Skip to content
Tech News
← Back to articles

Reverse engineering the storage format for an undocumented database

read original get Hex Fiend? No — 010 Editor (binary editor) → more articles
Why This Matters

Reverse-engineering CronosPro's undocumented binary format matters because large volumes of public-interest data — registries and archives from Russia and post-Soviet institutions — remain locked in a proprietary desktop format that existing open-source tooling can only partially parse. The work extends the Cronodump project so 'broken' dumps can be normalized into machine-readable formats like CSV. It also shows AI coding assistants being used practically for binary format analysis and legacy parser repair.

Key Takeaways
Worth a Look

Hex Fiend? No — 010 Editor (binary editor) — Reverse engineering an undocumented binary format like CronosPro is exactly the skill "Practical Reverse Engineering" teaches, walking through how to read raw bytes, spot structures, and rebuild parsers. It's a great companion for anyone who enjoyed following this file-format detective work and wants to try it on their own stubborn .dat files.

See Hex Fiend? No — 010 Editor (binary editor) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

We constantly work with different datasets that we normalize into our data lake. Recently we received CronosPro database files ( CroBank.dat , CroIndex.dat , and CroStru.dat ) that were thought to be broken because existing tooling could not parse them correctly.

Anyone who has worked with the CronosPro format, knows that its raw datafiles are notoriously difficult to convert into machine-readable formats such as CSV. A good amount of work has been put into the Cronos dump converter Cronodump alephdata/cronodump , but due to the version specific nuances of the database file structures, it doesn’t work 100% of the time. For the purpose of tackling this problem, we employed Codex for analyzing the dump structure and improved upon the Cronodump codebase to fix the parsing of the allegedly broken database.

Cronodump converter could read much of the format, but it could not decode this particular dump correctly. We had to understand how the files fit together, recover an obfuscated schema, fix several parser assumptions, and validate that parsed values still appeared under the correct schema columns.

This article explains that process from the beginning with no prior knowledge of Cronos assumed.

What is Cronos? #

Cronos, also known as CronosPro, is a proprietary desktop database and information-management system. It has historically been used by organizations in Russia and other post-Soviet countries to build registries, searchable archives, document collections, and internal information systems.

A Cronos installation uses slightly different terminology from a conventional database:

Conventional term Cronos term Database Bank Table Base Record Record Field Field Record ID System Number

A Cronos database is normally represented by several related binary files:

Files Purpose CroStru.dat and CroStru.tad Database structure: tables, fields, forms, and other definitions CroBank.dat and CroBank.tad Actual records CroIndex.dat and CroIndex.tad Search indexes CroSys.dat and CroSys.tad Information about databases known to a Cronos installation Additional files Forms, formulas, dictionaries, and embedded documents

... continue reading