-
-
Notifications
You must be signed in to change notification settings - Fork 246
Description
The -n/--length
flag is a great feature -- good especially for quickly checking if file headers match something. Another use case I can think of for limited output is inspecting, say, an entire block of some data from a file that's been dumped from a disk. Let's say I'm using Linux and reading the first block of a disk somewhere to determine its contents manually:
$ hexyl -n 512 "$disk_dump"
// Some output here...
I read the output and discover that there's an MBR at the beginning, with the first partition starting at logical block address 1. Sweet, let's mosey on over to 0x200 and read another block. I could implement this by using dd
:
$ input_file="_viminfo" block_size=512 block_num=1
$ dd bs="$block_size" status=none skip="$block_num" count="$block_size" if="$input_file" \
| hexyl
...but there's two issues with this:
dd
isn't usually available on Windows machines!- Because we're using
stdin
, we can't get the correct set of offsets -- the "file" starts at 0x0 regardless of what parameters I gavedd
.
Perhaps something like this spitballed set of options might help:
$ hexyl \
--start 512 \ # Could also be written as
\ #
\ # Could be bikeshed to `--begin`?
\
--length 512 \
\
\ # One could use an end offset instead of a length:
# --end 1024 \ # Could also be written as `-e 0x300
Having something similar to bat
's --range
could also be really handy, especially when combined with relative offsets (positive and negative):
$ hexyl --range 512:+512 # same as using `--skip 512 --length 512`
$ hexyl --range=-512: # read the last block
$ hexyl --block-size 4096 -1block: # like above, but use the block unit
$ hexyl --range 32:-32 # cut out a common header and footer for the input stream we don't care about
I would be more than happy to push implementation of this, since I've great personal interest in allowing more of my reverse engineering flow in the terminal. Let me know if you want me to hack on it!
Unresolved questions
Adding several more arguments that accept offsets/sizes might add pressure to create a system of units/radices a laWe've added support forxxd
for the appropriate arguments. Where should the line be drawn in terms of what this project is willing to support?xb
andxib
with Units of measurement of bytes? #44. That's as far as we've decided to go right now.