CS 50 Walkthrough 5 Problem Set 5: Forensics Marta Bralic Slides Courtesy of Keito Uchiyama

Problem Set 5: Forensics •  Topics:
 –  File
I/O
 –  Data
structures,
hexadecimal,
and
pointers


•  Programs:
 –  whodunit
 –  resize
 –  recover


Bitmaps •  Each
pixel’s
color
is
represented
as
levels
of
 Blue,
Green,
and
Red.
 [00‐ff]
[00‐ff]
[00‐ff]
 •  A
bitmap
is
a
series
of
consecuMve
pixels
 described
aNer
each
other.
 •  Also
has
“metadata”
in
first
54
bytes
 consisMng
of
two
headers.


Smiley 

Smiley  ffffff
ffffff
0000ff
0000ff
0000ff
0000ff
ffffff
ffffff
 ffffff
0000ff
ffffff
ffffff
ffffff
ffffff
0000ff
ffffff
 0000ff
ffffff
0000ff
ffffff
ffffff
0000ff
ffffff
0000ff
 0000ff
ffffff
ffffff
ffffff
ffffff
ffffff
ffffff
0000ff
 0000ff
ffffff
0000ff
ffffff
ffffff
0000ff
ffffff
0000ff
 0000ff
ffffff
ffffff
0000ff
0000ff
ffffff
ffffff
0000ff
 ffffff
0000ff
ffffff
ffffff
ffffff
ffffff
0000ff
ffffff
 ffffff
ffffff
0000ff
0000ff
0000ff
0000ff
ffffff
ffffff


Bitmap Headers

Bitmap padding

Whodunit?

Resize •  Two
steps:
 –  Make
necessary
changes
to
the
metadata
 –  Write
out
the
new
pixels


•  We
can
use
the
same
copy.c
framework!


Resize - Metadata

Resize - Pixels

resize
2
small.bmp
large.bmp


Image recovery! 0000000:
ff
d8
ff
e0
00
10
4a
46

......JF
 0000008:
49
46
00
01
01
01
00
60

IF.....`
 0000010:
00
60
00
00
ff
e1
1d
da

.`......
 0000018:
45
78
69
66
00
00
49
49

Exif..II
 0000020:
2a
00
08
00
00
00
0a
00

*.......
 0000028:
0f
01
02
00
12
00
00
00

........
 0000030:
86
00
00
00
10
01
02
00

........
 0000038:
0b
00
00
00
98
00
00
00

........
 0000040:
12
01
03
00
01
00
00
00

........
 0000048:
00
00
00
00
1a
01
05
00

........


Image recovery - Steps •  Steps:
 Go
through
each
block
in
the
disk
image
and:
 1.  If
we
find
a
JPEG
signature,
start
wriMng
the
 bytes
out
to
another
file
 2.  If
we
find
a
new
JPEG
signature,
close
that
old
 file
and
go
back
to
2
 3.  If
we
find
the
End
Of
File,
close
the
file
and
 kthxbai


QuesMons?


CS 50 Walkthrough 5 - CS50 CDN

A bitmap is a series of consecuûve pixels described after each other. • Also has “metadata” in first 54 bytes consisûng of two headers.

684KB Sizes 1 Downloads 294 Views

Recommend Documents

CS 50 Walkthrough 6 - CS50 CDN
Slow but simple: Linear search every fme. – don't do this! • Hash tables. • Tries ... easy if you've kept a counter that you increment every fme you load a word.

CS 50 Walkthrough 5
A bitmap is a series of consecuûve pixels described after each other. • Also has “metadata” in first 54 bytes consisûng of two headers.

CS 50 Walkthrough 5
Data structures, hexadecimal, and pointers. • Programs: – whodunit. – resize. – recover ... Image recovery! ... Go through each block in the disk image and: 1.

CS 50 Walkthrough 5
Image recovery - Steps. • Steps: Go through each block in the disk image and: 1. If we find a JPEG signature, start wriûng the bytes out to another file. 2. If we find a new JPEG signature, close that old file and go back to 2. 3. If we find the E

CS50 Walkthrough 1 - CS50 CDN
Free Candy. ▫ Time for Change. ▫ I Saw You ... Free Candy. ▫ Seriously, in the CS50 ... ask user for an integer printf("Give me an integer between 1 and 10: ");.

CS50 Walkthrough #3 - CS50 CDN
Go to middle if k < value at middle search for k between first and the one before the middle if k > value at middle search for k between one after the middle and last if k = value at middle return true. If you haven't found k after this loop, return

CS50 Walkthrough #3 - CS50 CDN
what type are these values? ▫ how do we initialize them? ▫ don't forget! ▫ swap tiles for even d ... Questions? Please email me feedback: [email protected].

CS 50 Walkthrough 6
create nodes for them. – put these nodes ... store each le›er i of the word in that node. • fgetc(dptr) is that ... put a pointer to your node that you just malloced there.

CS 50 Walkthrough 6
Topics: – More data structures, more pointers. – More File I/O. • You implement: ... convert each le›er of word tolower. • hash word and go to that place in array.

cs50.c 1/5 cs50.c 2/5 - CS50 CDN
11: * Based on Eric Roberts' genlib.h and simpio.h. 12: *. 13: * The latest version of this file can be found at. 14: * http://www.cs50.net/pub/releases/cs50/cs50.h.

cs50.c 1/5 cs50.c 2/5 - CS50 CDN
delete from middle or tail. 100: else. 101: {. 102: predptr->next = ptr->next;. 103: free(ptr);. 104: }. 105: 106: // all done. 107: break;. 108: }. 109: else. 110: {. 111:.

52/cs50! - CS50 CDN
SSH. • Secure Shell. • Allows you to access another computer through command-‐line interface. • We use SSH to connect to the CS50 Cloud!

52/cs50! - CS50 CDN
A condi on may have two values: true or false. • May be expressed as a logical expression or a. 'bool' variable. • Can be thought of as a yes/no ques on, or a.

Problem Set 5: Forensics - CS50 CDN
21 Actual credit for photos goes to ACM, Dan Armendariz, Eliza Grinnell, Harvard Crimson, Harvard Gazette, NVIDIA, SEAS, Titus. Zhang, et al. 22 This one's ...

CS50 Walkthrough 4
function, takes one argument ch (ascii). ▫ if ch is 0, . , KEY_BACKSPACE, KEY_DC. ▫ set that spot in the board to 0. ▫ if ch is numerical between '1' and '9'.

CS50 Walkthrough #3
search. ▫ sort. ▫ fifteen.c. ▫ distribution code ... Re-implement as binary! ▫ why? ▫ 2 main ways. ▫ iterative. ▫ recursive. Page 6. Binary Search: Iterative. Go to middle.

CS50 Walkthrough 4
distribution code. ▫ ncurses. ▫ move cursor. ▫ allow changing user-added numbers, but not original ones. ▫ allow replacement of blank with number. ▫ invalid move? ▫ won? ... Moving the cursor. ▫ Switch statements! switch (test). { case

Merge Sort - CS50 CDN
Data stored in memory has both a value and a location. • Pointers contain the memory address of some piece of data. • * pointer contains address to a ...

pset4 - CS50 CDN
Oct 8, 2010 - Go ahead and execute the command below: hostname. Recall that cloud.cs50.net is actually a cluster of servers. That command tells you the name of the specific server in the cluster that you happen to be connected to at the moment. Take

CS50 Walkthrough 4
To Do. ▫ distribution code. ▫ ncurses. ▫ move cursor. ▫ allow changing user-added ... Allows you to change colors, ... g.board[g.y][g.x] is spot on board where.

Merge Sort - CS50 CDN
Data stored in memory has both a value and a location. • Pointers contain the memory address of some piece of data. • * pointer contains address to a ...

CS51 - CS50 CDN
We can still conceptualize & prototype using the right language abstractions. ▻ If we understand relationships between linguistic abstractions, we can realize ...

Untitled - CS50 CDN
http://developer.apple.com/library/ios/documentation/UserExperience/Conceptual/MobileHIG/Characteristics/Characteristics.html ... content="yes"> http://developer.apple.com/library/safari/documentation/appleapplications/reference/SafariHTMLRef/Article

Asymptotic Notation - CS50 CDN
Like searching through the phone book. • Identify ... as you go. If array[i + 1] < array[i], swap them! ... Grab the smallest and swap it with whatever is at the front of ...