Skip to content

Commit

Permalink
output filename beautification, comments
Browse files Browse the repository at this point in the history
  • Loading branch information
candicenonsense committed May 30, 2015
1 parent 406d02f commit 9b661eb
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 10 deletions.
20 changes: 16 additions & 4 deletions README
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,25 @@ usage:

(output snippet)

71fffc nulls begin 722800 end
722800 data begins 294001f ends
2940017 nulls begin 2940023 end
0 data begins 2801a ends, size 163866
2801a nulls begin 2ad18 end
2ad18 data begins 2f3c07 ends, size 2920175
2f3c07 nulls begin 2f5868 end
2f5868 data begins 2f5a07 ends, size 415
2f5a07 nulls begin 2f5a08 end
2f5a08 data begins 2f5b32 ends, size 298
2f5b32 nulls begin 2f5bc9 end
2f5bc9 data begins 2f5bd4 ends, size 11
2f5bd4 nulls begin 2f5bf1 end
2f5bf1 data begins 2f5bfc ends, size 11
2f5bfc nulls begin 2f5c00 end
2f5c00 data begins 2f7354 ends, size 5972

The program will also extract the data fragments into location-marked files
using the --extract option.

Files are created as filename-address.extract.

bugs:
An argument to change the null-block length exists but does not work.

Program fragments are created in same directory as source.
19 changes: 13 additions & 6 deletions nullfinder.cc
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,8 @@
Takes argument of a file of dumped gpu memory, attempts to divine structure
by searching for blocks of nulls which have been added for padding.
Default block of nulls to search for is 8. extracting is only for 8-null blocks.
Default block of nulls to search for is 8. extracting is only working
for 8-null blocks. Not reporting really really short (1-2 byte blocks)
File parsing code lifted from sdhash, apache license (Roussev/Quates 2013)
General structure and command line arguments lifted from zsniff. (apache license)
Expand Down Expand Up @@ -120,16 +121,19 @@ std::cout <<"null size "<< nullssize << std::endl;
if (current == 0) {
nullcount++;
if (range != 1 && nullcount == 8) {
std::cout<< std::hex <<n <<" ends" << std::endl;
std::cout<< std::hex <<n-8 <<" nulls begin " ;
std::cout<< std::hex <<n <<" ends, size ";
std::cout << std::dec << n-startaddr << std::endl;
std::cout<< std::hex <<n <<" nulls begin " ;
// extract data
if (extract) {
std::vector<unsigned char> image;
image.resize(n-7-startaddr);
for (int x=0,y=startaddr; y<n-7; x++,y++) {
image[x]=(unsigned char)*(mfile->buffer+y);
}
writeExtracted(image,std::string(filename)+std::to_string((int)startaddr));
std::stringstream builder;
builder << filename<< "-"<< std::hex << startaddr;
writeExtracted(image,builder.str());
}
range=1;
startaddr=0;
Expand All @@ -148,14 +152,17 @@ std::cout <<"null size "<< nullssize << std::endl;
// If we've reached EOF and are in a block of data,
// extract if asked.
if (nullcount==0) {
std::cout<< std::hex <<mfile->size<<" ends" << std::endl;
std::cout<< std::hex <<mfile->size<<" ends, " ;
std::cout << std::dec << (mfile->size)-startaddr << std::endl;
if (extract) {
std::vector<unsigned char> image;
image.resize((mfile->size)-7-startaddr);
for (int x=0,y=startaddr; y<(mfile->size)-7; x++,y++) {
image[x]=(unsigned char)*(mfile->buffer+y);
}
writeExtracted(image,std::string(filename)+std::to_string((int)startaddr));
std::stringstream builder;
builder << filename<< "-"<< std::hex << startaddr;
writeExtracted(image,builder.str());
}
}
} // loop for parsing multiple files
Expand Down

0 comments on commit 9b661eb

Please sign in to comment.