$ python3 >>> import struct >>> with open("complex.bin","rb") as f: ... magic, version, crc, off, length = struct.unpack("<IIIII", f.read(20)) >>> print(hex(off), length) # 0x20, 480 >>> f.seek(0x20) >>> data = f.read(480) >>> data[:4] == b'\x78\x9c\x01\x00' # zlib header? True
$ file complex.bin data $ xxd complex.bin | head -1 00000000: 434f 4d50 0100 0000 1c00 0000 2000 0000 COMP........ ... complex.bin
dd if=complex.bin of=payload.bin bs=1 skip=64 count=1024 Assume complex.bin has the following layout (common pattern): $ python3 >
>>> import zlib >>> out = zlib.decompress(data) >>> out.find(b"FLAG{") 42 >>> print(out[42:42+30]) b'FLAGc0mpl3x_b1n4ry_f0rm4t' Save as parse_complex.py : import struct >
#!/usr/bin/env python3 import sys, struct, zlib, binascii def parse_complex_bin(path): with open(path, "rb") as f: raw = f.read()
Unser Newsletter ✉ 
…bringt alle Gratisproben und die besten Aktionen schnell, punktgenau und 1x wöchentlich kostenlos ins Postfach!
Gleich kostenlos abonnieren, einfach E-Mail-Adresse hier eintragen: