Skip to content

Instantly share code, notes, and snippets.

@knotech
Last active April 17, 2017 03:35
Show Gist options
  • Save knotech/a4cebe0b19a1e8c33b5c89256c0b35db to your computer and use it in GitHub Desktop.
Save knotech/a4cebe0b19a1e8c33b5c89256c0b35db to your computer and use it in GitHub Desktop.
hex_dump = """
0000000 eb 58 90 42 53 44 20 20 34 2e 34 00 02 10 20 00
0000010 02 00 00 00 00 f0 00 00 20 00 ff 00 00 00 00 00
0000020 f4 53 cd 01 9d 39 00 00 00 00 00 00 02 00 00 00
0000030 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00
0000040 00 00 29 02 14 f9 7e 47 43 47 4c 49 4e 55 58 20
0000050 20 20 46 41 54 33 32 20 20 20 fa 31 c0 8e d0 bc
0000060 00 7c fb 8e d8 e8 00 00 5e 83 c6 19 bb 07 00 fc
0000070 ac 84 c0 74 06 b4 0e cd 10 eb f5 30 e4 cd 16 cd
0000080 19 0d 0a 4e 6f 6e 2d 73 79 73 74 65 6d 20 64 69
0000090 73 6b 0d 0a 50 72 65 73 73 20 61 6e 79 20 6b 65
00000a0 79 20 74 6f 20 72 65 62 6f 6f 74 0d 0a 00 00 00
00000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
00001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
0000200 52 52 61 41 00 00 00 00 00 00 00 00 00 00 00 00
0000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
00003e0 00 00 00 00 72 72 41 61 04 ce 1c 00 06 00 00 00
00003f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
0000400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000c00 eb 58 90 42 53 44 20 20 34 2e 34 00 02 10 20 00
0000c10 02 00 00 00 00 f0 00 00 20 00 ff 00 00 00 00 00
0000c20 f4 53 cd 01 9d 39 00 00 00 00 00 00 02 00 00 00
0000c30 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00
0000c40 00 00 29 02 14 f9 7e 47 43 47 4c 49 4e 55 58 20
0000c50 20 20 46 41 54 33 32 20 20 20 fa 31 c0 8e d0 bc
0000c60 00 7c fb 8e d8 e8 00 00 5e 83 c6 19 bb 07 00 fc
0000c70 ac 84 c0 74 06 b4 0e cd 10 eb f5 30 e4 cd 16 cd
0000c80 19 0d 0a 4e 6f 6e 2d 73 79 73 74 65 6d 20 64 69
0000c90 73 6b 0d 0a 50 72 65 73 73 20 61 6e 79 20 6b 65
0000ca0 79 20 74 6f 20 72 65 62 6f 6f 74 0d 0a 00 00 00
0000cb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000df0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
0000e00 52 52 61 41 00 00 00 00 00 00 00 00 00 00 00 00
0000e10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000fe0 00 00 00 00 72 72 41 61 08 ce 1c 00 03 00 00 00
0000ff0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
0001000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0004000 f0 ff ff 0f ff ff ff 0f ff ff ff 0f ff ff ff 0f
0004010 ff ff ff 0f ff ff ff 0f ff ff ff 0f 00 00 00 00
0004020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0737a00 f0 ff ff 0f ff ff ff 0f ff ff ff 0f ff ff ff 0f
0737a10 ff ff ff 0f ff ff ff 0f ff ff ff 0f 00 00 00 00
0737a20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0e6b400 47 43 47 4c 49 4e 55 58 20 20 20 28 00 00 00 00
0e6b410 00 00 00 00 00 00 3a 64 90 4a 00 00 00 00 00 00
0e6b420 41 2e 00 5f 00 2e 00 54 00 72 00 0f 00 7f 61 00
0e6b430 73 00 68 00 65 00 73 00 00 00 00 00 ff ff ff ff
0e6b440 7e 31 20 20 20 20 20 20 54 52 41 22 00 0d 3a 64
0e6b450 90 4a 90 4a 00 00 3a 64 90 4a 04 00 00 10 00 00
0e6b460 e5 52 41 53 48 45 7e 31 33 58 42 12 00 0d 3a 64
0e6b470 90 4a 90 4a 00 00 3a 64 90 4a 03 00 00 00 00 00
0e6b480 41 2e 00 54 00 72 00 61 00 73 00 0f 00 25 68 00
0e6b490 65 00 73 00 00 00 ff ff ff ff 00 00 ff ff ff ff
0e6b4a0 54 52 41 53 48 45 7e 31 20 20 20 12 00 0d 3a 64
0e6b4b0 90 4a 90 4a 00 00 3a 64 90 4a 03 00 00 00 00 00
0e6b4c0 41 2e 00 66 00 73 00 65 00 76 00 0f 00 da 65 00
0e6b4d0 6e 00 74 00 73 00 64 00 00 00 00 00 ff ff ff ff
0e6b4e0 46 53 45 56 45 4e 7e 31 20 20 20 12 00 12 3a 64
0e6b4f0 90 4a 90 4a 00 00 3a 64 90 4a 05 00 00 00 00 00
0e6b500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0e6d400 2e 20 20 20 20 20 20 20 20 20 20 32 00 0d 3a 64
0e6d410 90 4a 90 4a 00 00 3a 64 90 4a 03 00 00 00 00 00
0e6d420 2e 2e 20 20 20 20 20 20 20 20 20 10 00 0d 3a 64
0e6d430 90 4a 90 4a 00 00 3a 64 90 4a 00 00 00 00 00 00
0e6d440 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0e6f400 00 05 16 07 00 02 00 00 4d 61 63 20 4f 53 20 58
0e6f410 20 20 20 20 20 20 20 20 00 02 00 00 00 09 00 00
0e6f420 00 32 00 00 0e b0 00 00 00 02 00 00 0e e2 00 00
0e6f430 01 1e 00 00 00 00 00 00 00 00 40 00 00 00 00 00
0e6f440 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0e6f450 00 00 00 00 41 54 54 52 3b 9a c9 ff 00 00 0e e2
0e6f460 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00
0e6f470 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"""
concated = 'eb 58 90 42 53 44 20 20 34 2e 34 00 02 10 20 \n 02 00 00 00 00 f0 00 00 20 00 ff 00 00 00 00 \n f4 53 cd 01 9d 39 00 00 00 00 00 00 02 00 00 \n 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 29 02 14 f9 7e 47 43 47 4c 49 4e 55 58 \n 20 20 46 41 54 33 32 20 20 20 fa 31 c0 8e d0 \n 00 7c fb 8e d8 e8 00 00 5e 83 c6 19 bb 07 00 \n ac 84 c0 74 06 b4 0e cd 10 eb f5 30 e4 cd 16 \n 19 0d 0a 4e 6f 6e 2d 73 79 73 74 65 6d 20 64 \n 73 6b 0d 0a 50 72 65 73 73 20 61 6e 79 20 6b \n 79 20 74 6f 20 72 65 62 6f 6f 74 0d 0a 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 \n 52 52 61 41 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 72 72 41 61 04 ce 1c 00 06 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n eb 58 90 42 53 44 20 20 34 2e 34 00 02 10 20 \n 02 00 00 00 00 f0 00 00 20 00 ff 00 00 00 00 \n f4 53 cd 01 9d 39 00 00 00 00 00 00 02 00 00 \n 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 29 02 14 f9 7e 47 43 47 4c 49 4e 55 58 \n 20 20 46 41 54 33 32 20 20 20 fa 31 c0 8e d0 \n 00 7c fb 8e d8 e8 00 00 5e 83 c6 19 bb 07 00 \n ac 84 c0 74 06 b4 0e cd 10 eb f5 30 e4 cd 16 \n 19 0d 0a 4e 6f 6e 2d 73 79 73 74 65 6d 20 64 \n 73 6b 0d 0a 50 72 65 73 73 20 61 6e 79 20 6b \n 79 20 74 6f 20 72 65 62 6f 6f 74 0d 0a 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 \n 52 52 61 41 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 72 72 41 61 08 ce 1c 00 03 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n f0 ff ff 0f ff ff ff 0f ff ff ff 0f ff ff ff \n ff ff ff 0f ff ff ff 0f ff ff ff 0f 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n f0 ff ff 0f ff ff ff 0f ff ff ff 0f ff ff ff \n ff ff ff 0f ff ff ff 0f ff ff ff 0f 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 47 43 47 4c 49 4e 55 58 20 20 20 28 00 00 00 \n 00 00 00 00 00 00 3a 64 90 4a 00 00 00 00 00 \n 41 2e 00 5f 00 2e 00 54 00 72 00 0f 00 7f 61 \n 73 00 68 00 65 00 73 00 00 00 00 00 ff ff ff \n 7e 31 20 20 20 20 20 20 54 52 41 22 00 0d 3a \n 90 4a 90 4a 00 00 3a 64 90 4a 04 00 00 10 00 \n e5 52 41 53 48 45 7e 31 33 58 42 12 00 0d 3a \n 90 4a 90 4a 00 00 3a 64 90 4a 03 00 00 00 00 \n 41 2e 00 54 00 72 00 61 00 73 00 0f 00 25 68 \n 65 00 73 00 00 00 ff ff ff ff 00 00 ff ff ff \n 54 52 41 53 48 45 7e 31 20 20 20 12 00 0d 3a \n 90 4a 90 4a 00 00 3a 64 90 4a 03 00 00 00 00 \n 41 2e 00 66 00 73 00 65 00 76 00 0f 00 da 65 \n 6e 00 74 00 73 00 64 00 00 00 00 00 ff ff ff \n 46 53 45 56 45 4e 7e 31 20 20 20 12 00 12 3a \n 90 4a 90 4a 00 00 3a 64 90 4a 05 00 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 2e 20 20 20 20 20 20 20 20 20 20 32 00 0d 3a \n 90 4a 90 4a 00 00 3a 64 90 4a 03 00 00 00 00 \n 2e 2e 20 20 20 20 20 20 20 20 20 10 00 0d 3a \n 90 4a 90 4a 00 00 3a 64 90 4a 00 00 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 05 16 07 00 02 00 00 4d 61 63 20 4f 53 20 \n 20 20 20 20 20 20 20 20 00 02 00 00 00 09 00 \n 00 32 00 00 0e b0 00 00 00 02 00 00 0e e2 00 \n 01 1e 00 00 00 00 00 00 00 00 40 00 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 41 54 54 52 3b 9a c9 ff 00 00 0e \n 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \n 00 00 00 00 01 00 00 00 01 00 00'
concated_out = ''.join([chr(int(i, 16)) for i in concated])
print concated_out
>>> "\xebX\x90BSD 4.4\x02\x10 \x02\xf0 \xff\xf4S\xcd\x01\x9d9\x02\x01\x06)\x02\x14\xf9~GCGLINUX FAT32 \xfa1\xc0\x8e\xd0|\xfb\x8e\xd8\xe8^\x83\xc6\x19\xbb\x07\xac\x84\xc0t\x06\xb4\x0e\xcd\x10\xeb\xf50\xe4\xcd\x16\x19\r\nNon-system dsk\r\nPress any ky to reboot\r\nURRaArrAa\x04\xce\x1c\x06U\xebX\x90BSD 4.4\x02\x10 \x02\xf0 \xff\xf4S\xcd\x01\x9d9\x02\x01\x06)\x02\x14\xf9~GCGLINUX FAT32 \xfa1\xc0\x8e\xd0|\xfb\x8e\xd8\xe8^\x83\xc6\x19\xbb\x07\xac\x84\xc0t\x06\xb4\x0e\xcd\x10\xeb\xf50\xe4\xcd\x16\x19\r\nNon-system dsk\r\nPress any ky to reboot\r\nURRaArrAa\x08\xce\x1c\x03U\xf0\xff\xff\x0f\xff\xff\xff\x0f\xff\xff\xff\x0f\xff\xff\xff\xff\xff\xff\x0f\xff\xff\xff\x0f\xff\xff\xff\x0f\xf0\xff\xff\x0f\xff\xff\xff\x0f\xff\xff\xff\x0f\xff\xff\xff\xff\xff\xff\x0f\xff\xff\xff\x0f\xff\xff\xff\x0fGCGLINUX (:d\x90JA._.Tr\x0f\x7fashes\xff\xff\xff~1 TRA"\r:\x90J\x90J:d\x90J\x04\x10\xe5RASHE~13XB\x12\r:\x90J\x90J:d\x90J\x03A.Tras\x0f%hes\xff\xff\xff\xff\xff\xff\xffTRASHE~1 \x12\r:\x90J\x90J:d\x90J\x03A.fsev\x0f\xdaentsd\xff\xff\xffFSEVEN~1 \x12\x12:\x90J\x90J:d\x90J\x05. 2\r:\x90J\x90J:d\x90J\x03.. \x10\r:\x90J\x90J:d\x90J\x05\x16\x07\x02Mac OS \x02\t2\x0e\xb0\x02\x0e\xe2\x01\x1e@ATTR;\x9a\xc9\xff\x0ex\x01\x01"
@knotech
Copy link
Author

knotech commented Apr 17, 2017

These are the .Trashes .fsevents (assorted fs metadata breadcrumbs) and that OS X writes to disks.

Zeroed the drive, formatted it, then did a hexdump of it and found this shit on my clean floor.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment