a bit of work on the man pages

- changed to mandoc
 - tried to be more complete and consistent in content
This commit is contained in:
pi-rho 2012-03-08 20:32:42 -06:00
parent 5d78dd7391
commit 70b5408d74
7 changed files with 495 additions and 363 deletions

View File

@ -1,77 +1,99 @@
.TH "hdng" "1" .\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.SH "NAME" .\"
hdng \(em a hex dumper for the next generation\) .\" This program is free software: you can redistribute it and/or modify
.SH "SYNOPSIS" .\" it under the terms of the GNU General Public License as published by
.PP .\" the Free Software Foundation, either version 3 of the License, or
\fBhdng\fR [ [\-oxsg] [\-w width] | [\-X] | [\-G] ] [FILE] .\" (at your option) any later version.
.SH "DESCRIPTION" .\"
.PP .\" This package is distributed in the hope that it will be useful,
The basic concept for this utility is to emulate the base .\" but WITHOUT ANY WARRANTY; without even the implied warranty of
functionality of a hex dumper as found in bsdmainutils while .\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
providing better representation of the data. A special character set .\" GNU General Public License for more details.
is used so that one might better observe patterns in the data. .\"
Additionally, the three areas of the hexdump (offsets, hexits, .\" You should have received a copy of the GNU General Public License
glyphs) can be turned off and the width of data represented in each .\" along with this program. If not, see <http://www.gnu.org/licenses/>.
line of data can be changed. .\"
.\" On Debian systems, the complete text of the GNU General
.SH "USAGE" .\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.IP "With a file specified" 10 .
\fBhdng\fR data.bin .Dd March 3, 2012
.Dt HDNG 1
.IP "As a filter" 10 .Os "network reverse engineering tools"
... | \fBhdng\fR | ... .Sh NAME
.Nm hdng
.SH "OPTIONS" .Nd a hex dumper for the next generation
.PP .
A summary of the options supported by \fBhdng\fR is included below. .Sh SYNOPSIS
.Nm hdng
.IP "\-o" 10 .Oo Fl h | Fl v Oc
The optional \fI\-o\fP flag tells hdng to turn off offsets and .Nm hdng
to not display the byte count at the end of execution .Op Fl oxsg
.IP "\-x" 10 .Op Fl w Ar width
The optional \fI\-x\fP flag tells hdng to turn off the display .Op Ar file
of hexits .Nm hdng
.IP "\-s" 10 .Op Fl X | Fl G
The optional \fI\-s\fP flag tells hdng to not abbreviate .Op Ar file
rendundant data .
.IP "\-g" 10 .Sh DESCRIPTION
The optional \fI\-g\fP flag tells hdng to turn off the display The basic concept for this utility is to emulate the base functionality of a hex
of glyphs dumper as found in bsdmainutils while providing better representation of the
.IP "\-w width" 10 data. A special character set is used so that one might better observe patterns
The optional \fI\-w\fP \fIwidth\fP flag tells in the data. Additionally, the three areas of the hexdump (offsets, hexits,
hdng the width of data to represent on each line of glyphs) can be turned off and the width of data represented in each line of data
output can be changed.
.IP "\-X" 10 .
The \fI\-X\fP flag turns on continuous .Sh USAGE
\fIhexdump\fP mode, which overrides all With a file specified
other options .D1 Nm hdng Pa data.bin
.IP "\-G" 10 .Pp
The \fI\-G\fP flag turns on continuous As a filter
\fIglyphdump\fP mode, which overrides all .D1 ... | Nm hdng | ...
other options .
.IP "FILE" 10 .Sh OPTIONS
The file to be dumped A summary of the options supported by
.Nm
.SH "REQUIRES" is included below.
.PP .Bl -tag -width -Ds
n/a .It Fl h
usage information
.SH "VERSION" .It Fl v
.PP the program's version
0.1337 .It Fl o
do not display offsets, including the total byte count
.SH "BUGS" .It Fl x
.PP do not display hexits
n/a .It Fl s
do not abbreviate redundant data
.SH "SEE ALSO" .It Fl g
.PP do not display glyphs
n/a .It Fl w Ar width
the
.SH "AUTHORS" .Em width
.PP of data to represent on each line of output
Zephyr zephyr@dirtbags.net .It Ar file
.PP the file to be dumped
pi-rho pi-rho@tyr.cx .El
.PP .
This man-page was written by pi-rho ubuntu@tyr.cx .Ss Special Modes
The following flags are mutually exclusive. When specified,
.Nm
ignores all other flags.
.Bl -tag -width Ds
.It Fl X
turns on continuous
.Em hexdump
mode, which overrides all other options
.It Fl G
turns on continuous
.Em glyphdump
mode, which overrides all other options
.El
.
.Sh SEE ALSO
.Xr unhex 1 ,
.Xr repr 1 ,
.Xr xor 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

View File

@ -1,53 +1,66 @@
.TH "p4split" "1" .\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.SH "NAME" .\"
p4split \(em split a PCAP based on CIDR .\" This program is free software: you can redistribute it and/or modify
.SH "SYNOPSIS" .\" it under the terms of the GNU General Public License as published by
.PP .\" the Free Software Foundation, either version 3 of the License, or
\fBp4split\fR [\-i INPUT] <CIDR> .\" (at your option) any later version.
.\"
.SH "DESCRIPTION" .\" This package is distributed in the hope that it will be useful,
.PP .\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt P4SPLIT 1
.Os "network reverse engineering tools"
.Sh NAME
.Nm p4split
.Nd split a PCAP based on CIDR filter
.
.Sh SYNOPSIS
.Nm p4split
.Oo Fl h | Fl v Oc
.Nm p4split
.Op Fl i Pa input.pcap
.Ao CIDR filter Ac
.
.Sh DESCRIPTION
The basic concept for this utility is to filter and split a PCAP packet capture The basic concept for this utility is to filter and split a PCAP packet capture
file into smaller files. This utility will create up to 256 smaller files. file into smaller files. This utility will create up to 256 smaller files.
.
.SH "USAGE" .Sh USAGE
.IP "As a filter" 10 As a filter
... | \fBp4split\fR 192.168.1.0/24 .D1 ... | Nm p4split 192.168.1.0/24
.Pp
.IP "Command mode" 10 Command mode
\fBp4split\fR \-i big.pcap 192.168.1.0/24 .D1 Nm p4split Fl i Pa big.pcap Ad 192.168.1.0/24
.
.SH "OPTIONS" .Sh OPTIONS
.PP A summary of the options supported by
A summary of the options supported by \fBp4split\fR is included below. .Nm
is included below.
.IP "\-i INPUT" 10 .Bl -tag -width Ds
When the \fB\-i\fR argument is specified, \fBINPUT\fR is used as input, instead .It Fl h
of stdin usage information
.It Fl v
.IP "CIDR" 10 the program's version
A network address in CIDR notation (ad.dre.ss/subnet-bits) .It Fl i Pa input.pcap
.Pa input.pcap
.SH "REQUIRES" is used as input, instead of stdin
.PP .It Ao CIDR filter Ac
n/a A filter in CIDR notation (ad.dre.ss/subnet-bits)
.El
.SH "VERSION" .
.PP .Sh SEE ALSO
0.1337 .Xr pmerge 1 ,
.Xr puniq 1
.SH "BUGS" .
.PP .Sh AUTHORS
n/a .An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx

View File

@ -1,52 +1,73 @@
.TH "pmerge" "1" .\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.SH "NAME" .\"
pmerge \(em merge multiple PCAP files in timeline order .\" This program is free software: you can redistribute it and/or modify
.SH "SYNOPSIS" .\" it under the terms of the GNU General Public License as published by
.PP .\" the Free Software Foundation, either version 3 of the License, or
\fBpmerge\fR [\-o OUTPUT] <FILE> [FILE]* .\" (at your option) any later version.
.SH "DESCRIPTION" .\"
.PP .\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt PMERGE 1
.Os "network reverse engineering tools"
.Sh NAME
.Nm pmerge
.Nd merge multiple PCAP files in timeline order
.
.Sh SYNOPSIS
.Nm pmerge
.Op Fl h | Fl v
.Nm pmerge
.Op Fl o Ar Pa output.pcap
.Pa input.pcap
.Op Ar
.
.Sh DESCRIPTION
The basic concept for this utility is to merge multiple PCAP files while The basic concept for this utility is to merge multiple PCAP files while
maintaining timeline order. maintaining timeline order.
.
.SH "USAGE" .Sh USAGE
.IP "As a filter" 10 As a filter
\fBpmerge\fR one.pcap two.pcap > merged.pcap .D1 Nm pmerge Pa one.pcap Pa two.pcap Li > Pa merged.pcap
.Pp
.IP "In simple command form" 10 In simple command form
\fBpmerge\fR \-o merged.pcap one.pcap two.pcap .D1 Nm pmerge Fl o Pa merged.pcap Pa one.pcap Pa two.pcap
.
.SH "OPTIONS" .Sh OPTIONS
.PP A summary of the options supported by
A summary of the options supported by \fBpmerge\fR is included below. .Nm pmerge
is included below.
.IP "\-o OUTPUT" 10 .
The \fB\-o\fR command flag sets the output filename. If this option flag is not .Bl -tag -width Ds
specified, stdout is used to output the merged PCAP. .It Fl h
usage information
.IP "FILE" 10 .It Fl v
the program's version
.It Fl o Ar output.pcap
sets the output filename to
.Pa output.pcap .
If this option flag is not specified,
.Ev stdout
is used to output the merged PCAP
.It Pa input.pcap
At least one input file argument is required. At least one input file argument is required.
.It Ar
.SH "REQUIRES" additional input files may be specified
.PP .El
n/a .
.Sh SEE ALSO
.SH "VERSION" .Xr p4split 1 ,
.PP .Xr puniq 1
0.1337 .
.Sh AUTHORS
.SH "BUGS" .An Zephyr Aq Ad zephyr@dirtbags.net ,
.PP .An pi-rho Aq Ad pi-rho@tyr.cx
n/a
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx

View File

@ -1,52 +1,72 @@
.TH "puniq" "1" .\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.SH "NAME" .\"
puniq \(em filter one to many PCAP files for unique frames .\" This program is free software: you can redistribute it and/or modify
.SH "SYNOPSIS" .\" it under the terms of the GNU General Public License as published by
.PP .\" the Free Software Foundation, either version 3 of the License, or
\fBpuniq\fR [\-o OUTPUT] <FILE> [FILE]* .\" (at your option) any later version.
.SH "DESCRIPTION" .\"
.PP .\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt PUNIQ 1
.Os "network reverse engineering tools"
.Sh NAME
.Nm puniq
.Nd filter one to many PCAP files for unique frames
.
.Sh SYNOPSIS
.Nm puniq
.Op Fl h | Fl v
.Nm puniq
.Op Fl o Ar output.pcap
.Pa input.pcap
.Op Ar
.
.Sh DESCRIPTION
The basic concept for this utility is to filter one to many PCAP files for The basic concept for this utility is to filter one to many PCAP files for
unique frames unique frames
.
.SH "USAGE" .Sh USAGE
.IP "As a filter" 10 As a filter
\fBpuniq\fR one.pcap two.pcap > unique.pcap .D1 Nm puniq Pa one.pcap Pa two.pcap Li > Pa unique.pcap
.Pp
.IP "In simple command form" 10 In simple command form
\fBpuniq\fR \-o unique.pcap one.pcap two.pcap .D1 Nm puniq Fl o Pa unique.pcap Pa one.pcap Pa two.pcap
.
.SH "OPTIONS" .Sh OPTIONS
.PP A summary of the options supported by
A summary of the options supported by \fBpuniq\fR is included below. .Nm puniq
is included below.
.IP "\-o OUTPUT" 10 .
The \fB\-o\fR command flag sets the output filename. If this option flag is not .Bl -tag -width Ds
specified, stdout is used to output the merged PCAP. .It Fl h
usage information
.IP "FILE" 10 .It Fl v
At least one input file argument is required. the program's version
.It Fl o Ar output.pcap
.SH "REQUIRES" sets the output filename to
.PP .Pa output.pcap .
n/a If this option flag is not specified,
.Dv stdout
.SH "VERSION" is used to output the merged PCAP
.PP .It Pa input.pcap
0.1337 At least one input file argument is required
.It Ar
.SH "BUGS" additional input files may be specified
.PP .
n/a .Sh SEE ALSO
.Xr p4split 1 ,
.SH "SEE ALSO" .Xr pmerge 1
.PP .
n/a .Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.SH "AUTHORS" .An pi-rho Aq Ad pi-rho@tyr.cx
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx

View File

@ -1,44 +1,63 @@
.TH "repr" "1" .\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.SH "NAME" .\"
repr \(em escape unprintable characters\) .\" This program is free software: you can redistribute it and/or modify
.SH "SYNOPSIS" .\" it under the terms of the GNU General Public License as published by
.PP .\" the Free Software Foundation, either version 3 of the License, or
\fBrepr\fR [FILE] .\" (at your option) any later version.
.SH "DESCRIPTION" .\"
.PP .\" This package is distributed in the hope that it will be useful,
The basic concept for this utility is to emulate python's repr() function .\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.SH "USAGE" .\" GNU General Public License for more details.
.IP "With a file specified" 10 .\"
\fBrepr\fR data.bin .\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.IP "As a filter" 10 .\"
... | \fBrepr\fR | ... .\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.SH "OPTIONS" .
.PP .Dd March 3, 2012
n/a .Dt REPR 1
.Os "network reverse engineering tools"
.SH "REQUIRES" .
.PP .Sh NAME
n/a .Nm repr
.Nd escape unprintable characters
.SH "VERSION" .
.PP .Sh SYNOPSIS
0.1337 .Nm repr
.Op Fl h | Fl v
.SH "BUGS" .Nm repr
.PP .Op Ar
n/a .
.Sh DESCRIPTION
.SH "SEE ALSO" The basic concept for this utility is to emulate python's repr() function. Input
.PP bytes are escaped using Python's byte notation if they do not fall within the
n/a printable range.
.
.SH "AUTHORS" .Sh USAGE
.PP With a file specified
Zephyr zephyr@dirtbags.net .D1 Nm repr Pa data.bin
.PP .Pp
pi-rho pi-rho@tyr.cx As a filter
.PP .D1 ... | Nm repr | ...
This man-page was written by pi-rho ubuntu@tyr.cx .
.Sh OPTIONS
A summary of the options supported by
.Nm repr
is included below.
.
.Bl -tag -width Ds
.It Fl h
usage information
.It Fl v
the program's version
.El
.
.Sh SEE ALSO
.Xr hdng 1 ,
.Xr xor 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

View File

@ -1,45 +1,63 @@
.TH "unhex" "1" .\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.SH "NAME" .\"
unhex \(em translate hexits to their binary equivalent\) .\" This program is free software: you can redistribute it and/or modify
.SH "SYNOPSIS" .\" it under the terms of the GNU General Public License as published by
.PP .\" the Free Software Foundation, either version 3 of the License, or
\fBunhex\fR [FILE] .\" (at your option) any later version.
.SH "DESCRIPTION" .\"
.PP .\" This package is distributed in the hope that it will be useful,
The basic concept for this utility is to translate hexits (00-ff) to their binary .\" but WITHOUT ANY WARRANTY; without even the implied warranty of
equivalent. .\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.SH "USAGE" .\"
.IP "With a file specified" 10 .\" You should have received a copy of the GNU General Public License
\fBunhex\fR data.bin .\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.IP "As a filter" 10 .\" On Debian systems, the complete text of the GNU General
... | \fBunhex\fR | ... .\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.SH "OPTIONS" .Dd March 3, 2012
.PP .Dt UNHEX 1
n/a .Os "network reverse engineering tools"
.
.SH "REQUIRES" .Sh NAME
.PP .Nm unhex
n/a .Nd translate hexits to their binary equivalent
.
.SH "VERSION" .Sh SYNOPSIS
.PP .Nm unhex
0.1337 .Op Fl h | Fl v
.Nm unhex
.SH "BUGS" .Op Ar
.PP .
n/a .Sh DESCRIPTION
The basic concept for this utility is to translate hexits (00-ff) to their
.SH "SEE ALSO" binary equivalent. If the text input includes spaces and non-hexadecimal
.PP characters, these characters are ignored. If non-hexadecimal characters appear
n/a between hexit pairs, an error is produced.
.
.SH "AUTHORS" .Sh USAGE
.PP With a file specified
Zephyr zephyr@dirtbags.net .D1 Nm unhex Pa data.bin
.PP .Pp
pi-rho pi-rho@tyr.cx As a filter
.PP .D1 ... | Nm unhex | ...
This man-page was written by pi-rho ubuntu@tyr.cx .
.Sh OPTIONS
A summary of the options supported by
.Nm unhex
is included below.
.
.Bl -tag -width Ds
.It Fl h
usage information
.It Fl v
the program's version
.El
.Sh SEE ALSO
.Xr hdng 1 ,
.Xr xor 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

113
man/xor.1
View File

@ -1,50 +1,69 @@
.TH "xor" "1" .\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.SH "NAME" .\"
xor \(em apply mask bytes to a stream using XOR .\" This program is free software: you can redistribute it and/or modify
.SH "SYNOPSIS" .\" it under the terms of the GNU General Public License as published by
.PP .\" the Free Software Foundation, either version 3 of the License, or
\fBxor\fR [\-x] <MASK>* .\" (at your option) any later version.
.SH "DESCRIPTION" .\"
.PP .\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt XOR 1
.Os "network reverse engineering tools"
.
.Sh NAME
.Nm xor
.Nd apply mask bytes to a stream using XOR
.
.Sh SYNOPSIS
.Nm xor
.Op Fl h | Fl v
.Nm xor
.Op Fl x
.Ar MASKBYTE
.Op Ar MASKBYTES ...
.
.Sh DESCRIPTION
The basic concept for this utility is to apply a set of mask bytes, repeatedly, The basic concept for this utility is to apply a set of mask bytes, repeatedly,
to a stream of input. The application of the mask bytes is accomplished using to a stream of input. The application of the mask bytes is accomplished using
the bitwise XOR operation. the bitwise XOR operation.
.
.SH "USAGE" .Sh USAGE
.IP "As a filter" 10 As a filter with the hexadecimal mask bytes
... | \fBxor\fR \-x 20 2f | ... .Bq 20 , 2f
applied to the input stream (i.e.
.SH "OPTIONS" .Bq 20 , 2f , 20 , 2f , ... Ns )
.PP .D1 ... | Nm xor Fl x Ar 20 Ar 2f | Li ...
A summary of the options supported by \fBxor\fR is included below. .
.Sh OPTIONS
.IP "\-x" 10 A summary of the options supported by
The optional \fI\-x\fP flag tells xor that mask bytes are specified in .Nm xor
hexadecimal notation is included below.
.
.IP "MASK" 10 .Bl -tag -width Ds
This represents a list of mask bytes to apply to the input stream. Bytes should .It Fl h
be listed in decimal, unless the optional \fI\-x\fR flag is usage information
given. .It Fl v
the program's version
.SH "REQUIRES" .It Fl x
.PP explicity interpret mask bytes as hexadecimal digits
n/a .It Ar MASKBYTE Op Ar MASKBYTES ...
a list of mask bytes to apply to the input stream
.SH "VERSION" .El
.PP .
0.1337 .Sh SEE ALSO
.Xr hdng 1 ,
.SH "BUGS" .Xr unhex 1
.PP .
n/a .Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.SH "SEE ALSO" .An pi-rho Aq Ad pi-rho@tyr.cx
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
This man-page was written by pi-rho ubuntu@tyr.cx