Show first 50
        print(f"  {sec['offset']:08x}: len={sec['length']:3d} name='{sec['name']}' next={sec['next_bytes']}")

    print()

    # Look for the checksum pattern
    print("\nSearching for MD5 checksums (32 hex chars)...")
    print("-" * 80)

    text_data = data.decode('latin-1', errors='replace')
    import re
    checksums = re.finditer(r'[0-9a-f]{32}', text_data)

    for match in checksums:
        offset = match.start()
        checksum = match.group()
        context_before = text_data[max(0, offset-30):offset]
        context_after = text_data[offset+32:offset+62]
        print(f"  {offset:08x}: {checksum}")
        print(f"    Before: {repr(context_before[-20:])}")
        print(f"    After:  {repr(context_after[:20])}")
        print()

def main():
    file_path = Path(r'C:\Users\Administrator\Desktop\GeViSoft.set')

    print(f"Analyzing: {file_path}")
    print(f"File size: {file_path.stat().st_size:,} bytes")
    print()

    data = file_path.read_bytes()
    analyze_structure(data)

if __name__ == '__main__':
    main()