---

Manual Reference Pages  - datasniffer (1)

---

datasniffer - dump data from a binary file

CONTENTS

Synopsis
Description
Options
Examples
See Also
License
Copyright
Authors

datasniffer [options...]

datasniffer is intended for use in reverse engineering binary data files whose contents are known (more or less) but whose internal organization is not known. datasniffer reads data from a specified input one byte at a time and dumps the indicated data types to a specified output after formatting each data type as requested. Each input byte results in an output line containing all of the requested formats of all of the requested data types. By examining this output a user may find the expected values and from that may be able to determine the file’s internal structure.

datasniffer is part of the drm_tools package which may be obtained from: http://sourceforge.net/projects/drmtools/

-in <input_file>
	Read input from the specified file. Use - to read from stdin. Default is to read from stdin.
-out <output_file>
	Write output to the specified file. Use - to write to stdout. Default is to write to stdout.
-o <offset>
	Emit data starting at <offset> bytes from the beginning of the file. Default is 0.
-l <multiple>
	The number of bytes to dump. Default is 0 = all.
-c <columns>
	Emit formatted data for <columns> bytes for each output line. The first "column" in a line will show all combinations of data types, formats, and byte orders for the data starting on that byte. The second column will do the same for the next byte, and so forth. Consequently the resulting data dump is most legible when only a single data type, format and byte order are displayed. Default is 1.
-n <number>
	Specify line numbering options by including one or more of the characters from the list below. Default is a0xd. Note that when any specification of number options must include at least one of x, d, or o. n no numbering a absolute position (number from start of file) r relative position (number from offset) 0 number from 0 1 number from 1 x print position in hexadecimal d print position in decimal o print position in octal
-d <data_type>
	Specify the types of data to display by including characters from the list below. Default is CSL. c signed char s signed short int l signed (long) int g signed long long (not available on all platforms) f signed float d signed double C unsigned char S unsigned short int L unsigned (long) int G unsigned long long (not available on all platforms)
-b <byte_order>
	Specify the order of bytes in the data by including characters from the list below. Default is f. f forward (as read from data) r reverse (invert order for each data size)
-r <N>	Header line control. The default value is INT_MAX which results in a single header line at the start of the output. 0 no headers N one header at start of output and then every N output lines after that
-p	Emit a page break before every header except the first. If printed as text most printers will respect the page break and start a new page before each header line.
-ds	Emit data sizes and exit.
-h -help --help -? --??
	Print the help message and exit.
-i	Emit version, copyright, license and contact information and exit.
Format options which may be specified for the -f* parameters:
	c char, d decimal, x hexadecimal, o octal, f float, e exp.
-fc [cdxo]
	Emit the c and C data types with the formats specified. If the character isn’t printable c format emits an "NP". Default is cx.
-fs [dxo]
	Emit the s and S data types with the formats specified. Default is dx.
-fl [dxo]
	Emit the l and L data types with the formats specified. Default is dx.
-fg [dxo]
	Emit the g and G data types with the formats specified. Default is dx.
-ff [fe]
	Emit the f data type with the formats specified. Note that format f may exceed the field width, in which case the data is shown as a "*". Use format e to see the full range of the data. Default is f.
-fd [fe]
	Emit the d data type with the formats specified. Note that format f may exceed the field width, in which case the data is shown as a "*". Use format e to see the full range of the data. Default is f.

% datasniffer -h
	List the the command line options.
% echo ABCD | datasniffer -d cs -n d -fc c -fs x -b fr
	P0AbsDec c(+,%c) c(-,%c) s(+,%x) s(-,%x) 0 A A 41 4100 1 B B 4142 4241 2 C C 4243 4342 3 D D 4344 4443 4 NP NP 440a a44 Dump for each byte of the input data types c and x. Use format c with data type c and format x with data type s. Also show the data for both directions, forward and reversed.
% echo ABCD | datasniffer -d c -n d
	P0AbsDec c(+,%c) c(+,%x) 0 A 41 1 B 42 2 C 43 3 D 44 4 NP a Emit a single header line followed by one data line each for the four ascii characters ABCD and the trailing newline. Each such line shows the absolute position of that byte (numbered from zero), the character it corresponds to, and the hexadecimal value of the byte
% echo ABCDEFGHIJKLMNOPQRSTUVWXYZ \
	| datasniffer -d s -fs x -c 5 -n d P0RelDec s(+,%x) s(+,%x) s(+,%x) s(+,%x) s(+,%x) 0 41 4142 4243 4344 4445 5 4546 4647 4748 4849 494a 10 4a4b 4b4c 4c4d 4d4e 4e4f 15 4f50 5051 5152 5253 5354 20 5455 5556 5657 5758 5859 25 595a 5a0a Emit multiple columns of data on each line.

od(1), mdump(1)

GNU General Public License 2

Copyright (C) 2008 David Mathog and Caltech.

David Mathog, Biology Division, Caltech <mathog@caltech.edu>