diff --git a/README b/README index c03270d..25f831f 100644 --- a/README +++ b/README @@ -16,13 +16,25 @@ usage: (output snippet) -71fffc nulls begin 722800 end -722800 data begins 294001f ends -2940017 nulls begin 2940023 end +0 data begins 2801a ends, size 163866 +2801a nulls begin 2ad18 end +2ad18 data begins 2f3c07 ends, size 2920175 +2f3c07 nulls begin 2f5868 end +2f5868 data begins 2f5a07 ends, size 415 +2f5a07 nulls begin 2f5a08 end +2f5a08 data begins 2f5b32 ends, size 298 +2f5b32 nulls begin 2f5bc9 end +2f5bc9 data begins 2f5bd4 ends, size 11 +2f5bd4 nulls begin 2f5bf1 end +2f5bf1 data begins 2f5bfc ends, size 11 +2f5bfc nulls begin 2f5c00 end +2f5c00 data begins 2f7354 ends, size 5972 The program will also extract the data fragments into location-marked files using the --extract option. +Files are created as filename-address.extract. + bugs: An argument to change the null-block length exists but does not work. - +Program fragments are created in same directory as source. diff --git a/nullfinder.cc b/nullfinder.cc index 798aaaa..98404e4 100644 --- a/nullfinder.cc +++ b/nullfinder.cc @@ -5,7 +5,8 @@ Takes argument of a file of dumped gpu memory, attempts to divine structure by searching for blocks of nulls which have been added for padding. - Default block of nulls to search for is 8. extracting is only for 8-null blocks. + Default block of nulls to search for is 8. extracting is only working + for 8-null blocks. Not reporting really really short (1-2 byte blocks) File parsing code lifted from sdhash, apache license (Roussev/Quates 2013) General structure and command line arguments lifted from zsniff. (apache license) @@ -120,8 +121,9 @@ std::cout <<"null size "<< nullssize << std::endl; if (current == 0) { nullcount++; if (range != 1 && nullcount == 8) { - std::cout<< std::hex < image; @@ -129,7 +131,9 @@ std::cout <<"null size "<< nullssize << std::endl; for (int x=0,y=startaddr; ybuffer+y); } - writeExtracted(image,std::string(filename)+std::to_string((int)startaddr)); + std::stringstream builder; + builder << filename<< "-"<< std::hex << startaddr; + writeExtracted(image,builder.str()); } range=1; startaddr=0; @@ -148,14 +152,17 @@ std::cout <<"null size "<< nullssize << std::endl; // If we've reached EOF and are in a block of data, // extract if asked. if (nullcount==0) { - std::cout<< std::hex <size<<" ends" << std::endl; + std::cout<< std::hex <size<<" ends, " ; + std::cout << std::dec << (mfile->size)-startaddr << std::endl; if (extract) { std::vector image; image.resize((mfile->size)-7-startaddr); for (int x=0,y=startaddr; y<(mfile->size)-7; x++,y++) { image[x]=(unsigned char)*(mfile->buffer+y); } - writeExtracted(image,std::string(filename)+std::to_string((int)startaddr)); + std::stringstream builder; + builder << filename<< "-"<< std::hex << startaddr; + writeExtracted(image,builder.str()); } } } // loop for parsing multiple files