During FOR508, I kept getting tired of having to divide the byte location of the string from the output of srch_strings by the block size. I figured out a way to use bc on the command line on a case-by-case basis, but figured it'd be easier to just have a couple scripts that could output in that format. The original result was srch_strings_blk, srch_strings_pipe, and srch_strings_wrap.sh.

Rob Lee put me in touch with Hal Pomeranz who had a similar idea and we talked about some additional things to include in the srch_strings_wrap.sh. I decided to conver the script to perl and added some new functionality. Those changes became the current srch_strings_wrap which aims to be a complete wrapper around srch_strings.

• Dave Lassalle, @superponible, dave@superponible.com

==============================================================================

srch_strings_wrap

This script is a wrapper around the regular srch_strings. It will pass all arguments to srch_strings and execute it normally. The -b or -d option must be given to enable additional functionality, otherwise it will just run liek the normal srch_strings. If the -b option is specified, it will calculate the block that matched using the block size given. If -d is used, it will use fsstat on the file argument to determine the block size. If -b or -d is specified but "-t d" is not used, then an error will be displayed.

Files can be specified, otherwise stdin is used for input.

Other arguments (-H, -F, -C, -O) can be used to modify the output. See the usage statement by running with -h.

Example:

srch_strings_wrap -d -a -t d -e l filesystem.img

OR

srch_strings_wrap -b 4096 -a -t -d -e l filesystem.img

This would be equivalent to

srch_strings -a -t d -e l filesystem.img | srch_strings_pipe -b 4096

and

srch_strings -a -t d -e l filesystem.img > strings.out

srch_strings_blk -i filesystem.img -s strings.out

==============================================================================

srch_strings_blk

This script requires a file as input (-s) which is the output of a srch_strings command run with the "-t d" option to produce the byte location of the string in the original file. Additionally, if the blocksize is known, specify it with -b. Otherwise, the original image file can be specified with -i and the script will determine the block size using fsstat

Example:

srch_strings -a -t d -e l filesystem.img > strings.out

srch_strings_blk -i filesystem.img -s strings.out

OR

srch_strings_blk -b 4096 -s strings.out

The script will output to stdout or to the file specified with -o.

Note, if -b and -i are both specified, the argument given in -b will be used.

==============================================================================

srch_strings_pipe

This script can be used in a pipeline following srch_strings. It only takes the -b argument for the block size and the -o argument for the optional output file.

Example:

srch_strings -a -t d -e l filesystem.img | srch_strings_pipe -b 4096

==============================================================================

srch_strings_wrap.sh

This script is a wrapper around the regular srch_strings. It will pass all arguments to srch_strings and execute it normally. If the -b option is specified, after running srch_strings, it will calculate the block like the other scripts do. If -b is not specified, srch_strings will run as it normally does. If -b is specified but "-t d" is not used, then an error will be displayed.

Files can be specified, otherwise stdin is used for input.

Example:

srch_strings_wrap -b 4096 -a -t -d -e l filesystem.img

This would be equivalent to

srch_strings -a -t d -e l filesystem.img | srch_strings_pipe -b 4096

and

srch_strings -a -t d -e l filesystem.img > strings.out

srch_strings_blk -i filesystem.img -s strings.out