Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Read little endian from file and convert to decimal

I have a file containing unsigned 64 bit integers in little endian format shown below

0100 0000 0000 0000 
0200 0000 0000 0000 
0300 0000 0000 0000 
3655 9d80 0f00 0000 
7a64 dae3 0900 0000 
060f fa3f 0600 0000

I'm looking for a way to read these numbers in and then convert them to their decimal equivilant

The code I have so far is as follows:

filename = "C:\\RainbowTables\\md5_loweralpha-numeric#1-7_0_2x50_0.rt"
blocksize = 8

with open(filename, "rb") as f:
    startpoint = f.read(blocksize)
    string = ""
    for ch in startpoint:
        string += hex(ord(ch))
    print string

which gives me the following output from the first number

0x10x00x00x00x00x00x00x0

I've been looking at how to use structs for this as it seems like it is what it was made for but I've been unable to find the correct syntax using them.

Any help would be hugely appreciated!

like image 418
Scott Avatar asked Mar 18 '23 22:03

Scott


2 Answers

import struct
decoded = []
with open("some_bin_file.rt","rb") as f:
     while True:
          try: 
             decoded.append(struct.unpack_from("<Q",f)[0])
             # `<` means little endian; `Q` means unsigned long long (8 bytes)            
          except struct.error:
             break

print decoded

should work I think ...

like image 63
Joran Beasley Avatar answered Apr 01 '23 04:04

Joran Beasley


The key is the struct module—in particular, struct.unpack—just as Joran Beasley explains.

So, loop over your file, reading 8 bytes at a time until the end:

filename = "C:\\RainbowTables\\md5_loweralpha-numeric#1-7_0_2x50_0.rt"
blocksize = 8

with open(filename, "rb") as f:
    while True:
        buf = f.read(blocksize)
        if not buf:
            break

… unpacking each 8 bytes as a little-endian 64-bit unsigned int:

        value = struct.unpack('<Q', buf)

… and doing whatever you want with each number—maybe adding it to a list?… but let's just print it out for now:

        print value

… and you're done.

like image 30
abarnert Avatar answered Apr 01 '23 04:04

abarnert