1. DAT2343 File Dump Analysis © Alan T. Pinck / Algonquin College; 2003

2. ASCII Text File Example C:\03F\dat2219d\projects>DEBUG -Nascii.txt -L -D 0ADB:0100 54 68 65 20 77 6F 72 6C-64 20 65 6E 64 65 64 20 The world ended 0ADB:0110 61 74 20 31 30 20 61 6D-20 74 6F 64 61 79 2E 20 at 10 am today. 0ADB:0120 20 59 6F 75 20 61 72 65-0D 0A 6A 75 73 74 20 64 You are..just d 0ADB:0130 72 65 61 6D 69 6E 67 20-61 6E 79 74 68 69 6E 67 reaming anything 0ADB:0140 20 61 66 74 65 72 20 74-68 61 74 2E 08 FE 06 63 after that....c 0ADB:0150 98 32 C0 EB 06 34 02 22-C4 D0 E8 0A 06 25 99 A2.2...4.".....%.. 0ADB:0160 13 96 D0 E0 D0 E0 A2 1E-99 80 3E 20 99 00 75 24..........>..u$ 0ADB:0170 A2 24 99 0A C9 75 1D 0A-C0 74 19 8B 0E 21 96 E3.$...u...t...!.. - Variable length lines terminated with 0D 0A (carriage return and line feed) Translation supplied in right-hand column area Only possible problem is in determining where the file ends.

3. Determining File Size C:\03F\dat2219d\projects>DEBUG -Nascii.txt -L -D 0ADB:0100 54 68 65 20 77 6F 72 6C-64 20 65 6E 64 65 64 20 The world ended 0ADB:0110 61 74 20 31 30 20 61 6D-20 74 6F 64 61 79 2E 20 at 10 am today. 0ADB:0120 20 59 6F 75 20 61 72 65-0D 0A 6A 75 73 74 20 64 You are..just d 0ADB:0130 72 65 61 6D 69 6E 67 20-61 6E 79 74 68 69 6E 67 reaming anything 0ADB:0140 20 61 66 74 65 72 20 74-68 61 74 2E 08 FE 06 63 after that....c 0ADB:0150 98 32 C0 EB 06 34 02 22-C4 D0 E8 0A 06 25 99 A2.2...4.".....%.. 0ADB:0160 13 96 D0 E0 D0 E0 A2 1E-99 80 3E 20 99 00 75 24..........>..u$ 0ADB:0170 A2 24 99 0A C9 75 1D 0A-C0 74 19 8B 0E 21 96 E3.$...u...t...!.. -R AX=0000 BX=0000 CX=004C DX=0000 SP=FFEE BP=0000 SI=0000 DI=0000 DS=0ADB ES=0ADB SS=0ADB CS=0ADB IP=0100 NV UP EI PL NZ NA PO NC 0ADB:0100 54 PUSH SP

4. Fixed Record Structure Files Considerations Word size Big endian / Little endian Slack bytes Record structure

5. Sample Fixed Structure File 32-bit word Little endian Slack bytes required int – char[2] - float 0ADB:0100 46 09 00 00 4A 41 00 00-00 00 91 C2 4B F6 FF FF 0ADB:0110 46 45 00 00 00 00 40 42-C0 09 00 00 4D 52 00 00

6. Field Value Analysis Because this file was identified as little endian, int and float byte sequences need to be reversed. 0ADB:0100 46 09 00 00 4A 41 00 00-00 00 91 C2 4B F6 FF FF 0ADB:0110 46 45 00 00 00 00 40 42-C0 09 00 00 4D 52 00 00 int fieldchar[2] fieldfloat field Record 1 00 00 09 464A 41C2 91 00 00 (1 decoded) +2374JA-72.5 Record 2 FF FF F6 4B46 4542 40 00 00 (2 decoded) -2484FE+48.0

7. EBCDIC-based File Characteristics Field types: EBCDIC characters, 2s complement, float, zoned decimal, and packed decimal Always big endian Fixed length records (no terminating CR & LF) Slack bytes (if needed) before int and float fields to force int and float to even address

8. Sample EBCDIC Analysis Record format: int – char[4] – packed[3] – zoned[5] int : 2s complement; char : EBCDIC 24A1:0100 02 01 C3 40 A2 85 03 78-9D F1 F0 F0 F0 C0 FF 00 24A1:0110 99 E8 F2 C7 01 96 4C F0 F0 F2 F1 D0 03 C1 C1 82 intchar[4]packedzoned Record 1 02 01C3 40 A2 8503 78 9DF1 F0 F0 F0 C0 (1 decoded) +513C te-3789+10000 Record 2 FF 0099 E8 F2 C701 96 4CF0 F0 F2 F1 D0 (2 decoded) -256rY2G+1964-210

9. End of Lecture