1

When looking at raw binary dumps are there any tools to help identify and decode base64 strings contained within? Essentially "strings", but taking into account base64.

  • A simple solution will be to run strings.exe, then try and decode each resulting string as base64. – tmr232 Oct 1 '15 at 14:36
  • @tmr232 do not only decode line by line. If a complete line cannot be decoded, all substrings need to be checked. – Thomas Weller Oct 7 '15 at 20:17
  • What content do you expect after decoding base64? Would that be a human readable string again or result in more or less hex data? What would you do with that hex data next? – Thomas Weller Oct 8 '15 at 18:36
  • I interpreted the "raw binary dump" as a .dmp file. Such a memory dump contains all sorts of strings, starting with MDMP but also words like Winlogon and a lot of REGISTRY related stuff containing SOFTWARE which is all valid base64 but it doesn't really make sense to decode that. If you could be a bit more specific, that would be great. – Thomas Weller Oct 8 '15 at 18:48
1

using powershell

C:\>type bana.txt
bXkgZmlyc3Qgc3RyaW5nCm15IHNlY29uZCBzdHJpbmcKbXkgdGhpcmQgc3RyaW5nZ2cgb2sh
CiJIZWxsbyBXb3JsZCI=

C:\>powershell -c "gc .\bana.txt | Select-String -Pattern ".*" |% { [text.encodi
ng]::ASCII.GetString([convert]::FromBase64String($_)) }"
my first string
my second string
my third stringgg ok!

"Hello World"

change the encoding to utf-8 if the file contains unicode encoded bas464 stringg

C:\>cat unibana.txt
 ■b X k g Z m l y c 3 Q g c 3 R y a W 5 n C m 1 5 I H N l Y 2 9 u Z C B z d H J
  b m c K b X k g d G h p c m Q g c 3 R y a W 5 n Z 2 c g b 2 s h
 C i J I Z W x s b y B X b 3 J s Z C I =

C:\>powershell -c "gc .\bana.txt | Select-String -Pattern ".*" |% { [text.encodi
ng]::utf8.GetString([convert]::FromBase64String($_)) }"
my first string
my second string
my third stringgg ok!

"Hello World"

C:\>ls -l *ban*
-rw-rw-rw-  1 Admin 0  96 2015-10-02 12:23 bana.txt
-rw-rw-rw-  1 Admin 0 194 2015-10-02 12:27 unibana.txt

if the string is invalid bas64 string this will throw an invalid format exception and continue to decode the rest of file

C:\>cat bana.txt
bXkgZmlyc3Qgc3RyaW5nCm15IHNlY29uZCBzdHJpbmcKbXkgdGhpcmQgc3RyaW5nZ2cgb2sh
CiJIZWxsbyBXb3JsZCI=
yakku
bakku
bXkgZmlyc3Qgc3RyaW5nCm15IHNlY29uZCBzdHJpbmcKbXkgdGhpcmQgc3RyaW5nZ2cgb2sh
CiJIZWxsbyBXb3JsZCI=    

C:\>powershell -c "gc .\bana.txt | Select-String -Pattern ".*" |% { [text.encodi
ng]::ASCII.GetString([convert]::FromBase64String($_)) }"
my first string
my second string
my third stringgg ok!

"Hello World"
Exception calling "FromBase64String" with "1" argument(s): "Invalid length for
a Base-64 char array."
At line:1 char:108
+ gc .\bana.txt | Select-String -Pattern .* |% { [text.encoding]::ASCII.GetStri
ng([convert]::FromBase64String <<<< ($_)) }
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException

Exception calling "FromBase64String" with "1" argument(s): "Invalid length for
a Base-64 char array."
At line:1 char:108
+ gc .\bana.txt | Select-String -Pattern .* |% { [text.encoding]::ASCII.GetStri
ng([convert]::FromBase64String <<<< ($_)) }
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException    
my first string
my second string
my third stringgg ok!

"Hello World"

edit is in reply to a comment by thomas weller
do you have a test suite for me to test against or abuse the testcase foo.txt below to break the assumptions made in the reply

IMHO a string is a bunch of characters interspersed with carriage return and or carriage return + line feed terminated with a null a normal string if its length is in multiples of 4 and contains the same subset of characters used in base64 string cannot be differentiated from one another

PS C:\> xxd -g 1 .\foo.txt
0000000: 75 0d 62 58 6b 67 0d 62 58 6b 67 0d 0a 62 58 6b  u.bXkg.bXkg..bXk
0000010: 67 75 0d 0a 62 58 6b 67 75 0d 62 58 6b 67 0d 62  gu..bXkgu.bXkg.b
0000020: 58 6b 67 62 58 6b 67 0d 62 58 6b 67 62 58 6b 67  XkgbXkg.bXkgbXkg
PS C:\> cat .\foo.txt
u
bXkg
bXkg
bXkgu
bXkgu
bXkg
bXkgbXkg
bXkgbXkg
PS C:\> strings.exe -q -n 1 .\foo.txt
u
bXkg
bXkg
bXkgu
bXkgu
bXkg
bXkgbXkg
bXkgbXkg
PS C:\> cat .\decodeb64strings.ps1
$ErrorActionPreference="silentlycontinue"
select-string -Path $args[0] -Pattern ".*" |%{$out=[text.encoding]::Ascii.getst
ring([convert]::FromBase64String($_.Line));if($?){$out}else{$_}}
PS C:\>
PS C:\> .\decodeb64strings.ps1 .\foo.txt    
foo.txt:1:u
my
my
foo.txt:4:bXkgu
foo.txt:5:bXkgu
my
my my
my my
  • I see that this works if a base64 string starts on a new line. I don't see how that works if the base64 part of the string starts e.g. on the second character of the line (which might be the case due to other ASCII output of strings right before the base64 data. – Thomas Weller Oct 7 '15 at 20:17
  • to accept indeficiency or to correct the implementation if it is feasible i would require a valid test case that one would see in a normal world a hypothetical wild guess indicating substrings in a bigger string is a definite recipe for chaos any string that could be stripped into multiples of 4 can be a valid base64 string so yuck can be both english word or a base64 encoded string yucky is invalid base64 string while it is a valid normal english string – blabb Oct 8 '15 at 8:21
  • That's a very valid point. So we should really clarify what OP needs. I interpreted the "raw binary dump" as a .dmp file. Such a memory dump contains all sorts of strings, starting with MDMP but also words like Winlogon and a lot of REGISTRY related stuff containing SOFTWARE which is all valid base64 but it doesn't really make sense to decode that. – Thomas Weller Oct 8 '15 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.