LR_DEANONYMIZE.IN(1)

📦 version 2.1.1, in arch rolling

💅 LR_DEANONYMIZE.IN(1) — the deanonymizer, bestie edition 🎀

okay so picture this: you've got a manual page called LR_DEANONYMIZE.IN(1) from LogReport's Lire Documentation, and it's literally about putting the real names back on anonymized data. iconic behavior. let's get into it ✨

🌸 NAME 🌸

lr_deanonymize — restore anonymized data, using a dump as produced by lr_anonymize(1)

like. it un-anonymizes things. the name is not subtle and honestly? love that for it 💖

✨ SYNOPSIS ✨

lr_deanonymize dumpfilestem

that's it. one arg. no flags, no drama, no thirty-seven options to memorize. she's lowkey minimalist 💅

🦋 DESCRIPTION 🦋

okay so lr_deanonymize is typically used when you're receiving anonymized reports from a responder. and if you're like "wait, what does that even look like in practice," the manual is pointing you at the section on "Processing The Responder's Results" in the chapter on "Using A Responder" in the Lire User Manual for usage examples. go read that, iykyk 📖

here's the vibe of what it actually does: lr_deanonymize reads a file from stdin — a file containing anonymized emailaddresses, ipnumbers, and hostnames (typically a report, generated from a logfile from an internet service) — and prints a "deanonymized" version of this file to stdout. so stdin in, stdout out, glow-up in the middle ✨

and where does she get the info to do this? from a bunch of Berkeley DB's, stored in files whose names are derived from dumpfilestem, as produced by lr_anonymize(1). so that one argument is literally the whole map back to reality. no cap 🔑

ngl, dumpfilestem is load-bearing. no stem, no deanonymization. she needs her Berkeley DB's 🫶

🍓 EXAMPLE 🍓

a logfile like, say:

 blaat fkrf 1.2.3.4.in-addr.arpa] pietje@bigcompany.com bla 1 2 3 lj;agas;gag
 blaat 1.2.3.4 fkrf 3.2.3.4.in-addr.arpa] bla 1 www.hotsex.com 2 3 lj;agas;gag
 jan@blaat.frut.com agagag
 blaat fkrf 4.2.3.4.in-addr.arpa] bla pietje@bigcompany.com www.hotsex.com
 234.34.2.0 jan@blaat.frut.com 4.2.3.4.in-addr.arpa1 2 3 lj;agas;gag
 blaat fkrf tweede 3.2.3.4.in-addr.arpa] bla 1.2.3.4 1 blablabla.com
 2 mdcc.cx
 3 lj;agas;gag

wil get anonymized to — and yes, the original page says "wil", we're keeping the chaos 🫶:

 blaat fkrf 1.0.0.10.in-addr.arpa] john.doe.1@example.com bla 1 2 3 lj;agas;gag
 blaat 10.0.0.1 fkrf 2.0.0.10.in-addr.arpa] bla 1 1.example.com 2 3 lj;agas;gag
 john.doe.2@example.com agagag
 blaat fkrf 3.0.0.10.in-addr.arpa] bla john.doe.1@example.com 1.example.com
 10.0.0.2 john.doe.2@example.com 3.0.0.10.in-addr.arpa1 2 3 lj;agas;gag
 blaat fkrf tweede 2.0.0.10.in-addr.arpa] bla 10.0.0.1 1 2.example.com
 2 3.example.com
 3 lj;agas;gag

and the dump will look like this, bestie — this is the receipts file 💀:

 ip 234.34.2.0 10.0.0.2
 ip 1.2.3.4 10.0.0.1
 inaddr 3.2.3.4.in-addr.arpa 2.0.0.10.in-addr.arpa
 inaddr 1.2.3.4.in-addr.arpa 1.0.0.10.in-addr.arpa
 inaddr 4.2.3.4.in-addr.arpa 3.0.0.10.in-addr.arpa
 domain mdcc.cx 3.example.com
 domain blablabla.com 2.example.com
 domain www.hotsex.com 1.example.com
 email jan@blaat.frut.com john.doe.2@example.com
 email pietje@bigcompany.com john.doe.1@example.com

see how pietje@bigcompany.com maps to john.doe.1@example.com, 234.34.2.0 maps to 10.0.0.2, and mdcc.cx maps to 3.example.com? that's the whole trick. the dump is the key, lr_deanonymize is the locksmith 🔥

🧚 SEE ALSO 🧚

👑 VERSION 👑

$Id: lr_deanonymize.in,v 1.4 2006/07/23 13:16:32 vanbaal Exp $

look at that vintage version string, she's an elder and we respect her 💜

Copyright (C) 2000-2001 Stichting LogReport Foundation LogReport@LogReport.org

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html.

fr fr do read the license, it's giving "legally required and also correct" ⚖️✨

⭐ AUTHOR ⭐

Joost van Baal <joostvb@logreport.org>

periodt 💅

and that's the whole page, bestie — Lire 2.1.1, dated 2025-09-28, manual page LR_DEANONYMIZE.IN(1). go deanonymize something responsibly 🫶🎀💖

📦 where this page comes from