Groups > linux.debian.user > #171090 > unrolled thread

iso verification: results - successful but still bewildered

Started by	Andrew F Comly 康大成 <andrew.comly@protonmail.com>
First post	2016-08-15 07:20 +0200
Last post	2016-08-15 10:40 +0200
Articles	2 — 2 participants

Back to article view | Back to linux.debian.user

  iso verification: results - successful but still bewildered Andrew F Comly   康大成 <andrew.comly@protonmail.com> - 2016-08-15 07:20 +0200
    Re: iso verification: results - successful but still bewildered "Thomas Schmitt" <scdbackup@gmx.net> - 2016-08-15 10:40 +0200

#171090 — iso verification: results - successful but still bewildered

From	Andrew F Comly 康大成 <andrew.comly@protonmail.com>
Date	2016-08-15 07:20 +0200
Subject	iso verification: results - successful but still bewildered
Message-ID	<s6itz-1kI-11@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

scdbackup@gmx.net, debian-user@lists.debian.org

Thomas,
Thank you for your previous assistance concerning the hacked iso issue. Below is my progress. The only remaining issues are found in Retort4-5 below:

<Quote1>
Why this overwriting of partition 1 by zeros ?
The partition table will be overwritten by the ISO anyways.

Retort1-->Thanks for this info.

--------------------------------------------
<Quote2>
dd if=/media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-lxde-CD-1.iso of=/dev/sdb bs=1M
...
(For me it runs substantially faster if i add option bs=1M.)

Retort2-->I ran dd again:
[code]
$ dd if=/media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-lxde-CD-1.iso of=/dev/sdb
dd: failed to open ‘/dev/sdb’: Permission denied
$ ll /dev/sdb
brw-rw----. 1 root disk 8, 16 8月 14 19:45 /dev/sdb
$ sudo chown a:adm /dev/sdb
$ ll /dev/sdb
brw-rw----. 1 a adm 8, 16 8月 14 19:45 /dev/sdb
$ ll /dev/sdb
brw-rw----. 1 a adm 8, 16 8月 14 19:45 /dev/sdb
$ dd if=/media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-lxde-CD-1.iso of=/dev/sdb
$ dd if=/media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-lxde-CD-1.iso of=/dev/sdb bs=1M
613+0 records in
613+0 records out
642777088 bytes (643 MB) copied, 105.551 s, 6.1 MB/s
[/code]
--------------------------------------------
<Quote3>
Did the command last long enough to be credible ?
Did it report
1255424+0 records in
1255424+0 records out

Retort3--> Again, I burnt the iso to disk again (above and below):
[code]
$ dd if=/media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-lxde-CD-1.iso of=/dev/sdb bs=1M
613+0 records in
613+0 records out
642777088 bytes (643 MB) copied, 105.551 s, 6.1 MB/s
[/code]

--------------------------------------------

<Quote4>
When you write:
$ dd if=debian-8.4.0-amd64-netinst.iso bs=1 skip=32768 count=6 | od -c
...
0000000 001 C D 0 0 1

Your file yielded two blanks on this shell command

dd if="/dev/sdb" bs=2048 skip=16 count=1 |
dd bs=1 count=6 | od -x | head -1 | \
awk '{print $2 " " $3 " " $4}'

Wheras an ISO is supposed to yield (on little-endian machine):

4301 3044 3130

Retort4-->
Do you mean that you want me to try out these commands? Or is the program not usable on an average lubuntu 14.04 Samsung netbook like mine? Is there anything more I can do?

--------------------------------------------

<Quote5>
As we learn from the copy-to-stick command, we need to curb to 1255424
blocks of dd''s default size (512 bytes per block). My USB stick is at
/dev/sdc:

$ dd if=/dev/sdc count=1255424 | sha256sum

Retort5--> May I assume that the number "1255424" is the records in/out integer? The first results below I used a count matching the burn of the iso to sdb:
[code]
$ dd if=/dev/sdb count=613 | sha256sum
613+0 records in
613+0 records out
313856 bytes (314 kB) copied, 0.0509401 s, 6.2 MB/s
943ad23096494bdff9a29f99368430285f8ecbe57da49db3d1fcf4be0800643d -
[/code]
The second results below I used a count matching the burn of the iso to sdb:
[code]
$ dd if=/dev/sdb count=1255424 | sha256sum
1255424+0 records in
1255424+0 records out
fd7729e3bdfcb2b1b8793f5a19096fb2eee3cf709c39112ed2da7e7a2d7f6886 -
642777088 bytes (643 MB) copied, 31.813 s, 20.2 MB/s
$ sha256sum /media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-lxde-CD-1.iso
fd7729e3bdfcb2b1b8793f5a19096fb2eee3cf709c39112ed2da7e7a2d7f6886
[/code]

Quite incredible, with the 'magic' number of "1255424" and using sha256sum the "/dev/sdb" and the original iso MATCH!!! But not the above command using the "records in/out integer" of 613(M), which is coincidentally the size of the downloaded iso on the local disk. Where does the number 1255424 come from? I notice that 613 M = 613 000 000 and if you break this down into 512 K than 613M / 512K = 1197265.6 which is near the magic number, is this not important? At this point I still didn't know where the 'magic number' came from. At this time I thought that sha256sum wasn't my target checksum, so I checked both /dev/sdb and the original iso with sha512sum:
[code]
$ dd if=/dev/sdb count=1255424 | sha512sum && wait && sha512sum /media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-lxde-CD-1.iso
1255424+0 records in
1255424+0 records out
642777088 bytes (643 MB) copied, 124.684 s, 5.2 MB/s
3365649694bf623d63f37853582d3fe0f7aa774821e2533d2dc79f5d763df1751e20da98da013ccc9bd3257159362434462bd7363caff3a590e75701b81e751c -
3365649694bf623d63f37853582d3fe0f7aa774821e2533d2dc79f5d763df1751e20da98da013ccc9bd3257159362434462bd7363caff3a590e75701b81e751c /media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-lxde-CD-1.iso
[/code]
It looks like the sha512sum of the /dev/sdb and the original iso MATCH ALSO!!!

But may I understand the 'magic number' better?

Sincerely,
Andrew

P.S. - Is there any forum (like linuxquestions.org) that I could post this on? I am new to debian and doubt the email thing is as quick as the email mailing list.

-------- Original Message --------
Subject: Re: iso hacked suspicious: answers
Local Time: August 10, 2016 5:23 PM
UTC Time: August 10, 2016 5:23 PM
From: scdbackup@gmx.net
To: debian-user@lists.debian.org

Hi,

Andrew F Comly wrote:
> E) Burn iso to media
> dd if=/dev/zero of=/dev/sdb1 bs=1M;
> wait;

Why this overwriting of partition 1 by zeros ?
The partition table will be overwritten by the ISO anyways.

(And on what asynchronous processes are you waiting to end ?)

> ddif=/media/LG/AC/bckup/Install/2_Bootable-OS/Debian/i386/debian-8.5.0-i386-l
xde-CD-1.iso of=/dev/sdb

Blanks matter. :))

Assumed that you did put a blank between "dd" and "/media", the command
would be ok for copying the ISO onto a USB stick at /dev/sdb.
(For me it runs substantially faster if i add option bs=1M.)

Did the command last long enough to be credible ?
Did it report
1255424+0 records in
1255424+0 records out
?

> sudo sha256sum /dev/sdb

As we learn from the copy-to-stick command, we need to curb to 1255424
blocks of dd's default size (512 bytes per block). My USB stick is at
/dev/sdc:

$ dd if=/dev/sdc count=1255424 | sha256sum
...
fd7729e3bdfcb2b1b8793f5a19096fb2eee3cf709c39112ed2da7e7a2d7f6886 -

$ fgrep fd7729e3bdfcb2b1b8793f5a19096fb2eee3cf709c39112ed2da7e7a2d7f6886 SHA256SUMS
fd7729e3bdfcb2b1b8793f5a19096fb2eee3cf709c39112ed2da7e7a2d7f6886 debian-8.5.0-i386-lxde-CD-1.iso

Testing with ./check_debian_iso (which counts blocks of 2048 bytes each):

$ ./check_debian_iso SHA512SUMS debian-8.5.0-i386-lxde-CD-1.iso /dev/sdc
Piping 313856 blocks of '/dev/sdc' through 'sha256sum'
to verify checksum list item 'debian-8.5.0-i386-lxde-CD-1.iso'.
313856+0 records in
313856+0 records out
642777088 bytes (643 MB) copied, 31.7854 s, 20.2 MB/s
Ok: '/dev/sdc' matches 'debian-8.5.0-i386-lxde-CD-1.iso' in 'SHA256SUMS'

Have a nice day :)

Thomas

[toc] | [next] | [standalone]

#171094

From	"Thomas Schmitt" <scdbackup@gmx.net>
Date	2016-08-15 10:40 +0200
Message-ID	<s6lB7-3do-5@gated-at.bofh.it>
In reply to	#171090

Hi,

i wrote:
> > Your file yielded two blanks on this shell command
> > dd if="/dev/sdb" bs=2048 skip=16 count=1 |
> > dd bs=1 count=6 | od -x | head -1 | \
> > awk '{print $2 " " $3 " " $4}'

Andrew F Comly wrote:
> Do you mean that you want me to try out these commands?

Not necessarily. On the first hand it was a technical diagnosis.
My theory is that you did not have the permissions to read the device.

(The script ./check_debian_iso should distinguish between unknown data
 and no data and rather report something like
   "Unable to read data from byte address 32768".
 But probably it needs a new home first, because George Danchev is
 too busy with other things to upload new versions.)

> Or is the program
> not usable on an average lubuntu 14.04 Samsung netbook like mine?

Besides the confusing way to say "no data", the script should be well
usable on any GNU/Linux, Solaris, and with some info about the local
checksum programs also on the BSD Unixes.

> May I assume that the number "1255424" is the records in/out integer?

Yes. Because the block size of the ISO is 2048 bytes and the number
tells blocks of size 512, this number is supposed to be exact.
With dd bs=1M, you had the risk to get a non integer count instead of 613.
But thanks to H. Peter Anvin's isohybrid prescriptions, the small
sized i386 bootable ISOs are size aligned to full MB.

So this command would have cut out the exact amount of data,
if you had told it the same block size as with your copying command.
You did:

> $ dd if=/dev/sdb count=613 | sha256sum

It should have been:

  dd if=/dev/sdb count=613 bs=1M | sha256sum

You meanwhile ran one with the correct combination of default block
size and block count:

> $ dd if=/dev/sdb count=1255424 | sha256sum
> ...
> fd7729e3bdfcb2b1b8793f5a19096fb2eee3cf709c39112ed2da7e7a2d7f6886  -

The result looks very good. File SHA256SUMS has

  fd7729e3bdfcb2b1b8793f5a19096fb2eee3cf709c39112ed2da7e7a2d7f6886  debian-8.5.0-i386-lxde-CD-1.iso

Your /dev/sdc in its first 613 MB bears the same bytes as the lxde ISO.

(Actually there are lots of files of the same size which would yield the
 same result. But they hide among a superzillion other possible file
 contents of a 613 MB file. So we are certain and can hardly be wrong.)

> Quite incredible, with the 'magic' number of "1255424" and using sha256sum
> the "/dev/sdb" and the original iso MATCH!!!

It's all about cutting out the exact number of bytes.

> Where does the number 1255424 come from?

"dd bs=1M count=613" cuts the same number as "dd count=1255424",
because 1M = 2048 blocks of 512 bytes, and 613 multiplied by 2048 yields
1255424.

The secret ingredient here is the dd default block size bs=512.
One has to deduce it from these statements in man dd:

       bs=BYTES
              read and write up to BYTES bytes at a time
       ...
       ibs=BYTES
              read up to BYTES bytes at a time (default: 512)
       ...
       obs=BYTES
              write BYTES bytes at a time (default: 512)

Further one has to take into account that in dd "1M" is not 1 million
but rather 1 MiB (programmer's megabyte):

    N and BYTES may be followed by the following multiplicative suffixes:
    ... M =1024*1024 ...

As said, we were lucky that the image size is divisible by 1M without
remainder. Else we'd not get such a nice integer computation.

> It looks like the sha512sum of the /dev/sdb and the original iso MATCH ALSO!!!

Now that you are on the right track, success becomes normal.

> P.S. -  Is there any forum (like linuxquestions.org) that I could post this
> on?

There is http://forums.debian.net/ .
If you say "xorriso", google will probably lure me in within a day.

Have a nice day :)

Thomas

[toc] | [prev] | [standalone]

csiph-web

iso verification: results - successful but still bewildered

Contents

#171090 — iso verification: results - successful but still bewildered

#171094