why can't you use ls -i, find the inode, and do find . -inum INODENUM -exec rm {} \;

is it a list of file that you want to remove put all the files in a text file and do a for loop.

HTH!
Prabhu
-


On May 14, 2009, at 5:47 PM, Ryan Flannery wrote:

I've been in similar situations countless times, but this one is
throwing me a for a loop.

I have a file that I'm trying to remove with non-printable characters
in the name.  Additionally, some of the characters appear to be
backspace/delete/etc.

All my normal tricks with rm(1) fail.
Using vim on the directory to try and delete the entry fails.

I can get the inode of the file with ls(1), and used that to write the
following program which I thought would help, but sadly it too fails.

#include <stdio.h>
#include <sys/types.h>
#include <dirent.h>
#include <err.h>
#include <unistd.h>

int main(void)
{

  /* open directory */
  DIR *usr;
  if ((usr = opendir("/usr")) == NULL)
     err(1, "failed to opendir");


  /* read through until we find the evil one... */
  struct dirent *entry;
  while ((entry = readdir(usr)) != NULL)
  {
     /* check against known evil inode */
     if (entry->d_fileno == 1065344)
     {
        /* got it */
        printf("found file...name length is: %d\n", entry->d_namlen);

        /* build filename as a char* */
        uint8_t i;
        for (i = 0; i < entry->d_namlen; i++)
           printf("%d ", entry->d_name[i]);


        /* cross fingers */
        printf("\n\nattempting to unlink...\n");
        if (unlink(entry->d_name) < 0)
           err(1, "failure, crack 'nother beer");
     }
  }

  closedir(usr);

  return 0;
}


the program outputs the following:

found file...name length is: 194
-104 38 13 40 -22 101 -13 -4 -68 -107 69 86 49 -92 69 37 -90 -95 -52
20 27 -104 -24 -60 82 -49 46 -50 79 -70 23 -30 66 -29 56 89 29 -100
-127 59 83 -115 28 26 -121 30 81 -45 67 -53 -100 -76 103 15 109 -88 17
95 69 -102 87 -35 -41 -83 -13 -18 9 62 76 44 -52 99 33 -5 39 79 -100
49 -111 6 -64 -94 -97 19 -10 34 104 -87 100 28 125 4 -52 -101 84 -85
85 92 13 -2 -84 -11 63 125 -1 119 -67 82 27 96 -113 -79 -1 84 -87 -43
55 -14 -1 53 -124 69 -29 -65 74 27 96 -113 -71 -1 -111 75 -91 -51 -8
-81 33 -120 -58 127 85 54 -64 30 115 -1 83 44 -41 55 -25 -65 53 -124
-51 -3 -49 -41 29 -60 -12 -65 26 27 96 -39 -9 63 114 66 -2 91 -86 -105
54 -12 -65 -122 -80 104 -4 55 60 -31 -21 8 66 -6 95 -111 13 -80 44 -6

attempting to unlink...
a.out: failure, crack 'nother beer: No such file or directory


Questions:
1.  Any whacks of a clue-stick would be greatly appreciated.
2.  When I printf dirent struct's d_namlen field, is says 302...
grep'ing /usr/include, isn't this 255?  How can this happen?
3.  Passing the d_name field directly to unlink(2)... this should
work, correct?  (I tried this with a sample setup elsewhere and it
did).  Any thoughts why this would fail?

To those who are curious, the file was created when I went to unpack a
ports.tar.gz and forgot the 'z' switch... d'oh.

Anyway, I could try deleting the parent directory, but it's /usr.

-Ryan

Reply via email to