CODEWITHSUNDEEP
linuxbashcommand-line
Dan
Dan

Reputation: 4663

Strings command radix offset not lining up with dd/xxd file offset

I used this command to generate a strings file:

strings -a -t d image.dd

This should display the radix offset in decimal before each line. I then grep'd the file for interesting search hits. I then wanted to view the specific offset in hex view for each search hit, which I did by using the dd command (the offset of interest is 32203):

dd if=image.dd skip=32203 count=1 | xxd

I've tried looking in the immediate context of this offset to no avail - it does not contain the same data. I searched the dd piped to xxd output and found the same data at offset \x7e00 (decimal 32256 - which is the same as the radix offset, just 53 bytes further into the relevant line), however even this doesn't seem to line up right when I go back to view it in dd piped through xxd. Why the disparities? How can I match the strings radix decimal offset to the byte offset within the dd image? Is xxd the culprit?

For those who are wondering why I don't just search the dd output through xxd, the actual reason I need the offset is to pass the allocation block content to another program, this is just a concept that illustrates that the offsets are not lining up.

Upvotes: 3

Views: 1251

Answers (1)

twalberg
twalberg

Reputation: 62519

Your problem is with the dd skip= parameter. skip=32203 blocks (with a default block size of 512) of the file. You can specify ibs=1 to set the default input block size.

Upvotes: 3

Related Questions