merces / hdump

Fast, simple and portable hexadecimal/ASCII dumper

Hello, stranger! 👋

So, you found me.

• 🔭 I’ve spent the past 10 years working as a threat researcher in Trend Micro.
• 💚 I run a non-profit organization called Mente Binária to educate people in computing.
• ⚡ Fun fact: I play guitar.

Things I love

Recent Publications ✍️

• How BPF-Enabled Malware Works: Bracing for Emerging Threats
• Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant
• Detecting BPFDoor Backdoor Variants Abusing BPF Filters
• Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals
• DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework
• Defending NAS Devices Against Evolving Threats
• Modern Ransomware's Double Extortion Tactics and How to Protect Enterprises Against Them
• VirusTotal Now Supports Trend Micro ELF Hash
• Grouping Linux IoT Malware Samples With Trend Micro ELF Hash
• VPNFilter Two Years Later: Routers Still Compromised

---

📊 Github Stats

hdump's Issues

Check for writing errors

$ hdump README.md > /dev/full
$ echo $?
0

Compilation fail

Compilation fails with the following error on Linux 64-bit machine:

$ make
gcc -O2 -W -Wall -Wextra -ansi -pedantic -o hdump hdump.c
hdump.c: In function ‘fatal’:
hdump.c:35:2: warning: format not a string literal and no format arguments [-Wformat-security]

Missing support for reading from stdin

$ echo foo | hdump
Usage:
        hdump [-c columns] [-s skip] [-n length] file

$ echo foo | hdump /dev/stdin
unable to seek through file

Last line printing issue

The number of spaces before printing ASCII chars is not correct if you use skip (-s) option:

$ hdump -s 0x9a Makefile
0000009a  0a 63 6c 65 61 6e 3a 0a  09 72 6d 20 2d 66 20 68  |.clean:..rm -f h|
000000aa  64 75 6d 70 0a                                   |dump.|

Check for reading errors

$ hdump /proc/self/mem
$ echo $?
0

Wrongly treating last argument as path

If you provide an option, but not the path, it treats the last argument as path:

$ hdump -c 0
file not found or not readable

Support for files bigger than 2GB

$ truncate -s 3G foo
$ hdump foo
file not found or not readable