2

For solving some problems in steganography, I need to look for end of images in hex

I am using 

xxd image.jpeg|grep ffd9

it does return the line having ffd9 when it is in C and D columns

but the same does not return anything when it is in 9 and A columns

Pro_Noob
  • 53
  • 7

1 Answers1

2

With GNU grep this will give you the byte-offsets of the EOI markers:

LC_ALL=C grep -oabUP "\xFF\xD9" image.jpeg

For reference:

  • bytes 0xFF, 0xD8 indicate start of image (SOI)
  • bytes 0xFF, 0xD9 indicate end of image (EOI)
Steve
  • 51,466
  • 13
  • 89
  • 103
  • The accepted answer is good, but running GNU grep with `-a` may cause the terminal to choke on the binary output when it isn't displayable since it isn't valid UTF-8. This may cause garbled output that is not only unreadable, it may overwrite displayed text which leads to potential misinterpretation of the results. BTW. there are other tools, such as this new grep utility [ugrep](https://github.com/Genivia/ugrep) I started to use recently, to search binary files to output hexdumps for binary matches. – Dr. Alex RE Nov 22 '19 at 18:18