Skip to content

Instantly share code, notes, and snippets.

@peterhellberg
Created January 27, 2023 16:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save peterhellberg/ddaf1f38c2f17b46260dc58561fac4e3 to your computer and use it in GitHub Desktop.
Save peterhellberg/ddaf1f38c2f17b46260dc58561fac4e3 to your computer and use it in GitHub Desktop.
#include <stdio.h>
#include <stdlib.h>
int main(int argc,char **argv)
{
FILE *afile = NULL;
FILE *bfile = NULL;
unsigned char *bbuffer = NULL;
int achar;
int bsize;
int acnt=0, bcnt=0, i;
if(argc<3){
printf("Usage: %s file1 file2\r\n Program tries to find file2 (binary) inside file1\r\n", argv[0]);
return 1;
}
afile = fopen(argv[1], "rb");
bfile = fopen(argv[2], "rb");
if(afile == NULL || bfile == NULL){
perror("Filename correct? ");
goto shutdown;
}
fseek(bfile, 0L, SEEK_END);
bsize = ftell(bfile);
fseek(bfile, 0L, SEEK_SET);
bbuffer = malloc(bsize);
if(1 != fread(bbuffer,bsize,1,bfile)){
perror("Unable to read file2");
goto shutdown;
}
while(1)
{
achar = getc(afile);
acnt++;
if(achar == EOF){
printf("Couldn't find file2 inside file1\r\n");
goto shutdown;
}
if((unsigned char)achar == bbuffer[bcnt]){
bcnt++;
}else{
bcnt = 0;
}
if(bcnt == bsize){
printf("Found file2 at offset %d\r\n", acnt-bcnt);
goto shutdown;
}
}
shutdown:
if(afile)
fclose(afile);
if(bfile)
fclose(bfile);
if(bbuffer)
free(bbuffer);
return 0;
}
@peterhellberg
Copy link
Author

Compiled using zig cc

zig cc -o blobfind blobfind.c
$ ./blobfind  dump-embed-file balena.png 
Found file2 at offset 1131744

And then you can use dd to extract the file in question:

dd skip=1131744 bs=1 count=148 if=dump-embed-file of=output.png

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment