-
Notifications
You must be signed in to change notification settings - Fork 30
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
I started analyzing ECLab.exe, here are my first results #80
Comments
It looks like the bytes between the labels do not hold type information. They seem to be:
At least I can now read all column labels and units. I think I will look further into this and try and find the type information. |
Thanks @ilka-schulz , this looks very helpful. I will look at it in more detail next week when I have some vacation. |
There is also an experimental way to find out all columns: I think we could try to synthesize our own MPR files and add columns with different colIDs. For each colID, we could try different column widths (2, 4 or 8 bytes). We could then try to convert these MPR files to MPT files using the EC-Lab GUI. @chatcannon If you could write the code to synthesize MPR files, I would manually do the work of converting them with EC-Lab. Judging from the strings found in the Anyways, I will probably start to work my way into disassembling. That might be the cleaner way and maybe that skill will be useful in the future ;) |
I have been playing around with radare2 and ghidra but I was not able to retrieve the type information of those columns. I will now try to synthesize MPR files and let EC-Lab convert them to MPT files. I bet I can automate the process and let my program handle the EC-Lab GUI. Anyways, I will be on holiday at the end of the year, so do not expect results for another month. |
@ilka-schulz, did you see any change in EC-Lab 11.50? The galvani code isn't working for newer versions, but hopefully some small fixes in the "MPTfileCSV" function might be a temporary solution. If you didn't, sorry for the dumb question, but which software did you use to check the exe file? (just to be sure I am not missing anything, I wasn't able to find this info with objdump) |
@fg-personal galvani has been updated and should work fine now with EC-Lab v11.50 |
I followed up the discussion in the other issue, looking forward for the new release (the one after 0.3.0) including the changes |
I started looking at the installed
EClab.exe
(version 11.36) and found some interesting data. Apparently, all column names are stored in a sorted array at 0x143E56D and continuing:There are some bytes of variable length between the column names and it looks like they might contain type information. Anyways, I will work on this with low priority but I will share my findings as soon as I have more.
The text was updated successfully, but these errors were encountered: