5

There is an interesting article on Phack: http://phrack.org/issues/69/15.html#article

At the end of the article there is the source appended in a strange encoding. 

begin 664 hypervisor_for_rootkit.tar.gz
M'XL(`%?BS58``^P];7>B2-;]U3ZG_P/K[LXQTU$!$<R0S!Q4['C&1!\U[<PS
M/<=%*)5I!`8P+],[_WUO%:!@0,U+)YUNJF,+U*U;5??]E@7,;VSD7.JNY8RG
M\'$LR_NH>^57CUEH*`)-XV]&J,:^P_**87F^4N$96A!>T0S'5/A75/511Y%2
...
`
end

Does anyone know how to convert this back to the original archive?

Improve this question
0

3 Answers 3

Reset to default
7

This seems to be UUencoded data.

Improve this answer
2
  • I succeeded decode it with perl: the format is "u61". put the string into $a and: open(my $out, '>:raw', 'b1.tar.gz') or die "Unable to open: $!"; print $out unpack("u61",$a); close($out);
    – Konrad Eisele
    Commented Oct 18, 2016 at 17:43
  • 1
    Append: there happen to be a program to decode as well: "uudecode"
    – Konrad Eisele
    Commented Oct 18, 2016 at 17:57
4

Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their "magic" mime, i.e. markers left in the file (like you see %PDF in PDFs and PK in zip files).

file accepts as argument a filename, like file /tmp/unknown-file. It can also read from STDIN if you use - as the "file" argument. This makes it easy to just figure out an encoding you're seeing without having to store the file:

cat | file -

Now paste the data and end with Ctrl+D (which signals 'end of input'). In your case, the result is this:

/dev/stdin: uuencoded or xxencoded, ASCII text

For some formats it can give a lot of information, like for gzip compressed data:

echo test | gzip | file -
/dev/stdin: gzip compressed data, last modified: Wed Oct 19 01:36:02 2016, from Unix
Improve this answer
1
  • 1
    Also, if you add -z, it will look inside compressed files, giving you even more information
    – Nick Mertin
    Commented Oct 25, 2016 at 22:48
-1

If you are using a file manager like Total Commander on Windows, simply create a new text file (Shift+F4), name it like you want followed by .uue extension i.e. hypervisor_for_rootkit.tar.gz.uue

Then paste the whole encoded symbols in that new text file with *.uue extension including the 'begin ...' and 'end' strings.

Now open (click) that file in Total Commander and it'll be ready to unpack (decode) it to the sidebar location.

Or Files -> Decode File... in menu on selected .uue file

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.