Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Here is the situation: I have to find in the output from an hexdump the bytes between a string A and a string B. The structure of the hexdump is something like:

-random bytes
-A + useful bytes + B
-random bytes
-A + useful bytes + B
-random bytes

And now, the questions: - Is it possible to grep "from A to B"? I haven't seen anything like that in the man page or in the internet. I know i can do it manually, but I need to script it. - Is it possible to show the hexdump output without the line numbers? It seems very reasonable, but I have no found the way to do it.

Thanks!

Edit: I'm trying to recover 2 deleted JPEG images from a loopback device, so I can't show all the output (it's extremely long), but here's a piece of it:

0010400 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01
0010410 00 01 00 00 ff fe 00 3c 43 52 45 41 54 4f 52 3a
[...]
0030f50 3e e9 fb a4 54 37 70 7f cb 55 03 fd af f1 a2 32
0030f60 e8 26 8f ff d9 00 00 00 00 00 00 00 00 00 00 00

the standard says that the JPEG files start with 0xff 0xd8 and finish with 0xff 0xd9, so I want to get all the information between that 2 strings (I think that should work, but i haven't tested it yet)

share|improve this question
    
Yep, way better xD Thanks :) –  Palantir May 8 '12 at 17:50
    
Ok, much better with the explanation too, thanks. How large is the file you're working on, and do you know approx. how large those two files are? –  Mat May 8 '12 at 17:54
1  
Oh, and did you try cgsecurity.org/wiki/PhotoRec –  Mat May 8 '12 at 17:56
    
The loopback file's size is 1MB, and i have no idea about the size of the 2 pics, but they can't be very very large if they're both in 1MB –  Palantir May 8 '12 at 18:01
    
The think is that it's for an assignment, so I have to script it :) –  Palantir May 8 '12 at 18:02
add comment

3 Answers

It might be a better idea to keep this strictly binary, as mentioned here bbe seems to be the tool for the job. The following command writes JPEGs to zero padded numeric files.

bbe -s -b '/\xff\xd8/:/\xff\xd9/' -e 'w %05B.jpg' > /dev/null
share|improve this answer
add comment

untested

awk '
  /ff d8/ || ($2 == "d8" && ff_prevline) {p = 1}
  p {print}
  /ff d9/ || ($2 == "d9" && ff_prevline) {p = 0}
  {ff_prevline = ($NF == "ff")}
'
share|improve this answer
add comment

One way using perl. It will output only that range of bytes between ff 8d and ff 9d, without line numbers:

Assuming next data as the content of infile:

0010400 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01
0010410 00 01 00 00 ff fe 00 3c 43 52 45 41 54 4f 52 3a
0030f50 3e e9 fb a4 54 37 70 7f cb 55 03 fd af f1 a2 32
0030f60 e8 26 8f ff d9 00 00 00 00 00 00 00 00 00 00 00

Run next perl one-liner:

perl -ne '
    if ( (my $start = m/ff\sd8/) .. (my $end = m/ff\sd9/) ) { 
        s/\S*\s//; 
        s/\A.*(?=ff\sd8)// if $start; 
        s/(?<=ff\sd9).*\Z// if $end; 
        print 
    }
' infile

That will give following output:

ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01                                                                                                                                                                                              
00 01 00 00 ff fe 00 3c 43 52 45 41 54 4f 52 3a                                                                                                                                                                                              
3e e9 fb a4 54 37 70 7f cb 55 03 fd af f1 a2 32                                                                                                                                                                                              
e8 26 8f ff d9
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.