写这篇博客的目的是是为了方便下次使用或者帮助其他需要的人。在打CTF的时候,偶尔会遇到还原一些文件,笔者遇到的是分析数据流量的时候,提取出了一个未知文件,用二进制编辑器打开,搜所文件头,发现和某个文件头有点相似,但是每两个字节位置颠倒了,于是就想到把每两个字节交换位置,就像下面这种:
(二).演示及效果:
在命令行执行前后如下图:
(三).贴上代码:
代码是C写的,有点多不太美观,功能太单一, 也没弄啥模块化,编写环境是windows。
#include <stdio.h> #include <stdlib.h> #include <string.h> int main(int argc, const char** argv) { //The pointer of input file and output file FILE *fin; FILE* fout; //The file name of input file and output char* inFile; char* outFile; //The pointer of single and double byte type unsigned short* pDouble = NULL; unsigned char* pSingle = NULL; //The memery buffer of header and tail pointer about input file void* fBuffStart = NULL; void* fBuffEnd = NULL; //The size of input file (Byte) unsigned long fileSize = 0; //Judge the count of parameter and the file name limit if(argc != 3 || strlen(argv[1]) > 255 || strlen(argv[2]) > 255) { printf("\n[-]Usage: %s infile outfile\n", argv[0]); printf("[-]Filename limited: 255 Byte\n"); exit(-1); } inFile = argv[1]; outFile = argv[2]; //Exception handling if(!(fin = fopen(inFile, "rb"))) { printf("Error: open %s failed!\n", inFile); exit(-1); } //Obtain file size fseek(fin, 0, SEEK_END); fileSize = ftell(fin); fseek(fin, 0, SEEK_SET); //Alloc memery for input file and read its data to memery fBuffStart = (unsigned char*)malloc(fileSize); memset(fBuffStart, 0, fileSize); fread(fBuffStart, 1, fileSize, fin); fclose(fin); //The position of start and end input file memery fBuffEnd = (unsigned char*)fBuffStart + fileSize; pDouble = (unsigned short*)fBuffStart; //Exception handling if(!(fout = fopen(outFile,"wb"))) { printf("Error: open %s failed!\n", outFile); exit(-1); } //Exchange position of each two byte while(pDouble != fBuffEnd) { pSingle = pDouble; fwrite(pSingle+1, 1, 1, fout); fwrite(pSingle, 1, 1, fout); pDouble++; } fclose(fout); return 0; }
(四).若有不足之处,还请斧正。
原文:http://blog.51cto.com/daye8ku/2057530