Reputation: 4663
I used this command to generate a strings file:
strings -a -t d image.dd
This should display the radix offset in decimal before each line. I then grep'd the file for interesting search hits. I then wanted to view the specific offset in hex view for each search hit, which I did by using the dd command (the offset of interest is 32203):
dd if=image.dd skip=32203 count=1 | xxd
I've tried looking in the immediate context of this offset to no avail - it does not contain the same data. I searched the dd piped to xxd output and found the same data at offset \x7e00 (decimal 32256 - which is the same as the radix offset, just 53 bytes further into the relevant line), however even this doesn't seem to line up right when I go back to view it in dd piped through xxd. Why the disparities? How can I match the strings radix decimal offset to the byte offset within the dd image? Is xxd the culprit?
For those who are wondering why I don't just search the dd output through xxd, the actual reason I need the offset is to pass the allocation block content to another program, this is just a concept that illustrates that the offsets are not lining up.
Upvotes: 3
Views: 1251
Reputation: 62519
Your problem is with the dd
skip=
parameter. skip=32203
blocks (with a default block size of 512) of the file. You can specify ibs=1
to set the default input block size.
Upvotes: 3