From: mikepb@lupus.dell.com (Michael P. Brininstool)
Subject: Re: Unknown filearchive
Reply-To: mikepb@lupus.dell.com
Organization: Dell UNIX Support
Date: Fri, 22 Jan 1993 20:22:46 GMT

In article <813@hineni.sbi.com>, coe@hineni.sbi.com (Chet Edelman) writes:
>>In article <1993Jan11.215236.15693@raid.dell.com> mikepb@lupus.dell.com writes:
>>>In article <C0JznI.LsF@news.cso.uiuc.edu>, lam@mrcnext.cso.uiuc.edu (Ken Lam) writes:
>>>>> I have received an unknown file archive.  I can't seem to figure out what
>>>>>program was used to create it.  the magic number says that it is ascii text.
>>>>> 
>>>>>below is the first couple of lines.
>>>>> 
>>>>>0707010001aa74000041ff0000000000000003000000042a2d5aa600000000ffffffff00000001ffffffff0003a64d0000000400000000sdk0707010001aa75000081a40000000000000003000000012a2d558b00002c80ffffffff00000001ffffffff0003ff100000000b00000000sdk/pkgmap: 1 18266
>>>>>1 d none etc 0775 root sys
>>>>>1 d none etc/init.d 0775 root sys
>>>>>1 f none etc/init.d/nuc 0775 root sys 1294 32156 706492066
>>>>>1 i pkginfo 139 10505 707614087
>>>>>1 i postinstall 1320 44140 707610280
>>>>>1 i postremove 623 52180 707613495
>>>>> 
>>>>> Any ideas?
>>>
>>>The pkginfo, postinstall, postremove stuff looks like a pkgadd from SVR4.
>>>I assume the 070701001aa74..... is an octal dump of the file.  070701 is
>>>octal at the beginning of a file looks like a cpio archive, kinda.
>>>I looks like a pkgadd stream format for a pkg called "nuc".
>>
>>The leading line is a cpio(1) header.  A datastream for pkg stuff
>>begins with "# PaCkAgE DaTaStReAm" followed by the info section.  (At
>>least around here they do.)  Hope this helps...

I just ran strings on a pkgstream and got this:

# PaCkAgE DaTaStReAm
ModemSet 1 29
# end of header
0707010000300f000081a40000000000000001000000012a410de90000014d0000004a0000000100
000000000000000000001100000000ModemSet/pkginfo
.....
[stuff deleted]

Here is with hd:

0000    23 20 50 61 43 6b 41 67  45 20 44 61 54 61 53 74   # PaCkAgE DaTaSt
0010    52 65 41 6d 0a 4d 6f 64  65 6d 53 65 74 20 31 20   ReAm.ModemSet 1
0020    32 39 0a 23 20 65 6e 64  20 6f 66 20 68 65 61 64   29.# end of head
0030    65 72 0a 00 00 00 00 00  00 00 00 00 00 00 00 00   er..............
0040    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
*
0200    30 37 30 37 30 31 30 30  30 30 33 30 30 66 30 30   0707010000300f00
0210    30 30 38 31 61 34 30 30  30 30 30 30 30 30 30 30   0081a40000000000
0220    30 30 30 30 30 31 30 30  30 30 30 30 30 31 32 61   000001000000012a
0230    34 31 30 64 65 39 30 30  30 30 30 31 34 64 30 30   410de90000014d00
0240    30 30 30 30 34 61 30 30  30 30 30 30 30 31 30 30   00004a0000000100
0250    30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30   0000000000000000
0260    30 30 30 30 31 31 30 30  30 30 30 30 30 30 4d 6f   00001100000000Mo
0270    64 65 6d 53 65 74 2f 70  6b 67 69 6e 66 6f 00 00   demSet/pkginfo..
[stuff deleted]

I agree that this guy's stuff looks like a cpio.  It also looks like what
is cpio'ed is possibly a pkgadd pkg stream.  It could be that the first
record is missing and he has a partial pkg stream.

Is this output he gave us the output from strings?  What does od -xc give?

----------------------------------------------------------------------------|
| Michael P. Brininstool   DELL UNIX PRODUCT SUPPORT  mikepb@lupus.dell.com |
|----------------------------------------------------------------------------