Skip to content

Instantly share code, notes, and snippets.

@bradley219
Last active December 16, 2015 06:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bradley219/5392777 to your computer and use it in GitHub Desktop.
Save bradley219/5392777 to your computer and use it in GitHub Desktop.
Cheap-o file carving utility :)
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int read_file_into_mem( char *filename, char **memory )
{
int size;
FILE *fp;
fp = fopen( filename, "rb" );
if( fp == NULL )
{
*memory = NULL;
size = -1;
}
else
{
fseek( fp, 0, SEEK_END );
size = ftell( fp );
fseek( fp, 0, SEEK_SET );
*memory = (char *)malloc( sizeof(char) * (size + 1) );
if( size != fread( *memory, sizeof(char), size, fp ) )
{
free(*memory);
size = -2;
*memory = NULL;
}
else {
(*memory)[size] = '\0';
}
fclose( fp );
}
return size;
}
typedef struct {
int offset;
int period;
int line_length;
} carver_opts_t;
int main( int argv, char *argc[] )
{
char *filename = NULL;
if( argv > 1 )
{
filename = argc[1];
}
else
{
fprintf( stderr, "must specify filename as first argument\n" );
return -1;
}
carver_opts_t opts;
opts.offset = 0x0;
opts.period = 56;
opts.line_length = 56;
if( argv > 2 )
{
opts.offset = atoi( argc[2] );
}
if( argv > 3 )
{
opts.period = atoi( argc[3] );
}
if( argv > 4 )
{
opts.line_length = atoi( argc[4] );
}
fprintf( stderr, "offset = 0x%x period = 0x%x line_length = 0x%x\n", opts.offset, opts.period, opts.line_length );
char *raw = NULL;
int sz;
if( (sz = read_file_into_mem( filename, &raw ) ) < 0 )
{
fprintf( stderr, "error reading file\n" );
return -1;
}
char *p = raw;
p += opts.offset;
while( p < raw + sz )
{
int i;
for( i = 0; i < opts.line_length; i++ )
{
if( (*p >= ' ' && *p <= '~') )
{
printf( "%c", *p );
}
else
{
printf( " " );
}
p++;
}
printf( "\n" );
p += opts.period - opts.line_length;
}
free(raw);
return 0;
}
@bradley219
Copy link
Author

Usage:

./carver FILENAME OFFSET PERIOD LINE_LENGTH

@bradley219
Copy link
Author

./carver ../u/LADSAR/CUSMAS.RI1 1647 615 615

./carver ../u/LADSAR/CUSMST.DAT 0 207 207

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment