实用工具binwalk

在刚刚结束的Ghost in shellcode 2013热身赛中，其中的第三题涉及到了有关压缩文件格式的问题。

原题在：http://ghostintheshellcode.com/2013-teaser/

第三题，给了一个bin文件，很容易猜到应该是从文件中提取信息。

首先利用file命令检测文件的magic，得到它是xz格式的压缩包。

解压后，继续file，得到以下信息：

gzip compressed data, was "43", from Unix, last modified: Fri Jan 11 07:54:03 2013

这里这个43其实是十分诡异的存在的，如果当时能够继续深思一下就好了。

随后我直接就gzip -d 进行解压缩，得到了一个纯数据文件。

检查内部的二进制数据，发现了tar压缩包的magic：ustar以及大量可读的文本。

后来查阅发现，是其中的html文件内容。

此时已经猜到了这里的tar文件被乱序了。当时只顾着分析gzip后的结果，而忘记了从原始gzip文件开始。

结束后，看到别人的writeup才恍然大悟，这是一道完全应该可以做出来的题目。

他们提到了一个工具binwalk，能够对binary文件中的不同部分，根据magic标示，分析文件。

我去下载然后编译运行了一下，效果确实不错。

DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------
0               0x0             gzip compressed data, was "43", from Unix, last modified: Fri Jan 11 07:54:03 2013
956             0x3BC           gzip compressed data, was "38", from Unix, last modified: Fri Jan 11 07:54:03 2013
1912            0x778           gzip compressed data, was "45", from Unix, last modified: Fri Jan 11 07:54:03 2013
2868            0xB34           gzip compressed data, was "16", from Unix, last modified: Fri Jan 11 07:54:03 2013
3824            0xEF0           gzip compressed data, was "67", from Unix, last modified: Fri Jan 11 07:54:03 2013
4780            0x12AC          gzip compressed data, was "30", from Unix, last modified: Fri Jan 11 07:54:03 2013
5736            0x1668          gzip compressed data, was "03", from Unix, last modified: Fri Jan 11 07:54:03 2013
6286            0x188E          gzip compressed data, was "23", from Unix, last modified: Fri Jan 11 07:54:03 2013
7242            0x1C4A          gzip compressed data, was "9008", from Unix, last modified: Fri Jan 11 07:54:03 2013
7276            0x1C6C          gzip compressed data, was "53", from Unix, last modified: Fri Jan 11 07:54:03 2013
8232            0x2028          gzip compressed data, was "60", from Unix, last modified: Fri Jan 11 07:54:03 2013
9188            0x23E4          gzip compressed data, was "24", from Unix, last modified: Fri Jan 11 07:54:03 2013
10144           0x27A0          gzip compressed data, was "59", from Unix, last modified: Fri Jan 11 07:54:03 2013
11100           0x2B5C          gzip compressed data, was "11", from Unix, last modified: Fri Jan 11 07:54:03 2013
11441           0x2CB1          gzip compressed data, was "44", from Unix, last modified: Fri Jan 11 07:54:03 2013
12397           0x306D          gzip compressed data, was "70", from Unix, last modified: Fri Jan 11 07:54:03 2013
13353           0x3429          gzip compressed data, was "50", from Unix, last modified: Fri Jan 11 07:54:03 2013
14309           0x37E5          gzip compressed data, was "12", from Unix, last modified: Fri Jan 11 07:54:03 2013
14661           0x3945          gzip compressed data, was "00", from Unix, last modified: Fri Jan 11 07:54:03 2013
14792           0x39C8          gzip compressed data, was "42", from Unix, last modified: Fri Jan 11 07:54:03 2013
15748           0x3D84          gzip compressed data, was "75", from Unix, last modified: Fri Jan 11 07:54:03 2013
16426           0x402A          gzip compressed data, was "10", from Unix, last modified: Fri Jan 11 07:54:03 2013
16948           0x4234          gzip compressed data, was "9009", from Unix, last modified: Fri Jan 11 07:54:03 2013
16977           0x4251          gzip compressed data, was "15", from Unix, last modified: Fri Jan 11 07:54:03 2013
17933           0x460D          gzip compressed data, was "09", from Unix, last modified: Fri Jan 11 07:54:03 2013
18492           0x483C          gzip compressed data, was "40", from Unix, last modified: Fri Jan 11 07:54:03 2013
19448           0x4BF8          gzip compressed data, was "27", from Unix, last modified: Fri Jan 11 07:54:03 2013
20225           0x4F01          gzip compressed data, was "08", from Unix, last modified: Fri Jan 11 07:54:03 2013
20771           0x5123          gzip compressed data, was "63", from Unix, last modified: Fri Jan 11 07:54:03 2013
21182           0x52BE          gzip compressed data, was "01", from Unix, last modified: Fri Jan 11 07:54:03 2013
21564           0x543C          gzip compressed data, was "66", from Unix, last modified: Fri Jan 11 07:54:03 2013
22520           0x57F8          gzip compressed data, was "18", from Unix, last modified: Fri Jan 11 07:54:03 2013
23476           0x5BB4          gzip compressed data, was "57", from Unix, last modified: Fri Jan 11 07:54:03 2013
24432           0x5F70          gzip compressed data, was "21", from Unix, last modified: Fri Jan 11 07:54:03 2013
25388           0x632C          gzip compressed data, was "47", from Unix, last modified: Fri Jan 11 07:54:03 2013
26344           0x66E8          gzip compressed data, was "04", from Unix, last modified: Fri Jan 11 07:54:03 2013
26885           0x6905          gzip compressed data, was "9005", from Unix, last modified: Fri Jan 11 07:54:03 2013
27843           0x6CC3          gzip compressed data, was "32", from Unix, last modified: Fri Jan 11 07:54:03 2013
28799           0x707F          gzip compressed data, was "41", from Unix, last modified: Fri Jan 11 07:54:03 2013
29755           0x743B          gzip compressed data, was "55", from Unix, last modified: Fri Jan 11 07:54:03 2013
30711           0x77F7          gzip compressed data, was "36", from Unix, last modified: Fri Jan 11 07:54:03 2013
31667           0x7BB3          gzip compressed data, was "33", from Unix, last modified: Fri Jan 11 07:54:03 2013
32623           0x7F6F          gzip compressed data, was "80", from Unix, last modified: Fri Jan 11 07:54:03 2013
33579           0x832B          gzip compressed data, was "9006", from Unix, last modified: Fri Jan 11 07:54:03 2013
33613           0x834D          gzip compressed data, was "69", from Unix, last modified: Fri Jan 11 07:54:03 2013
34569           0x8709          gzip compressed data, was "52", from Unix, last modified: Fri Jan 11 07:54:03 2013
35525           0x8AC5          gzip compressed data, was "89", from Unix, last modified: Fri Jan 11 07:54:03 2013
36481           0x8E81          gzip compressed data, was "9007", from Unix, last modified: Fri Jan 11 07:54:03 2013
36515           0x8EA3          gzip compressed data, was "84", from Unix, last modified: Fri Jan 11 07:54:03 2013
37471           0x925F          gzip compressed data, was "82", from Unix, last modified: Fri Jan 11 07:54:03 2013
38427           0x961B          gzip compressed data, was "76", from Unix, last modified: Fri Jan 11 07:54:03 2013
38877           0x97DD          gzip compressed data, was "25", from Unix, last modified: Fri Jan 11 07:54:03 2013
39833           0x9B99          gzip compressed data, was "06", from Unix, last modified: Fri Jan 11 07:54:03 2013
40379           0x9DBB          gzip compressed data, was "88", from Unix, last modified: Fri Jan 11 07:54:03 2013
41335           0xA177          gzip compressed data, was "26", from Unix, last modified: Fri Jan 11 07:54:03 2013
42291           0xA533          gzip compressed data, was "29", from Unix, last modified: Fri Jan 11 07:54:03 2013
43247           0xA8EF          gzip compressed data, was "9002", from Unix, last modified: Fri Jan 11 07:54:03 2013
44205           0xACAD          gzip compressed data, was "14", from Unix, last modified: Fri Jan 11 07:54:03 2013
45161           0xB069          gzip compressed data, was "31", from Unix, last modified: Fri Jan 11 07:54:03 2013
46117           0xB425          gzip compressed data, was "83", from Unix, last modified: Fri Jan 11 07:54:03 2013
47073           0xB7E1          gzip compressed data, was "34", from Unix, last modified: Fri Jan 11 07:54:03 2013
48029           0xBB9D          gzip compressed data, was "86", from Unix, last modified: Fri Jan 11 07:54:03 2013
48985           0xBF59          gzip compressed data, was "51", from Unix, last modified: Fri Jan 11 07:54:03 2013
49941           0xC315          gzip compressed data, was "13", from Unix, last modified: Fri Jan 11 07:54:03 2013
50897           0xC6D1          gzip compressed data, was "54", from Unix, last modified: Fri Jan 11 07:54:03 2013
51853           0xCA8D          gzip compressed data, was "37", from Unix, last modified: Fri Jan 11 07:54:03 2013
52809           0xCE49          gzip compressed data, was "48", from Unix, last modified: Fri Jan 11 07:54:03 2013
53765           0xD205          gzip compressed data, was "61", from Unix, last modified: Fri Jan 11 07:54:03 2013
54721           0xD5C1          gzip compressed data, was "28", from Unix, last modified: Fri Jan 11 07:54:03 2013
55104           0xD740          gzip compressed data, was "77", from Unix, last modified: Fri Jan 11 07:54:03 2013
56060           0xDAFC          gzip compressed data, was "9003", from Unix, last modified: Fri Jan 11 07:54:03 2013
57018           0xDEBA          gzip compressed data, was "65", from Unix, last modified: Fri Jan 11 07:54:03 2013
57974           0xE276          gzip compressed data, was "39", from Unix, last modified: Fri Jan 11 07:54:03 2013
58930           0xE632          gzip compressed data, was "78", from Unix, last modified: Fri Jan 11 07:54:03 2013
59886           0xE9EE          gzip compressed data, was "46", from Unix, last modified: Fri Jan 11 07:54:03 2013
60842           0xEDAA          gzip compressed data, was "19", from Unix, last modified: Fri Jan 11 07:54:03 2013
61798           0xF166          gzip compressed data, was "20", from Unix, last modified: Fri Jan 11 07:54:03 2013
62754           0xF522          gzip compressed data, was "68", from Unix, last modified: Fri Jan 11 07:54:03 2013
63710           0xF8DE          gzip compressed data, was "58", from Unix, last modified: Fri Jan 11 07:54:03 2013
64666           0xFC9A          gzip compressed data, was "35", from Unix, last modified: Fri Jan 11 07:54:03 2013
65622           0x10056         gzip compressed data, was "9004", from Unix, last modified: Fri Jan 11 07:54:03 2013
66580           0x10414         gzip compressed data, was "62", from Unix, last modified: Fri Jan 11 07:54:03 2013
67536           0x107D0         gzip compressed data, was "79", from Unix, last modified: Fri Jan 11 07:54:03 2013
68492           0x10B8C         gzip compressed data, was "49", from Unix, last modified: Fri Jan 11 07:54:03 2013
69448           0x10F48         gzip compressed data, was "05", from Unix, last modified: Fri Jan 11 07:54:03 2013
69961           0x11149         gzip compressed data, was "56", from Unix, last modified: Fri Jan 11 07:54:03 2013
70917           0x11505         gzip compressed data, was "72", from Unix, last modified: Fri Jan 11 07:54:03 2013
71873           0x118C1         gzip compressed data, was "9001", from Unix, last modified: Fri Jan 11 07:54:03 2013
72831           0x11C7F         gzip compressed data, was "71", from Unix, last modified: Fri Jan 11 07:54:03 2013
73787           0x1203B         gzip compressed data, was "17", from Unix, last modified: Fri Jan 11 07:54:03 2013
74743           0x123F7         gzip compressed data, was "74", from Unix, last modified: Fri Jan 11 07:54:03 2013
75699           0x127B3         gzip compressed data, was "9000", from Unix, last modified: Fri Jan 11 07:54:03 2013
76657           0x12B71         gzip compressed data, was "02", from Unix, last modified: Fri Jan 11 07:54:03 2013
77175           0x12D77         gzip compressed data, was "07", from Unix, last modified: Fri Jan 11 07:54:03 2013
77717           0x12F95         gzip compressed data, was "22", from Unix, last modified: Fri Jan 11 07:54:03 2013
78673           0x13351         gzip compressed data, was "85", from Unix, last modified: Fri Jan 11 07:54:03 2013
79629           0x1370D         gzip compressed data, was "81", from Unix, last modified: Fri Jan 11 07:54:03 2013
80585           0x13AC9         gzip compressed data, was "73", from Unix, last modified: Fri Jan 11 07:54:03 2013
81541           0x13E85         gzip compressed data, was "64", from Unix, last modified: Fri Jan 11 07:54:03 2013
82100           0x140B4         gzip compressed data, was "87", from Unix, last modified: Fri Jan 11 07:54:03 2013

看到这些输出，也就对开始的那个莫名的“43”有所想法了，其实就是很多gzip文件被连接在了一起，但是标准的gz格式是不支持多个文件混在一起解压的，导致了解压后的文件全部输出到了一起，顺序就丢失了。