Glazer’s data team received CronosPro files (CroBank.dat, CroIndex.dat, CroStru.dat) that existing tooling could not parse — a proprietary desktop database format used across the post-Soviet world. The open-source cronodump converter failed on the schema file, so they had to recover an obfuscated schema before any records were readable. The write-up assumes no prior knowledge of the format and earns its depth.

Key moves in the recovery:

  • Narrow the target: only the small schema file was KOD-encoded; the huge record file was merely compressed. Crack the schema and the ordinary parser handles the rest.
  • KOD protection is a position-dependent byte substitution (plaintext = KOD[cipher] − position − record number, mod 256). Being off by one byte corrupts everything after it.
  • Reconstruction became an assignment problem: a KOD table must be a true 256-entry permutation, so they scored each candidate mapping against known-good dumps and solved globally with the Hungarian algorithm — not per-byte greedy picks.
  • Validate structurally, not visually: record markers, length-prefixed names, known keys like Bank/BankId/BankName, consistent table references. “Readable output alone is weak evidence.”
  • Two parser bugs surfaced: a 12-byte Cronos v4 extent header was fed into the KOD decoder (shifting every byte position), and documented text types were being exported as hex instead of Windows-1251.
  • The subtlest trap: hidden internal fields. Visible field definitions mapped to stored positions 2, 4, 7 — not 1, 2, 3 — so a CSV could look valid while every value sat under the wrong header.

The key lesson is that a decoding failure does not always mean a bad key — sometimes the right decoder runs at the wrong boundary. And a CSV with readable values under wrong headers is worse than an obvious error, because it looks valid while being semantically corrupted.

Good postmortem-style reading for anyone doing legacy data recovery, ETL, or reverse engineering: formalize the unknown, shrink the surface, and never trust output that merely looks right.