Understanding Hex “I hope you have the worst headache of your life, then you will begin to understand” ~unknown

Overview Hex Basics Hex editors File Analysis basics GHex hexedit xxd Magic Numbers strings, file, xxd

Hex Basics Base 16 number system Binary 2 Hex echo "obase=16;ibase=2;11111111" | bc Python -c ‘print hex(int(‘11111111’,2)’ Hex 2 Binary echo "obase=2;ibase=16; FFFF" | bc echo "FFFF" | xxd -r -p | xxd -b python -c 'print bin(0xFF)' Hex to Decimal echo $((16#FF)) python -c 'print(int("FF", 16))' Number 1 2 3 4 5 6 7 Binary 0000 0001 0010 0011 0100 0110 0111 Hexadecimal Number 8 9 10 11 12 13 14 15 Binary 1000 1001 1010 1011 1100 1101 1110 1111 Hexadecimal A B C D E F

Hex Basics Hex can represent many things including text encodings You will need to know how to look up an encoding character from hex There are many different encodings but a lot of the time you will be dealing with ASCII (1 byte encoding 0x0-0x7f) man ascii (Table of ASCII conversions) Online ascii conversions python -c ‘print chr(0x45)’ cat binary_file | xxd

Hex Editors xxd (CLI) - creates a hex dump of a given file or standard input. It can also convert a hex dump back to its original binary form. hexedit (CLI) - shows a file both in ASCII and in hexadecimal. The file can be a device as the file is read a piece at a time. You can modify the file and search through it. ghex (GUI) - allows the user to load data from any file, view and edit it in either hex or ascii. Any Scripting language and usually text editors

File Analysis Basics Rationale - Often times you will need to find hidden information in files or you may not know about a certain file type. Additionally, a forensics tool may not support an image that you have been tasked to extract data from. This is where you will need file analysis techniques to figure out what type of file/image you are examining and develop a tool to parse the file

File Analysis Basics Files are just a huge blob of binary data. The data’s meaning comes from some abstract structure we impose over the raw bits. The file type tells us the structure to use in interpreting the binary information. File type is indicated by the magic number, a hex string(s) at a specific offset(s). See: https://en.wikipedia.org/wiki/List_of_file_signatures File type is one form of metadata: data about data. Metadata is a common source of artifacts.

File Analysis Basics Basic tools file command on Linux Searches for magic numbers in file and also basic header information strings (linux or Windows) This will give you ascii strings contained in a data blob it may be helpful in identifying what type of data you are examining. Note strings requires arguments specifying encoding (ASCII, UTF-8, etc.) and endianness.

File Analysis Basics Basic tools xxd Sometimes looking at the hexdump will give you clues as well File extensions This is more relevant on Windows but can still be used on Linux This cannot necessarily be trusted Exiftool Analyze exif metadata for image types such as jpeg File carvers Binwalk, we will go over these more in the future

File Analysis Basics More basic tools diff Compare two text files and print all the differences Audacity Open source tool for analyzing audio files Specific file metadata tools Once you know the type of image or file you are dealing with there are often existing tools that can help you interpret the metadata. Archive tools You will often receive files compressed using a variety of common to obscure formats.

File Analysis Basics Sometimes the tools mentioned previously leave you with no information or false information. This is when Google becomes helpful. You may still be able to search for strings or hex sequences on Google that will give you valuable information File analysis can be difficult and can sometimes waste your time.

Questions?

In Class Assignment 1 You have 10-15 minutes Find all three parts of the flag The flag is in the format flag{l33t_sp34k_m3554g3} *Hint: xxd