4 releases
0.2.2 | May 20, 2024 |
---|---|
0.2.1 | May 19, 2024 |
0.2.0 | May 19, 2024 |
0.1.0 | May 19, 2024 |
#209 in Compression
41KB
816 lines
drive-image-searcher
A Rust CLI tool to stream a drive image, and search for one or more byte patterns
cargo install drive-image-searcher
drive-image-searcher -h
Features
- Supports custom "needle" definition configuration file.
- Supports reading from compressed disk images (lz4 and xz compression).
- Writes out chunks of data where the needle was found.
- Fast.
Usage
- Download the
needle_config.sample.yaml
file, and fill it with search patterns you want to locate. For example:
- name: "Example Needle 1"
val: "48 65 6c 6c 6f ff ff ff ff ff ff ff" # This is "Hello" in hexadecimal
val_format: hex
description_notes: "A simple hex value of the word 'Hello'"
happiness_level: 1
- name: "Example Needle 2"
val: "word plus a bunch of other random text"
val_format: ascii
description_notes: "A plain ASCII value"
happiness_level: 2
write_to_file: false
- Run
cargo install drive-image-searcher
. - Run
drive-image-searcher -c none -i /path/to/dd_file.img -n /path/to/needle_config.yaml -o ./output_dir/
When complete, matching instances within the files will be in ./output_dir/
, alongside logs.
Bugs
- Total file size for block devices shows as 0, so ETA doesn't work.
- The offsets are incorrect as a result of the carry forward not shifting the haystack
Dependencies
~36–64MB
~1M SLoC