Tuesday, March 15, 2022

[SOLVED] Getting rid of the first 5 characters, than every other character after the 32nd character?

Issue

Is there a way to easily remove the first 5 characters from this hexdump (from a .pcap), remove the spaces from the hex characters, and then after the 32nd hex character, remove the decoded ascii? I've read into the cut operator, as well as using a Python script but couldn't get it working (it just seemed to create an extremely large .txt).

0000  ca fe 00 00 ba be de ad 00 00 be ef 08 00 45 00   ..............E.
0010  00 c6 9a 59 40 00 40 06 88 38 c0 a8 01 c8 ac d9   ...Y@[email protected]......
0020  a8 56 8b 18 01 bb 85 40 40 4f 4d 73 a6 1b 80 18   .V.....@@OMs....
0030  05 c1 fd 7f 00 00 01 01 08 0a df 7b 09 99 3e cb   ...........{..>.
0040  4d 9f 17 03 03 00 8d d3 6d ce 93 8c 4d ec bd 16   M.......m...M...
0050  91 21 b4 cf d5 cf 40 d6 79 5c 5d 0a 33 41 51 d3   [email protected]\].3AQ.
0060  5c 81 1b 40 f7 bc fb 26 1e c3 0a 6d 1b e5 62 d5   \..@...&...m..b.
0070  04 18 43 a1 ec 8f 7f ca 3e bf 62 2f 77 f1 e4 0e   ..C.....>.b/w...
0080  62 d0 12 0a da cc 1c 03 f3 e6 32 d6 de 65 27 aa   b.........2..e'.
0090  3f 85 35 4d 11 7f 5a 1a 2d 41 08 27 97 98 e8 04   ?.5M..Z.-A.'....
00a0  88 03 1f 66 bd 56 f2 4c c2 0e 7d 47 5f c6 5d b0   ...f.V.L..}G_.].
00b0  52 d7 16 31 27 28 d5 01 9f b0 01 3f 14 3d a7 33   R..1'(.....?.=.3
00c0  39 b2 65 6c f2 3d 76 b3 2c 47 5b 2c f6 03 4a c8   9.el.=v.,G[,..J.
00d0  37 b6 24 9a                                       7.$.

Expected (for the first line):

cafe0000babedead0000beef08004500

Here's what I tried to get rid of the first 5 characters:

tail -c +6 test2.txt > newfile.txt


Solution

Could you please try following, written and tested with shown samples in GNU awk.

awk '{val="";val=substr($0,5,50);gsub(/ +/,"",val);print val}' Input_file

Explanation: Adding detailed explanation for above.

awk '                   ##Starting awk program from here.
{
  val=""
  val=substr($0,5,50)   ##Creating val which has sub string of characters starting from 5th index to 50 more characters of current line.
  gsub(/ +/,"",val)     ##Globally substituting spaces with NULL in val here.
  print val             ##Printing val here.
}
' Input_file            ##Mentioning Input_file name here.


Answered By - RavinderSingh13
Answer Checked By - David Goodson (WPSolving Volunteer)
at