4 ms·
> I decided to write another Python script to save the packet data with offsets. This way it would save the file test1 skipping 1 byte from the packet, test2 sk
by bonyt 6y ago
> I decided to write another Python script to save the packet data with offsets. This way it would save the file test1 skipping 1 byte from the packet, test2 skipping 2 bytes and so on.
There is a useful tool called ‘binwalk’ that goes through a binary offset by offset looking for signatures like this. Don’t know if it would’ve worked here, but it’s pretty awesome for finding various data formats hidden in files, and was originally made for analyzing firmware files.
- uhinter 6y agoI dont understand this step . How does skipping n+1 number of bytes help in capturing the correct file ?
- knaik94 6y agoIt's a way to find the start of the file header when you don't know the original offset. You have to have an idea about the target header format, and in this article the author was looking for an audio stream because each packet ended with LAME3.91UUUUUUU which is an mp3 audio encoder with a funny acronym. You use n+1 so each at each packet you're looking at a different part of the packet.
- bunfunton 6y agoAFAIK often the file type signature is in the beginning of the data, however a proprietary elevator music solution could add their custom headers to the beginning of the stream, or, he might have captured data midstream
- uhinter 6y agoThanks. That was helpful.
- fastball 6y agoThe idea is that the file within the byte stream does not have a clear start marker (due to the unknown length of the customer headers), so you bruteforce trying to find the file.
- pottertheotter 6y agoThe assumption is that the packet is something like header + file (I don't know if header is the right terminology). You don't know how many bytes the header is, so you increment the header length until the remaining bytes are recognized as a file.