Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes for the string, rather than interpret them as the raw bytes.
One way I've seen people accomplish this is by calling python -c 'print("\x00\xFF\xAB")' and piping output to the program under test. Is there a way to do this without using Python by just using the Bash shell?
Use echo -e and pipe to your program's input.
Example:
echo -e "\x41\x42\x43\x44" | <executable>
Will write ABCD as input.
edit: You can pass null-bytes
echo -e command after the executable name, surrounded by backticks: (`). Null bytes are ok in this method too. (Newline chars, however, will break the string)
$(...) to dodge the escaping nightmare that ensues as soon as you start nesting backticks ... null bytes will work in arguments? I find that surprising, since they're treated as zero-terminated. Can you substantiate that claim?
ls, echo -e "\x2E\x2E" (ls ..) works the same as ls with echo "\x2E\x00\x2E", even though it supposedly ends the string. I'd expect the latter to be treated as just "\x2E" and list the current folder but it doesn't. I agree with you on the backticks-escaping though.
If you need null bytes, you can write them to a file and use the file as input for the program, e.g.:
echo -e -n "\x00\xFF\xAB" > file.bin
program < file.bin
You can use also use xxd to convert hex to binary:
echo "00 FF AB" | xxd -r -p | program
xxd – it is much more convenient without the backslashes.