https://systemoverlord.com/tags/csaw.htmlRecent content in CSAW on System OverlordHugoen-usdavid@systemoverlord.com (David Tomaschik)david@systemoverlord.com (David Tomaschik)Mon, 21 Sep 2015 21:33:58 +0000https://systemoverlord.com/2015/09/21/csaw-quals-2015-sharpturn-aka-forensics-400/Mon, 21 Sep 2015 21:33:58 +0000david@systemoverlord.com (David Tomaschik)https://systemoverlord.com/2015/09/21/csaw-quals-2015-sharpturn-aka-forensics-400/<p>The text was just:</p> <blockquote> <p>I think my SATA controller is dying.</p> <p>HINT: <code>git fsck -v</code></p> </blockquote> <p>And included a tarball containing a git repository. If you ran the suggested <code>git fsck -v</code>, you&rsquo;d discover that 3 commits were corrupt:</p> <pre><code>:::text Checking HEAD link Checking object directory Checking directory ./objects/2b Checking directory ./objects/2e Checking directory ./objects/35 Checking directory ./objects/4a Checking directory ./objects/4c Checking directory ./objects/7c Checking directory ./objects/a1 Checking directory ./objects/cb Checking directory ./objects/d5 Checking directory ./objects/d9 Checking directory ./objects/e5 Checking directory ./objects/ef Checking directory ./objects/f8 Checking tree 2bd4c81f7261a60ecded9bae3027a46b9746fa4f Checking commit 2e5d553f41522fc9036bacce1398c87c2483c2d5 error: sha1 mismatch 354ebf392533dce06174f9c8c093036c138935f3 error: 354ebf392533dce06174f9c8c093036c138935f3: object corrupt or missing Checking commit 4a2f335e042db12cc32a684827c5c8f7c97fe60b Checking tree 4c0555b27c05dbdf044598a0601e5c8e28319f67 Checking commit 7c9ba8a38ffe5ce6912c69e7171befc64da12d4c Checking tree a1607d81984206648265fbd23a4af5e13b289f83 Checking tree cb6c9498d7f33305f32522f862bce592ca4becd5 Checking commit d57aaf773b1a8c8e79b6e515d3f92fc5cb332860 error: sha1 mismatch d961f81a588fcfd5e57bbea7e17ddae8a5e61333 error: d961f81a588fcfd5e57bbea7e17ddae8a5e61333: object corrupt or missing Checking blob e5e5f63b462ec6012bc69dfa076fa7d92510f22f Checking blob efda2f556de36b9e9e1d62417c5f282d8961e2f8 error: sha1 mismatch f8d0839dd728cb9a723e32058dcc386070d5e3b5 error: f8d0839dd728cb9a723e32058dcc386070d5e3b5: object corrupt or missing Checking connectivity (32 objects) Checking a1607d81984206648265fbd23a4af5e13b289f83 Checking e5e5f63b462ec6012bc69dfa076fa7d92510f22f Checking 4a2f335e042db12cc32a684827c5c8f7c97fe60b Checking cb6c9498d7f33305f32522f862bce592ca4becd5 Checking 4c0555b27c05dbdf044598a0601e5c8e28319f67 Checking 2bd4c81f7261a60ecded9bae3027a46b9746fa4f Checking 2e5d553f41522fc9036bacce1398c87c2483c2d5 Checking efda2f556de36b9e9e1d62417c5f282d8961e2f8 Checking 354ebf392533dce06174f9c8c093036c138935f3 Checking d57aaf773b1a8c8e79b6e515d3f92fc5cb332860 Checking f8d0839dd728cb9a723e32058dcc386070d5e3b5 Checking d961f81a588fcfd5e57bbea7e17ddae8a5e61333 Checking 7c9ba8a38ffe5ce6912c69e7171befc64da12d4c missing blob 354ebf392533dce06174f9c8c093036c138935f3 missing blob f8d0839dd728cb9a723e32058dcc386070d5e3b5 missing blob d961f81a588fcfd5e57bbea7e17ddae8a5e61333 </code></pre> <p>Well, crap. How do we fix these? Well, I guess the good news is that the git blob format is <a href="https://git-scm.com/book/en/v2/Git-Internals-Git-Objects">fairly well documented</a>. The SHA-1 of a blob is computed by taking the string <code>blob </code>, appending the length of the blob as an ASCII-encoded decimal value, a null character, and then the blob contents itself: <code>blob &lt;blob_length&gt;\0&lt;blob_data&gt;</code>. The final blob value as written in the objects directory of the git repository is the zlib-compressed version of this string. This leads us to these useful functions for reading, writing, and hashing git blobs in python:</p>