How about getting your bash syntax right, first? What you post can't possibly run...
--- Post updated at 18:33 ---
OK, trying to guess what you're after, and making some assumptions, how about
We assume a *number* file is always present, all files have a .txt suffix, and the order of entries being sorted by item is acceptable...
I]hi all
i am in confusion since last 2 days :(
i posted thraed yesterday and some friends did help but still i couldnt get solution to my problem
let it be very clear
i have a long log file of alkatel switch and i have to seperate the minor major and critical alarms shown by ! , !! and !!!... (6 Replies)
If $1 in file1 matches $2 in file2. Then the value in $2 of file2 is updated to $1"."$2 of file2. The awk seems to only match the two files but not update. Thank you :).
awk
awk 'NR==FNR{A ; next} $1 in A { $2 = a }1' file1 file2
file1
name version
NM_000593 5
NM_001257406... (3 Replies)
I am trying to match $1 in file1 with $2 in file2. If a match is found then $3 and $4 of file2 are copied to file1. Both files are tab-delimeted and I am getting a syntax error and would also like to update file1 in-place without creating a new file, but am not sure how. Thank you :).
file1
... (19 Replies)
In the bash below the unique headers of each vcf.gz are stored in a text file with the same name. That is if 16-0000-file.vcf.gz was used the header text file would be 16-0000-file_header.txt.
There can be multiple vcf.gz in a directory, usually 3, that I need to fix the header in each file before... (6 Replies)
I am trying to create a cronjob that will run on startup that will look at a list.txt file to see if there is a later version of a database using database.txt as the source. The matching lines are written to output.
$1 in database.txt will be in list.txt as a partial match. $2 of database.txt... (2 Replies)
In the perl below I am trying to set/update the value of $14 (last field) in file2, using the matching NM_ in $12
or $9 in file2 with the NM_ in $2 of file1.
The lengths of $9 and $12 can be variable but what is consistent is the start pattern will always be NM_ and the end pattern is always
;... (4 Replies)
In the awk, thanks you @RavinderSingh13, for the help in below, hopefully it is close as I am trying to update the value in $12 of the tab-delimeted file2 with the matching value in $1 of the space delimeted file1. I have added comments for each line as well. Thank you :).
awk
awk '$12 ==... (10 Replies)
In the bash below which does execute I am trying to extract the contents of ${id} is 1234, as ${id} stores the variable that changes each time.
After the path is removed the contents of ${id} are stored in pref, so they can be used in the output. Currently I am not able to extract the 1234 in the... (6 Replies)
In the awk below I am trying to use the file1 as a match to file2. In file2 the contents of $5,&6,and $7 (always tab-delimited) and are copied to the output under the header Quality metrics. The below executes but the output is empty. I have added comments to help and show my thinking. Thank you... (0 Replies)
Trying to use awk to store the value of $5 in file1 in array x. That array x is then used to search $4 of file1 to find aa match (I use x to skip the header in file1). Since $4 can have multiple strings in it seperated by a , (comma), I split them and iterate througn each split looking for a match.... (2 Replies)
Discussion started by: cmccabe
2 Replies
LEARN ABOUT DEBIAN
hfind
HFIND(1) General Commands Manual HFIND(1)NAME
hfind - Lookup a hash value in a hash database
SYNOPSIS
hfind [-i db_type ] [-f lookup_file ] [-eq] db_file [hashes]
DESCRIPTION
hfind looks up hash values in a database using a binary search algorithm. This allows one to easily create a hash database and identify if
a file is known or not. It works with the NIST National Software Reference Library (NSRL) and the output of 'md5sum'.
Before the database can be used by 'hfind', an index file must be created with the '-i' option.
This tool is needed for efficiency. Most text-based databases do not have fixed length entries and are sometimes not sorted. The hfind
tool will create an index file that is sorted and has fixed-length entries. This allows for fast lookups using a binary search algorithm
instead of a linear search such as 'grep'.
ARGUMENTS -i db_type
Create an index file for the database. This step must be done before a lookup can be performed. The 'db_type' argument specifies
the database type (i.e. nsrl-md5 or md5sum). See section below.
-f lookup_file
Specify the location of a file that contains one hash value per line. These hashes will be looked up in the database.
-e Extended mode. Additional information besides just the name is printed. (Does not apply for all hash database types).
-q Quick mode. Instead of displaying the corresponding information with the hash, just display 0 if the hash was not found and 1 if it
was. If this flag is used, then only one hash can be given at a time.
-V Display version
db_file
The location of the hash database file.
[hashes]
The hashes to lookup. If they are not supplied on the command line, STDIN is used. If index files exist for both SHA-1 and MD5
hashes, then both types of hashes can be given at runtime.
INDEX FILE
hfind uses an index file to perform a binary search for a hash value. This is much faster than using 'grep', which will do a linear search.
Before a hash database is used, a corresponding index file must be created. This is done with the '-i' option to hfind.
The resulting index file will be named based on the database file name. The name will have the original name following by the hash type
(sha1 or md5) followed by '.idx'. For example, creating an MD5 hash index of the NIST NSRL results in 'NSRLFile.txt-md5.idx' and the SHA-1
index results in 'NSRLFile.txt-sha1.idx'.
The file has two columns. Each entry is sorted by the first column, which is the hash value. The second column has the byte offset of the
corresponding entry in the original file. So, when a hash is found in the index, the offset is recorded and then 'hfind' seeks to the
entry in the original database.
The following input types are valid. For NSRL, 'nsrl-md5' and 'nsrl-sha1' can be used. The difference is which hash value the index is
sorted by. The 'md5sum' value can also be used to sort and index "home made" databases. 'hfind' can take data in both common formats:
MD5 (test.txt) = 76b1f4de1522c20b67acc132937cf82e
and
76b1f4de1522c20b67acc132937cf82e test.txt
EXAMPLES
To create an MD5 index file for NIST NSRL:
# hfind -i nsrl-md5 /usr/local/hash/nsrl/NSRLFile.txt
To lookup a value in the NSRL:
# hfind /usr/local/hash/nsrl/NSRLFile.txt 76b1f4de1522c20b67acc132937cf82e
76b1f4de1522c20b67acc132937cf82e Hash Not Found
You can even do both SHA-1 and MD5 if you want:
# hfind -i nsrl-sha1 /usr/local/hash/nsrl/NSRLFile.txt
# hfind /usr/local/hash/nsrl/NSRLFile.txt
76b1f4de1522c20b67acc132937cf82e
80001A80B3F1B80076B297CEE8805AAA04E1B5BA
76b1f4de1522c20b67acc132937cf82e Hash Not Found
80001A80B3F1B80076B297CEE8805AAA04E1B5BA thrdcore.cpp
To make a database of critical binaries of a trusted system, use 'md5sum':
# md5sum /bin/* /sbin/* /usr/bin/* /usr/bin/* /usr/local/bin/* /usr/local/sbin/* > system.md5
# hfind -i md5sum system.md5
To look entries up, the following will work:
# hfind system.md5 76b1f4de1522c20b67acc132937cf82e
76b1f4de1522c20b67acc132937cf82e Hash Not Found
or
# md5sum -q /bin/* | hfind system.md5
928682269cd3edb1acdf9a7f7e606ff2 /bin/bash
<...>
or
# md5sum -q /bin/* > bin.md5
# hfind -f bin.md5 system.md5
928682269cd3edb1acdf9a7f7e606ff2 /bin/bash
<...>
SEE ALSO sorter(1)
The NIST National Software Reference Library (NSRL) can be found at www.nsrl.nist.gov.
LICENSE
Distributed under the Common Public License, found in the cpl1.0.txt file in the The Sleuth Kit licenses directory.
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
HFIND(1)