Help Me Understand This Binary File Format

I am attempting to write a small utility to produce a binary file that will mimic the one produced by another closed application. I've used hex editor开发者_如何学运维s to decrypt the format by I'm stuck trying to understand what the format/encoding is so that I can produce it using C++ or C#.

The file starts with the first four bytes: 01 00 followed by FF FE. My understanding is that the file begins with SOH followed by the byte order mark for little endian. After these four bytes, the program appears to write BSTR's for each of the string fields from the app's GUI.

Using C#, I have produced a unicode file that starts with FF FE, but I'm not sure how to insert the SOH character first.

I would be forever grateful if someone could offer insight to the file format or encoding and why the file starts with the SOH character.

Thank you in advance.

---

Reverse engineering a binary file format can be a challenging task. On the surface, I don't recognize this as an obvious, well-known file format ... but there are thousands out there, so who knows.

Legal issues aside, I would suggest you look at some of the following resources that talk about approaches to such an endeavor:

• How To Crack a Binary File Format
• Tools to Reverse Engineer Binary Files
• Basics of Reverse Engineering File Formats
• File Format Reverse Engineering

---

If you are just having trouble writing out the first four bytes this will do it for you.

using (var stream = new FileStream("myfile.bin", FileMode.Create))
{
     using (var binaryWriter = new BinaryWriter(stream))
     {
         binaryWriter.Write((byte)1);
         binaryWriter.Write((byte)0);
         binaryWriter.Write((byte)0xFF);
         binaryWriter.Write((byte)0xFE);
         binaryWriter.Write(Encoding.Unicode.GetBytes("string"));
     }
}

This will output the following file

01 00 FF FE 73 00 74 00 72 00 69 00 6e 00 67 00  ....s.t.r.i.n.g.

Edit: Added Mark H's suggestion for writing out a string.