Sunday, October 26, 2008

How Much Are X Rays To See If My Dogs Pregnant

V0.3 CFI - Linux Day 2008 Modena

: - D Leisure time is also used to test and when you have a passion for computer forensics, are suffering ....


Through

Nigilant32
(present in the Helix Live
2) do the immaginedella Ram on my PC while in use, and save the file RAM.IMG.
ram.img - dump of my 1.3GB ram


Using hex editor, I see that among the many strings in the file, I take one at random to make my test string is "
awatarami
.
Seeking with strings and the parameter-td (which I also generates the offset in decimal) to obtain:




strings-td ram.img


Then sign the offset as:
33593



Then I try to grep and parameters


-i ignore upper / lower case;

-
is a binary file as if it were text;

-b Print the byte offset
;
-o Show only the part of the line that matches the search string;
grep-IABO awatarami ram.img 4923: awatarami


sign the offset:
4923
I searched the word "awatarami" and I got two different offset .... but what is the right one? Step
use of
xxd
(Hex editor command line) and I do-s found starting at the:
4923 ram.img xxd-s 0800 0066




b980 2e8b 0000 c00f 3066 2E10 ... f. ..... 0f .... 00138b. 2e8b 0eac 0066 1ee8 0066 0266 2ea1 2e8b f. .... f. .... f.. 00139b: E002 662e 8b3e 0f22 0800 456e C066 SR20 f. .. f. .>...". En
0013ab: 8008 0000 0000 0000 0000 0000 0000 0000 ................ 0013bb: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0013cb: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0013db: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0013eb: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0013fb: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00140b: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00141b: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00142b: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00143b: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00144b: 0000 0000 0000 0000 0000 0000 0000 0000 ................
There is no trace of the word "awatarami ".... Provo with the offset from strings:
xxd-s 33593 ram.img
(
grep with updated work instead

)

I speak with Mario Pascucci

and he suggested this solution to the dilemma, namely that grep has a completely different way of thinking with the characters and may erroneously interpret the control characters and especially messing with multibyte characters, which is interpreted as a multibyte character sequences, when they are far, and counting them as one. A mystery is solved!

But these two tools I have not finished working on it, and then, armed with a stopwatch I made this experiment:

grep-iaob mustafa / cygdrive / c / immaginidd /

barbuto.dd

time: 52 seconds and 50 hundredths - correct offset 113917010



$ strings-td / cygdrive / c / immaginidd / barbuto.dd strings algorithm has a much simpler and faster than grep, and the amount of data extracted is minimal, so the second grep, whose input is generated by strings, with much less input to be examined.

To confirm this, just send the output of strings to a file and see that it is immensely smaller than the whole file strings on which he worked.
there are also other reasons, including the fact that grep is built to look for in a text file, divided into rows, and with a well-defined character set, and passs a binary, as is the dd image is not ; that helps him a lot.

Strings instead produces an output close to that on which grep offers the best performance.

Basically, strings pulls the strings from a binary file and passes its output to pipe it to grep, which will operate a search for "mustafa", a text output and reduced, making the most of its power.


The same experiment can be done using the these images.

Nanni Bassetti


Posted by admin at 11:54 PM

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)