find hex-code within binary file

hi,

is there a possibility to find a hex-code string within a binary file
and get its position in that file?

thanks,

toby

Yes.
Kurt

well... nice to know..

would you tell me how, then..? :)

I would open a filestream in binary mode, fill a buffer using e.g. stream::read and use maybe memcmp to search for the string. to account for the case that the searchstring will not be completely found in the buffer I would move length of searchstring - 1 chars from the end of the buffer to the beginning of the buffer and refill the buffer from offset length of searchstring - 1 and use memcmp again until i'd either found the string or reading from the file would fail.
Kurt

thanks!

but how do i compare binary-read input and a hex-string?
i can't think of that point...?

Right, so what have you tried so far?

The general principle in this forum is that we don't just simply "provide people with code ready to run", but we help people LEARN HOW TO do things themselves. A large part of programming is about learning how to solve problems - the syntax and functions, whilst important, are only a small portion of what you need to know and understand.

Does the search have to be fully generic, with completely arbitrary search patterns, arbitrary number of repetitions, wildcards, etc, etc? Or can it be allowed to restrict itself, for example, if you find a partial set, can you skip over the bit you matched without "going back on yourself"? [This is a problem if you search for abcaabc, and you search in find xxaabcabcaabcyyy...

In the above example, when search through the red part, it starts to match, when we get to the second of the blue letters, it is a mismatch, but the blue letters are actually part of the pattern, as the blue and green makes up what we searched.

[The fact that the search pattern isn't a sequence of hex numbers doesn't really matter - the principle applies to any "compare a bit at a time" searching, and I didn't want it to be three times as long just by writing a sequence of hex numbers - as it changes nothing]

--
Mats

I'd try something like this

Code:

---

#include <cstring>
#include <iostream>

using namespace std;

int main() {
    char hexstr[] = { 12, 0, 21, 14 };
    char buffer[] = { 55, 19, 88, 12, 0, 21, 14, 99, 12 };
    char * p = 0;
    for ( int i = 0; i < sizeof(buffer) - sizeof(hexstr); ++ i ) {
        if ( buffer[i] = hexstr[0] ) {
            if ( memcmp(&buffer[i], hexstr, sizeof(hexstr)) == 0 ) {
                p = &buffer[i];
                break;
            }
        }
    }
    if ( p) {
        cout << "found at position " << p - buffer << endl;
    }
    else
        cout << "not found" << endl;
}

---

You could use std::string and string::find. In this case you wouldn't need the loop to search the buffer.
Kurt

yes of course, and i do want to learn, that's why i did not just say "give me some code to do this".. :)
so far i tried to write such a procedure in a file test.cpp

Code:

---

#include <iostream>
#include <fstream>
using namespace std;

int main(int argc, char *argv[]) {

//argc and argv not used yet, using the bin of myself...

        char *FileName;
        char *HexString;
        char *ReadBuffer;
        FileName = "test";
        HexString = "110fa8";
        ifstream filestream(FileName,  ios::binary | ios::ate);
        if (filestream.is_open()) {
        ReadBuffer = new char [6];
        filestream.read(ReadBuffer, -6);
        cout<<memcmp(ReadBuffer, HexString, 6)<<endl;
        filestream.close();
        return 0;
        } else {
        cout<<"Opening file failed."<<endl;
        return 1;
        }
}

---

if i am correct i should get 0 if there is a match, and a -1 if there
is none. with `od` i made sure this hex-code is part of the file.
I think it's wrong to try to compare a char* with memcmp, but
that's my question, how to compare hex-data?

thanks,

toby

I think you can download a hexeditor on shareware.com and edit or browse a binary.

I have done this numerous times with various games to edit them

oh, thanks ZuK, i didn't refresh the webpage, so i didn't see your answer before
i replied to the post.. :)

@t3chn0n3rd : thanks, but i do not just want to browse some files and edit them..

Quote:

---

...hex-code string within a binary file

---

I was not aware there was a difference. Hex code is just a base 16 interpretation of binary base 2. Just as decimal is base 10. You can get hex codes from text files if you convert the characters into their ASCII or Unicode equivalents. The only diff between binary and text is how the values are interpreted.

This is a simple file operation that shouldn't take too long at all. Look at ifstream and stream manipulators.

ok, so i tried this, but this always gives me a negative output, except if i set all the
integers for the HexString to 0. I do not see why, can anyone give me a clue?

Code:

---

#include <iostream>
#include <stdio.h>
#include <fstream>
using namespace std;

int main(int argc, char *argv[]) {

//argc and argv not used yet, using the bin of myself...

        char *FileName;
        char HexString[3] = {0,0,0};
        char *ReadBuffer;
        double length = 0;
        double i=0;
        FileName = "test";
        ifstream filestream(FileName,  ios::binary);
        if (filestream.is_open()) {
          ReadBuffer = new char [3];
          filestream.seekg (0, ios::end);
          length = filestream.tellg();
        // filestream.seekg (0, ios::beg);
        while (length>=i) {
          filestream.read(ReadBuffer,3);
          cout<<memcmp(&ReadBuffer[0], HexString, 3);
          cout<<" :: ";
          cout<<i<<" / "<<length<<endl;
          filestream.seekg((int)+i);
          i++;
        }
        filestream.close();
        return 0;
        } else {
        cout<<"Opening file failed."<<endl;
        return 1;
        }
}

---

thanks,

toby

Unfortunately, the code you posted above has a lot of issues. I've made the basic corrections in the following code.

Code:

---

#include <iostream>
#include <fstream>
#include <stdio.h>
using namespace std;

main(int argc, char *argv[]) {

    //argc and argv not used yet, using the bin of myself...
    char szInput[3] = {0};
    unsigned char m;
    char *FileName;
    unsigned long length = 0;
    unsigned long  i=0;
    FileName = "test";
    ifstream filestream(FileName,  ios::binary);
    if (filestream.is_open()) {
        filestream.seekg (0, ios::end);
        length = filestream.tellg();
        filestream.seekg (0, ios::beg);
        while (length > i)
        {
            filestream.read(reinterpret_cast < char * > (&m), sizeof(m));
            sprintf(szInput, "%02x", m);
                        cout <<  szInput << endl;
            filestream.seekg((int)++i);
        }
        filestream.close();
        return 0;
    }
    else {
        cout<<"Opening file failed."<<endl;
        return 1;
    }
}

---

Now you'll have to concentrate on your search routine.

wow, thank you so much!! thank you all!
finally it works and i got it to search for
the hex-codes passed!

thanks!

toby