a bit of work on the man pages

- changed to mandoc
 - tried to be more complete and consistent in content
This commit is contained in:
pi-rho 2012-03-08 20:32:42 -06:00
parent 5d78dd7391
commit 70b5408d74
7 changed files with 495 additions and 363 deletions

View File

@ -1,77 +1,99 @@
.TH "hdng" "1"
.SH "NAME"
hdng \(em a hex dumper for the next generation\)
.SH "SYNOPSIS"
.PP
\fBhdng\fR [ [\-oxsg] [\-w width] | [\-X] | [\-G] ] [FILE]
.SH "DESCRIPTION"
.PP
The basic concept for this utility is to emulate the base
functionality of a hex dumper as found in bsdmainutils while
providing better representation of the data. A special character set
is used so that one might better observe patterns in the data.
Additionally, the three areas of the hexdump (offsets, hexits,
glyphs) can be turned off and the width of data represented in each
line of data can be changed.
.SH "USAGE"
.IP "With a file specified" 10
\fBhdng\fR data.bin
.IP "As a filter" 10
... | \fBhdng\fR | ...
.SH "OPTIONS"
.PP
A summary of the options supported by \fBhdng\fR is included below.
.IP "\-o" 10
The optional \fI\-o\fP flag tells hdng to turn off offsets and
to not display the byte count at the end of execution
.IP "\-x" 10
The optional \fI\-x\fP flag tells hdng to turn off the display
of hexits
.IP "\-s" 10
The optional \fI\-s\fP flag tells hdng to not abbreviate
rendundant data
.IP "\-g" 10
The optional \fI\-g\fP flag tells hdng to turn off the display
of glyphs
.IP "\-w width" 10
The optional \fI\-w\fP \fIwidth\fP flag tells
hdng the width of data to represent on each line of
output
.IP "\-X" 10
The \fI\-X\fP flag turns on continuous
\fIhexdump\fP mode, which overrides all
other options
.IP "\-G" 10
The \fI\-G\fP flag turns on continuous
\fIglyphdump\fP mode, which overrides all
other options
.IP "FILE" 10
The file to be dumped
.SH "REQUIRES"
.PP
n/a
.SH "VERSION"
.PP
0.1337
.SH "BUGS"
.PP
n/a
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx
.\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.\"
.\" This program is free software: you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt HDNG 1
.Os "network reverse engineering tools"
.Sh NAME
.Nm hdng
.Nd a hex dumper for the next generation
.
.Sh SYNOPSIS
.Nm hdng
.Oo Fl h | Fl v Oc
.Nm hdng
.Op Fl oxsg
.Op Fl w Ar width
.Op Ar file
.Nm hdng
.Op Fl X | Fl G
.Op Ar file
.
.Sh DESCRIPTION
The basic concept for this utility is to emulate the base functionality of a hex
dumper as found in bsdmainutils while providing better representation of the
data. A special character set is used so that one might better observe patterns
in the data. Additionally, the three areas of the hexdump (offsets, hexits,
glyphs) can be turned off and the width of data represented in each line of data
can be changed.
.
.Sh USAGE
With a file specified
.D1 Nm hdng Pa data.bin
.Pp
As a filter
.D1 ... | Nm hdng | ...
.
.Sh OPTIONS
A summary of the options supported by
.Nm
is included below.
.Bl -tag -width -Ds
.It Fl h
usage information
.It Fl v
the program's version
.It Fl o
do not display offsets, including the total byte count
.It Fl x
do not display hexits
.It Fl s
do not abbreviate redundant data
.It Fl g
do not display glyphs
.It Fl w Ar width
the
.Em width
of data to represent on each line of output
.It Ar file
the file to be dumped
.El
.
.Ss Special Modes
The following flags are mutually exclusive. When specified,
.Nm
ignores all other flags.
.Bl -tag -width Ds
.It Fl X
turns on continuous
.Em hexdump
mode, which overrides all other options
.It Fl G
turns on continuous
.Em glyphdump
mode, which overrides all other options
.El
.
.Sh SEE ALSO
.Xr unhex 1 ,
.Xr repr 1 ,
.Xr xor 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

View File

@ -1,53 +1,66 @@
.TH "p4split" "1"
.SH "NAME"
p4split \(em split a PCAP based on CIDR
.SH "SYNOPSIS"
.PP
\fBp4split\fR [\-i INPUT] <CIDR>
.SH "DESCRIPTION"
.PP
.\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.\"
.\" This program is free software: you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt P4SPLIT 1
.Os "network reverse engineering tools"
.Sh NAME
.Nm p4split
.Nd split a PCAP based on CIDR filter
.
.Sh SYNOPSIS
.Nm p4split
.Oo Fl h | Fl v Oc
.Nm p4split
.Op Fl i Pa input.pcap
.Ao CIDR filter Ac
.
.Sh DESCRIPTION
The basic concept for this utility is to filter and split a PCAP packet capture
file into smaller files. This utility will create up to 256 smaller files.
.SH "USAGE"
.IP "As a filter" 10
... | \fBp4split\fR 192.168.1.0/24
.IP "Command mode" 10
\fBp4split\fR \-i big.pcap 192.168.1.0/24
.SH "OPTIONS"
.PP
A summary of the options supported by \fBp4split\fR is included below.
.IP "\-i INPUT" 10
When the \fB\-i\fR argument is specified, \fBINPUT\fR is used as input, instead
of stdin
.IP "CIDR" 10
A network address in CIDR notation (ad.dre.ss/subnet-bits)
.SH "REQUIRES"
.PP
n/a
.SH "VERSION"
.PP
0.1337
.SH "BUGS"
.PP
n/a
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx
.
.Sh USAGE
As a filter
.D1 ... | Nm p4split 192.168.1.0/24
.Pp
Command mode
.D1 Nm p4split Fl i Pa big.pcap Ad 192.168.1.0/24
.
.Sh OPTIONS
A summary of the options supported by
.Nm
is included below.
.Bl -tag -width Ds
.It Fl h
usage information
.It Fl v
the program's version
.It Fl i Pa input.pcap
.Pa input.pcap
is used as input, instead of stdin
.It Ao CIDR filter Ac
A filter in CIDR notation (ad.dre.ss/subnet-bits)
.El
.
.Sh SEE ALSO
.Xr pmerge 1 ,
.Xr puniq 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

View File

@ -1,52 +1,73 @@
.TH "pmerge" "1"
.SH "NAME"
pmerge \(em merge multiple PCAP files in timeline order
.SH "SYNOPSIS"
.PP
\fBpmerge\fR [\-o OUTPUT] <FILE> [FILE]*
.SH "DESCRIPTION"
.PP
.\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.\"
.\" This program is free software: you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt PMERGE 1
.Os "network reverse engineering tools"
.Sh NAME
.Nm pmerge
.Nd merge multiple PCAP files in timeline order
.
.Sh SYNOPSIS
.Nm pmerge
.Op Fl h | Fl v
.Nm pmerge
.Op Fl o Ar Pa output.pcap
.Pa input.pcap
.Op Ar
.
.Sh DESCRIPTION
The basic concept for this utility is to merge multiple PCAP files while
maintaining timeline order.
.SH "USAGE"
.IP "As a filter" 10
\fBpmerge\fR one.pcap two.pcap > merged.pcap
.IP "In simple command form" 10
\fBpmerge\fR \-o merged.pcap one.pcap two.pcap
.SH "OPTIONS"
.PP
A summary of the options supported by \fBpmerge\fR is included below.
.IP "\-o OUTPUT" 10
The \fB\-o\fR command flag sets the output filename. If this option flag is not
specified, stdout is used to output the merged PCAP.
.IP "FILE" 10
.
.Sh USAGE
As a filter
.D1 Nm pmerge Pa one.pcap Pa two.pcap Li > Pa merged.pcap
.Pp
In simple command form
.D1 Nm pmerge Fl o Pa merged.pcap Pa one.pcap Pa two.pcap
.
.Sh OPTIONS
A summary of the options supported by
.Nm pmerge
is included below.
.
.Bl -tag -width Ds
.It Fl h
usage information
.It Fl v
the program's version
.It Fl o Ar output.pcap
sets the output filename to
.Pa output.pcap .
If this option flag is not specified,
.Ev stdout
is used to output the merged PCAP
.It Pa input.pcap
At least one input file argument is required.
.SH "REQUIRES"
.PP
n/a
.SH "VERSION"
.PP
0.1337
.SH "BUGS"
.PP
n/a
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx
.It Ar
additional input files may be specified
.El
.
.Sh SEE ALSO
.Xr p4split 1 ,
.Xr puniq 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

View File

@ -1,52 +1,72 @@
.TH "puniq" "1"
.SH "NAME"
puniq \(em filter one to many PCAP files for unique frames
.SH "SYNOPSIS"
.PP
\fBpuniq\fR [\-o OUTPUT] <FILE> [FILE]*
.SH "DESCRIPTION"
.PP
.\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.\"
.\" This program is free software: you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt PUNIQ 1
.Os "network reverse engineering tools"
.Sh NAME
.Nm puniq
.Nd filter one to many PCAP files for unique frames
.
.Sh SYNOPSIS
.Nm puniq
.Op Fl h | Fl v
.Nm puniq
.Op Fl o Ar output.pcap
.Pa input.pcap
.Op Ar
.
.Sh DESCRIPTION
The basic concept for this utility is to filter one to many PCAP files for
unique frames
.SH "USAGE"
.IP "As a filter" 10
\fBpuniq\fR one.pcap two.pcap > unique.pcap
.IP "In simple command form" 10
\fBpuniq\fR \-o unique.pcap one.pcap two.pcap
.SH "OPTIONS"
.PP
A summary of the options supported by \fBpuniq\fR is included below.
.IP "\-o OUTPUT" 10
The \fB\-o\fR command flag sets the output filename. If this option flag is not
specified, stdout is used to output the merged PCAP.
.IP "FILE" 10
At least one input file argument is required.
.SH "REQUIRES"
.PP
n/a
.SH "VERSION"
.PP
0.1337
.SH "BUGS"
.PP
n/a
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx
.
.Sh USAGE
As a filter
.D1 Nm puniq Pa one.pcap Pa two.pcap Li > Pa unique.pcap
.Pp
In simple command form
.D1 Nm puniq Fl o Pa unique.pcap Pa one.pcap Pa two.pcap
.
.Sh OPTIONS
A summary of the options supported by
.Nm puniq
is included below.
.
.Bl -tag -width Ds
.It Fl h
usage information
.It Fl v
the program's version
.It Fl o Ar output.pcap
sets the output filename to
.Pa output.pcap .
If this option flag is not specified,
.Dv stdout
is used to output the merged PCAP
.It Pa input.pcap
At least one input file argument is required
.It Ar
additional input files may be specified
.
.Sh SEE ALSO
.Xr p4split 1 ,
.Xr pmerge 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

View File

@ -1,44 +1,63 @@
.TH "repr" "1"
.SH "NAME"
repr \(em escape unprintable characters\)
.SH "SYNOPSIS"
.PP
\fBrepr\fR [FILE]
.SH "DESCRIPTION"
.PP
The basic concept for this utility is to emulate python's repr() function
.SH "USAGE"
.IP "With a file specified" 10
\fBrepr\fR data.bin
.IP "As a filter" 10
... | \fBrepr\fR | ...
.SH "OPTIONS"
.PP
n/a
.SH "REQUIRES"
.PP
n/a
.SH "VERSION"
.PP
0.1337
.SH "BUGS"
.PP
n/a
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx
.\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.\"
.\" This program is free software: you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt REPR 1
.Os "network reverse engineering tools"
.
.Sh NAME
.Nm repr
.Nd escape unprintable characters
.
.Sh SYNOPSIS
.Nm repr
.Op Fl h | Fl v
.Nm repr
.Op Ar
.
.Sh DESCRIPTION
The basic concept for this utility is to emulate python's repr() function. Input
bytes are escaped using Python's byte notation if they do not fall within the
printable range.
.
.Sh USAGE
With a file specified
.D1 Nm repr Pa data.bin
.Pp
As a filter
.D1 ... | Nm repr | ...
.
.Sh OPTIONS
A summary of the options supported by
.Nm repr
is included below.
.
.Bl -tag -width Ds
.It Fl h
usage information
.It Fl v
the program's version
.El
.
.Sh SEE ALSO
.Xr hdng 1 ,
.Xr xor 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

View File

@ -1,45 +1,63 @@
.TH "unhex" "1"
.SH "NAME"
unhex \(em translate hexits to their binary equivalent\)
.SH "SYNOPSIS"
.PP
\fBunhex\fR [FILE]
.SH "DESCRIPTION"
.PP
The basic concept for this utility is to translate hexits (00-ff) to their binary
equivalent.
.SH "USAGE"
.IP "With a file specified" 10
\fBunhex\fR data.bin
.IP "As a filter" 10
... | \fBunhex\fR | ...
.SH "OPTIONS"
.PP
n/a
.SH "REQUIRES"
.PP
n/a
.SH "VERSION"
.PP
0.1337
.SH "BUGS"
.PP
n/a
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
pi-rho pi-rho@tyr.cx
.PP
This man-page was written by pi-rho ubuntu@tyr.cx
.\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.\"
.\" This program is free software: you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt UNHEX 1
.Os "network reverse engineering tools"
.
.Sh NAME
.Nm unhex
.Nd translate hexits to their binary equivalent
.
.Sh SYNOPSIS
.Nm unhex
.Op Fl h | Fl v
.Nm unhex
.Op Ar
.
.Sh DESCRIPTION
The basic concept for this utility is to translate hexits (00-ff) to their
binary equivalent. If the text input includes spaces and non-hexadecimal
characters, these characters are ignored. If non-hexadecimal characters appear
between hexit pairs, an error is produced.
.
.Sh USAGE
With a file specified
.D1 Nm unhex Pa data.bin
.Pp
As a filter
.D1 ... | Nm unhex | ...
.
.Sh OPTIONS
A summary of the options supported by
.Nm unhex
is included below.
.
.Bl -tag -width Ds
.It Fl h
usage information
.It Fl v
the program's version
.El
.Sh SEE ALSO
.Xr hdng 1 ,
.Xr xor 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx

113
man/xor.1
View File

@ -1,50 +1,69 @@
.TH "xor" "1"
.SH "NAME"
xor \(em apply mask bytes to a stream using XOR
.SH "SYNOPSIS"
.PP
\fBxor\fR [\-x] <MASK>*
.SH "DESCRIPTION"
.PP
.\" This manual is Copyright 2012 by pi-rho <ubuntu@tyr.cx>
.\"
.\" This program is free software: you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This package is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" On Debian systems, the complete text of the GNU General
.\" Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
.
.Dd March 3, 2012
.Dt XOR 1
.Os "network reverse engineering tools"
.
.Sh NAME
.Nm xor
.Nd apply mask bytes to a stream using XOR
.
.Sh SYNOPSIS
.Nm xor
.Op Fl h | Fl v
.Nm xor
.Op Fl x
.Ar MASKBYTE
.Op Ar MASKBYTES ...
.
.Sh DESCRIPTION
The basic concept for this utility is to apply a set of mask bytes, repeatedly,
to a stream of input. The application of the mask bytes is accomplished using
the bitwise XOR operation.
.SH "USAGE"
.IP "As a filter" 10
... | \fBxor\fR \-x 20 2f | ...
.SH "OPTIONS"
.PP
A summary of the options supported by \fBxor\fR is included below.
.IP "\-x" 10
The optional \fI\-x\fP flag tells xor that mask bytes are specified in
hexadecimal notation
.IP "MASK" 10
This represents a list of mask bytes to apply to the input stream. Bytes should
be listed in decimal, unless the optional \fI\-x\fR flag is
given.
.SH "REQUIRES"
.PP
n/a
.SH "VERSION"
.PP
0.1337
.SH "BUGS"
.PP
n/a
.SH "SEE ALSO"
.PP
n/a
.SH "AUTHORS"
.PP
Zephyr zephyr@dirtbags.net
.PP
This man-page was written by pi-rho ubuntu@tyr.cx
.
.Sh USAGE
As a filter with the hexadecimal mask bytes
.Bq 20 , 2f
applied to the input stream (i.e.
.Bq 20 , 2f , 20 , 2f , ... Ns )
.D1 ... | Nm xor Fl x Ar 20 Ar 2f | Li ...
.
.Sh OPTIONS
A summary of the options supported by
.Nm xor
is included below.
.
.Bl -tag -width Ds
.It Fl h
usage information
.It Fl v
the program's version
.It Fl x
explicity interpret mask bytes as hexadecimal digits
.It Ar MASKBYTE Op Ar MASKBYTES ...
a list of mask bytes to apply to the input stream
.El
.
.Sh SEE ALSO
.Xr hdng 1 ,
.Xr unhex 1
.
.Sh AUTHORS
.An Zephyr Aq Ad zephyr@dirtbags.net ,
.An pi-rho Aq Ad pi-rho@tyr.cx