[ale] tool to repair a binary file given a diff betweenhex dumps of the original and the altered

[Jeff Lightner]

Be careful if you don't know what the hex is.  It might be something as
trivial as compile date (in which case it doesn't help him anyway) or
something more critical.   Also if the file contains an internal
checksum of some sort modifying the hex value might cause different
problems.

-----Original Message-----
From: ale-bounces at ale.org [mailto:ale-bounces at ale.org] On Behalf Of
Michael H. Warfield
Sent: Thursday, April 24, 2008 11:37 AM
To: ale at ale.org
Cc: mhw at wittsend.com
Subject: Re: [ale] tool to repair a binary file given a diff betweenhex
dumps of the original and the altered


On Thu, 2008-04-24 at 10:56 -0400, Jerry Yu wrote:
> what tool can I suggest a remote Windows admin to use to 'repair' his
> binary file given the hex diff below. 
> Of course, if this 'repair' is too hairy, I'd go down the
> retransmission route (expensive).

	hexedit?

	I've used this for working on and extracting keys from memory
dumps.

	I know it's available on Linux and OS/X.  Don't know about what
you
would give a Windows admin.  A copy of Ubuntu?

	DOS, we use to just use debug.

> diff meta.od-x tpp.od-x 
> 24,25c24,26 
> < 0000560 6b92 d311 01fb f7be 402c c959 a125 0ac4 
> < 0000600 
> --- 
> > 0000560 6b92 d311 01fb f7be 402c c959 a125 0d0a 
> > 0000600 c400 
> > 0000601 

	Mike
-- 
Michael H. Warfield (AI4NB) | (770) 985-6132 |  mhw at WittsEnd.com
   /\/\|=mhw=|\/\/          | (678) 463-0932 |
http://www.wittsend.com/mhw/
   NIC whois: MHW9          | An optimist believes we live in the best
of all
 PGP Key: 0xDF1DD471        | possible worlds.  A pessimist is sure of
it!
----------------------------------
CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.
----------------------------------