1. Understanding Hex
“I hope you have the worst headache of your life, then you will begin to understand” ~unknown

2. Overview Hex Basics Hex editors File Analysis basics GHex hexedit xxd
Magic Numbers
strings, file, xxd

3. Hex Basics Base 16 number system Binary 2 Hex
echo "obase=16;ibase=2; " | bc
Python -c ‘print hex(int(‘ ’,2)’
Hex 2 Binary
echo "obase=2;ibase=16; FFFF" | bc
echo "FFFF" | xxd -r -p | xxd -b
python -c 'print bin(0xFF)'
Hex to Decimal
echo $((16#FF))
python -c 'print(int("FF", 16))'
Number 1 2 3 4 5 6 7
Binary
0000
0001
0010
0011
0100
0110
0111
Hexadecimal
Number 8 9 10 11 12 13 14 15
Binary
1000
1001
1010
1011
1100
1101
1110
1111
Hexadecimal A B C D E F

4. Hex Basics Hex can represent many things including text encodings
You will need to know how to look up an encoding character from hex
There are many different encodings but a lot of the time you will be dealing with ASCII (1 byte encoding 0x0-0x7f)
man ascii (Table of ASCII conversions)
Online ascii conversions
python -c ‘print chr(0x45)’
cat binary_file | xxd

5. Hex Editors
xxd (CLI) - creates a hex dump of a given file or standard input. It can also convert a hex dump back to its original binary form.
hexedit (CLI) - shows a file both in ASCII and in hexadecimal. The file can be a device as the file is read a piece at a time. You can modify the file and search through it.
ghex (GUI) - allows the user to load data from any file, view and edit it in either hex or ascii.
Any Scripting language and usually text editors

6. File Analysis Basics
Rationale - Often times you will need to find hidden information in files or you may not know about a certain file type. Additionally, a forensics tool may not support an image that you have been tasked to extract data from. This is where you will need file analysis techniques to figure out what type of file/image you are examining and develop a tool to parse the file

7. File Analysis Basics
Files are just a huge blob of binary data. The data’s meaning comes from some abstract structure we impose over the raw bits.
The file type tells us the structure to use in interpreting the binary information.
File type is indicated by the magic number, a hex string(s) at a specific offset(s). See:
File type is one form of metadata: data about data.
Metadata is a common source of artifacts.

8. File Analysis Basics Basic tools file command on Linux
Searches for magic numbers in file and also basic header information
strings (linux or Windows)
This will give you ascii strings contained in a data blob it may be helpful in identifying what type of data you are examining. Note strings requires arguments specifying encoding (ASCII, UTF-8, etc.) and endianness.

9. File Analysis Basics Basic tools xxd
Sometimes looking at the hexdump will give you clues as well
File extensions
This is more relevant on Windows but can still be used on Linux
This cannot necessarily be trusted
Exiftool
Analyze exif metadata for image types such as jpeg
File carvers
Binwalk, we will go over these more in the future

10. File Analysis Basics More basic tools diff
Compare two text files and print all the differences
Audacity
Open source tool for analyzing audio files
Specific file metadata tools
Once you know the type of image or file you are dealing with there are often existing tools that can help you interpret the metadata.
Archive tools
You will often receive files compressed using a variety of common to obscure formats.

11. File Analysis Basics
Sometimes the tools mentioned previously leave you with no information or false information. This is when Google becomes helpful. You may still be able to search for strings or hex sequences on Google that will give you valuable information
File analysis can be difficult and can sometimes waste your time.

12. Questions?

13. In Class Assignment 1 You have 10-15 minutes
Find all three parts of the flag
The flag is in the format flag{l33t_sp34k_m3554g3}
*Hint: xxd