> Daniel Lord wrote: > > > > > Not shure if I got your question right. Hexedit is the tool to get > > the bytes (not strings). The rest is knowlegde of the JFIF > > fileformat. And some (>20000) samples to prove that the format is > > implemented widely this way. :) > > Sorry if my question was a bit vague :) That was indeed the type of > answer I was after. The reason that I asked is because neither od nor > hexdump output contains the strings listed, and I was just wondering if > they can, or if I'm barking up the wrong tree trying to extract the info > from a jpeg with those utils. >
Found out why I couldn't find them with hexdump. Its standard output type makes ffd8 into d8ff. (Sorry for referring to them as strings again instead of bytes, Daniel). One last question, do the fffe 000(0|1) bytes always have to follow each other for this exploit, or is this just a pure example of the possibility of this exploit? Matt ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
