CODEWITHSUNDEEP
cobfuscationdeobfuscation
Alex Danilov
Alex Danilov

Reputation: 43

Strange .C file

Don't ask where and why I got it, but I have a lot of lines like these in .c file:

0005080: 3465 3434 2035 6635 6620 2064 6c65 2e5f  4e44 5f5f  dle._
0005090: 5f44 544f 525f 454e 445f 5f0a 3030 3031  _DTOR_END__.0001
00050a0: 3334 303a 2030 3035 6620 3566 3663 2036  340: 005f 5f6c 6
00050b0: 3936 3220 3633 3566 2036 3337 3320 3735  962 635f 6373 75
00050c0: 3566 2036 3936 6520 3639 3734 2020 2e5f  5f 696e 6974  ._
00050d0: 5f6c 6962 635f 6373 755f 696e 6974 0a30  _libc_csu_init.0

What can I do with it? Is this a program?

Upvotes: 0

Views: 184

Answers (2)

skrtbhtngr
skrtbhtngr

Reputation: 2251

This looks like the output of the hexdump command.

If you have a file temp.c with the following code:

#include<stdio.h>
int main()
{
        printf("Hello World!\n");
        return 0;
}

Then, hexdump -C temp.c will produce the output as:

00000000  23 69 6e 63 6c 75 64 65  3c 73 74 64 69 6f 2e 68  |#include<stdio.h|
00000010  3e 0a 69 6e 74 20 6d 61  69 6e 28 29 0a 7b 0a 09  |>.int main().{..|
00000020  70 72 69 6e 74 66 28 22  48 65 6c 6c 6f 20 57 6f  |printf("Hello Wo|
00000030  72 6c 64 21 5c 6e 22 29  3b 0a 09 72 65 74 75 72  |rld!\n");..retur|
00000040  6e 20 30 3b 0a 7d 0a                              |n 0;.}.|
00000047

The last few lines of the compiled output file (a.out generally) for the above program reads:

\00__data_start\00__gmon_start__\00__dso_handle\00_IO_stdin_used\00__libc_csu_init\00_end\00_start\00__bss_start\00main\00_Jv_RegisterClasses\00__TMC_END__\00_ITM_registerTMCloneTable\00_init\00

In your case, it looks like the hexdump (or a similar) command was used on an a.out (i.e. object code file) file and those are the last few lines of the output.

Good luck!

Upvotes: 1

Williham Totland
Williham Totland

Reputation: 29009

That's not a C file. That's not a C file at all!

What appears to have happened here is that someone flipped some parameters trying to compile a file; something like gcc -o my_file.c my_file.c, or something to that effect.

If you're on Linux, you can run the file utility to figure out what it is.

Note:

This might well also be a piece of malware: The enterprising would-be attacker sent you the file, hoping you would double-click it in the file manager, causing it to execute and do something nasty.

Edit:

Also, is that the literal content of the file, or the file as seen through xxd? If it's the former, it's more likely a mistake of some kind; but if it's the latter: Beware.

Upvotes: 7

Related Questions