Oninit® Forensic Tools — Features

Library: ondebug

• Pure C, libc only. Self-contained: No OpenSSL, no GSKit, no Informix headers.

CLI: ondebug

• Thin wrapper over the library. One invocation, one page. Reads the page directly from a chunk file via pread.
• Output: hex-dump to stdout (default) or raw bytes to a file (-o FILE).

How it works: Encryption-At-Rest (EAR)

Informix's Encryption-At-Rest (EAR) sits below the engine's page-cache boundary: pages are plaintext in the buffer cache, in oncheck -pP output, in dbexport/onunload, and in unencrypted backups; the on-disk transform applies only as pages cross between the cache and chunk storage. ondebug's role is offline: given the chunk file in hand and the appropriate key material recovered out-of-band, it produces the plaintext page without needing a running engine.

Configuration discovery happens through the standard Informix surfaces (onconfig, onstat -d). The library itself is self-contained: it has no Informix linkage and no third-party crypto library dependency at link time.

Verification scaffolding

Engagement-side verification harnesses + internal RE tooling are available to Oninit® staff (internal). The public deliverable is the library plus CLI described above; the verification corpus, diagnostic tools, and capture-side scripts live under the engagement's internal documentation.