✅ What Is dd?
The dd command is a powerful Unix tool used to:
- Copy data at the block level
- Extract specific file segments
- Convert and clone disks
- Repair or reconstruct images
- Recover corrupted partitions or files
Because it works on raw byte streams, dd is frequently used in CTF forensics challenges to extract hidden data, fix disk images, or carve out embedded files from larger binaries.
🛠️ Basic Syntax
dd if=<input_file> of=<output_file> bs=<block_size> count=<blocks> skip=<blocks>
Where:
if=→ input fileof=→ output filebs=→ block sizecount=→ how many blocks to copyskip=→ how many blocks to skip before copying
🧰 Essential dd Commands for CTFs
1. Create a raw copy of a file or disk
dd if=image.dd of=copy.dd bs=1M
Used when you want to extract safely from a target image while preserving the original.
2. Extract a section of bytes from a file
This is the most common use in CTF challenges:
dd if=bigfile.bin of=piece.bin bs=1 skip=100 count=200
Meaning:
- Skip first 100 bytes
- Copy next 200 bytes
Useful when:
- A file is hidden inside another
- You know the exact byte offset
3. Extract everything after a given offset
dd if=image.bin of=tail.bin bs=1 skip=4096
Used when:
- A hidden file begins at a known offset
- Binwalk reveals embedded data starting at X bytes
4. Repair corrupted file headers
Sometimes a file contains a broken header.
You can replace it using dd:
dd if=good_header.bin of=broken_file.bin bs=1 count=8 conv=notrunc
This overwrites the first 8 bytes with the correct header (e.g., PNG, ZIP, JFIF, etc.).
5. Extract embedded partitions
If a disk image contains multiple partitions:
dd if=disk.img of=part1.img bs=512 skip=<start_sector> count=<num_sectors>
fdisk -l or mmls can provide sector positions.
6. Clone an entire device
dd if=/dev/sda of=disk_copy.img bs=4M
(Used more in IR than CTF but still relevant.)
🎯 How dd Is Used in CTF Challenges
Below are the most common patterns.
🔍 Common Pattern 1 — Extracting Hidden Data at Known Offsets
Challenge creators often embed files within files, for example:
- PNG inside a PDF
- ZIP inside an audio file
- Hidden flag appended to an image
binwalk might reveal:
12345 PNG image 54321 Zip archive
Then use:
dd if=mystery.bin of=hidden.png bs=1 skip=12345
🔍 Common Pattern 2 — Repairing Corrupted Headers
CTFs often provide broken files such as:
- Corrupted PNG
- Damaged ZIP
- Invalid WAV/MP3
If the header is wrong, replace it:
dd if=correct_header.bin of=brokenfile.bin bs=1 count=8 conv=notrunc
Example: Fix the PNG signature (89 50 4E 47 0D 0A 1A 0A).
🔍 Common Pattern 3 — Extracting Data Before/After a Marker
Find marker with grep, strings, or hex editor:
FLAG{...
Then extract:
dd if=file.bin of=flag.bin bs=1 skip=<offset_of_flag>
🔍 Common Pattern 4 — Carving Out a Specific Partition
Disk images (.dd, .img) often contain multiple partitions.
Use:
fdisk -l disk.img # or mmls (The Sleuth Kit)
Then extract the partition:
dd if=disk.img of=partition1.img bs=512 \ skip=<start_sector> count=<sector_count>
Useful for:
- Hidden Linux partitions
- Overwritten boot sectors
- CTFs involving file system examination
🔍 Common Pattern 5 — Splitting a File Into Chunks
Sometimes you need to isolate multiple embedded objects.
dd if=binary.bin of=part1.bin bs=1 count=4096 dd if=binary.bin of=part2.bin bs=1 skip=4096 count=4096
Useful when the challenge includes:
- Multi-layer files
- Concatenated images
- Embedded steganography payloads
🔍 Common Pattern 6 — Fixing Truncated Files
If a file is missing its footer or cutoff:
dd if=goodfile.bin of=repaired.bin conv=notrunc
or copy out the intact region:
dd if=corrupt.bin of=recovered.bin bs=1 count=<good_length>
🚀 Recommended Workflow for Using dd in CTFs
- Run file and binwalk
Identify offsets. - Inspect in hex editor (hexedit, bless, xxd)
Confirm offsets/manual markers. - Use dd to extract exact byte ranges
Avoid corrupting flags by incorrect trimming. - Reconstruct or repair as needed
Replace headers or carve new files. - Analyze extracted data
With tools like:filestringsbinwalkexiftoolzsteg
📌 Tips and Tricks
- Use
bs=1for byte-accurate extraction. - Use
bs=512orbs=4096for disk-level operations. - Use
conv=notruncwhen patching files (so the file size doesn’t change). - Always extract to a new file to avoid corrupting the original.
Leave a Reply