Re: [luv-beginners] malware or not

Thanks for your very helpful answer Trent.Yes, finalrd is a shell script as you suggested which is why objdump didn't disassemble it.I thought that hexdump or objdump would have directly shown that finalrd is a shell script.

Peter Wolf via luv-beginners wrote:
Thanks for your very helpful answer, Trent. Yes, finalrd is a shell script as you suggested which is why objdump didn't disassemble it. I thought that hexdump or objdump would have directly shown that finalrd is a shell script.
I guess the lesson here is to know your dumpers a bit better. :-) bash5$ printf '#!/bin/sh\nhello world\n' >test.sh bash5$ cat test.sh #!/bin/sh hello world bash5$ file test.sh test.sh: POSIX shell script, ASCII text executable bash5$ hexdump test.sh 0000000 2123 622f 6e69 732f 0a68 6568 6c6c 206f 0000010 6f77 6c72 0a64 0000016 bash5$ hd test.sh 00000000 23 21 2f 62 69 6e 2f 73 68 0a 68 65 6c 6c 6f 20 |#!/bin/sh.hello | 00000010 77 6f 72 6c 64 0a |world.| 00000016 bash5$ od test.sh 0000000 020443 061057 067151 071457 005150 062550 066154 020157 0000020 067567 066162 005144 0000026
participants (2)
-
Peter Wolf
-
Trent W. Buck