[Fixed] Creating photorec signature for Minecraft Xbox 360 world Topic is solved

[RACKwAir]

Hello! As the title suggests, I'm trying to create a file signature for a minecraft xbox 360 world to recover it with photorec. Photorec support's xfat (xbox partition), however all of the minecraft world's on xbox 360 are binary .bin files, this is a problem because all files on the xbox 360 are .bin making it impossible to ID which ones are which. I downloaded 2 random xbox 360 minecraft maps off the internet, and the only thing they both have in common after viewing the hex data in VScodium was "M i n e c r a f t". I provided a screenshot of the two worlds below. However, after reading the wiki multiple times for creating custom sigs, when I try to put this hex data into the viewer, it still can't identify the file. I tried BOTH methods (letters and hex), and the file tester can't ID it.

If anyone can please help me create a custom signature for minecraft 360 .bin world's, I'd highly appreciate it.

The two screenshots below are from separate worlds in the vscodium hex viewer.

Thanks!

Screenshots: https://imgur.com/a/NTMd1S0
(If anyone needs a sample of a Minecraft 360 world, or multiple, let me know)

[recuperation]

I uploaded your files to this site, see pictures below.
Now show us your fingerprint file!

Folgqkr.png (23.2 KiB) Viewed 24673 times

1gnUY6j.png (16.89 KiB) Viewed 24673 times

[RACKwAir]

I uploaded your files to this site, see pictures below.
Now show us your fingerprint file!


Folgqkr.png
1gnUY6j.png

Hello thanks for the reply!

I've tried the following in photorec.sig (located in C:\Users\Account)

bin 0 0x4D0069006E006500630072006100660074
bin 0 4D0069006E006500630072006100660074
bin 0 "M i n e c r a f t"

When I run fidentify I get:
.\fidentify_win.exe .\sample.bin .\sample.bin: unknown

[recuperation]

This signature won't work if you pretend that your search string is at offset 0 (beginning of your Minecraft file) whereas the grey text "1690" suggests something completely different.

As I won't install your editor I recommend you doing the following:

Use the editor named "Hxd" and load both Minecraft files. Make a screenshot from offset 0 until 1F0 for both files and we both will have a look at it.
Maybe you will find something even without my help.
No - I don't have Minecraft and won't install it for you, sorry, but I will of course look at the pictures.

[RACKwAir]

This signature won't work if you pretend that your search string is at offset 0 (beginning of your Minecraft file) whereas the grey text "1690" suggests something completely different.

As I won't install your editor I recommend you doing the following:

Use the editor named "Hxd" and load both Minecraft files. Make a screenshot from offset 0 until 1F0 for both files and we both will have a look at it.
Maybe you will find something even without my help.
No - I don't have Minecraft and won't install it for you, sorry, but I will of course look at the pictures.

Just installed it.

Here's the two images, the top one is sample world A and the bottom is sample world B.

A1.png (442.27 KiB) Viewed 24609 times

B1.png (446.05 KiB) Viewed 24609 times

I also would like to point out that "m i n e c r a f t" still appears on both files on HxD at 1690.

B2.png (15.11 KiB) Viewed 24609 times

Thanks for the help!

[RACKwAir]

I would like to make clear that the "CON" at the start is in EVERY xbox 360 file binary file, so it's not unique therefore useless sadly. However it does work when I do "bin 0 0x434F4E" in the sig file. Sadly though I think the only thing I need is the "m i n e c r a f t". I just don't know how to make photorec recognize that part which is far below. I tried "bin 1690 "m i n e c r a f t" and it didn't work.

[recuperation]

Have you read chapter 12 in the manual?

The following is related to the second possible fingerprint:

Fingerprints are not necessarily based on readable letters of the alphabet.
You already discovered some common element of all your Xbox files, the "CON" at the beginning. There is more than that right in front of your eyes. Check symbol by symbol. Each symbol or letter to the right hand side is described by one byte to the left.

To describe one byte you need two hexadecimal values ranging from 0 to F (0123456789ABCDEF). One byte (8 bit) can also be represented by a decimal number ranging from 0 to 255. Both type of values (offset and content) are expressed in hexadecimal notation.

Now we continue with the fingerprint you intend to use:

I tried "bin 1690 "m i n e c r a f t" and it didn't work.

There are three errors in here. I don't mind two of the them.

First error:
Now look at the screenshot from HxD. What number system is being used here?
How do you tell you Photorec about it?

Second error:
I can't find the word "m i n e c r a f t" . For this error you should be spanked, really.
What is wrong here ?!!!

Third error:
To be continued!

[RACKwAir]

Have you read chapter 12 in the manual?

The following is related to the second possible fingerprint:

Fingerprints are not necessarily based on readable letters of the alphabet.
You already discovered some common element of all your Xbox files, the "CON" at the beginning. There is more than that right in front of your eyes. Check symbol by symbol. Each symbol or letter to the right hand side is described by one byte to the left.

To describe one byte you need two hexadecimal values ranging from 0 to F (0123456789ABCDEF). One byte (8 bit) can also be represented by a decimal number ranging from 0 to 255. Both type of values (offset and content) are expressed in hexadecimal notation.

Now we continue with the fingerprint you intend to use:

I tried "bin 1690 "m i n e c r a f t" and it didn't work.

There are three errors in here. I don't mind two of the them.

First error:
Now look at the screenshot from HxD. What number system is being used here?
How do you tell you Photorec about it?

Second error:
I can't find the word "m i n e c r a f t" . For this error you should be spanked, really.
What is wrong here ?!!!

Third error:
To be continued!

Thanks for the info! After putting your hints together, I think I figured it out.
This syntax positively IDs the file:
bin 0x1690 0x00004D0069006E00650063007200610066007400

After changing some hex info to test it out, this signature will detect anything that states "M i n e c r a f t" at 0x1690.

Thank you I highly appreciate it. Do you know what the third error is?
Thanks again!

[recuperation]

Now, that you stated the fingerprint in hex terms, you eliminated the third error!

For all others to learn: The string "M i n e c r a f t" contains spaces. The ASCII code for the space symbol is decimal 32 (or hexadecimal 20).
But in this case there are no space symbols in the file!
In reality there are bytes containing the value "zero" between the letters of the string "M i n e c r a f t". As there is no ASCII symbol for the "zero" value you can't distinguish on the right side of HxD where the text representation for both zero and decimal 32 is a blank.

When in doubt, use the hexadecimal representation as user RACKwAir did successfully!

[RACKwAir]

Now, that you stated the fingerprint in hex terms, you eliminated the third error!

For all others to learn: The string "M i n e c r a f t" contains spaces. The ASCII code for the space symbol is decimal 32 (or hexadecimal 20).
But in this case there are no space symbols in the file!
In reality there are bytes containing the value "zero" between the letters of the string "M i n e c r a f t". As there is no ASCII symbol for the "zero" value you can't distinguish on the right side of HxD where the text representation for both zero and decimal 32 is a blank.

When in doubt, use the hexadecimal representation as user RACKwAir did successfully!

Thanks again!