Thread: find hex-code within binary file

  1. #1
    Registered User
    Join Date
    Dec 2007
    Posts
    23

    find hex-code within binary file

    hi,

    is there a possibility to find a hex-code string within a binary file
    and get its position in that file?

    thanks,

    toby

  2. #2
    Registered User
    Join Date
    Aug 2005
    Location
    Austria
    Posts
    1,990
    Yes.
    Kurt

  3. #3
    Registered User
    Join Date
    Dec 2007
    Posts
    23
    well... nice to know..

    would you tell me how, then..?

  4. #4
    Registered User
    Join Date
    Aug 2005
    Location
    Austria
    Posts
    1,990
    I would open a filestream in binary mode, fill a buffer using e.g. stream::read and use maybe memcmp to search for the string. to account for the case that the searchstring will not be completely found in the buffer I would move length of searchstring - 1 chars from the end of the buffer to the beginning of the buffer and refill the buffer from offset length of searchstring - 1 and use memcmp again until i'd either found the string or reading from the file would fail.
    Kurt

  5. #5
    Registered User
    Join Date
    Dec 2007
    Posts
    23
    thanks!

    but how do i compare binary-read input and a hex-string?
    i can't think of that point...?

  6. #6
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Right, so what have you tried so far?

    The general principle in this forum is that we don't just simply "provide people with code ready to run", but we help people LEARN HOW TO do things themselves. A large part of programming is about learning how to solve problems - the syntax and functions, whilst important, are only a small portion of what you need to know and understand.

    Does the search have to be fully generic, with completely arbitrary search patterns, arbitrary number of repetitions, wildcards, etc, etc? Or can it be allowed to restrict itself, for example, if you find a partial set, can you skip over the bit you matched without "going back on yourself"? [This is a problem if you search for abcaabc, and you search in find xxaabcabcaabcyyy...

    In the above example, when search through the red part, it starts to match, when we get to the second of the blue letters, it is a mismatch, but the blue letters are actually part of the pattern, as the blue and green makes up what we searched.

    [The fact that the search pattern isn't a sequence of hex numbers doesn't really matter - the principle applies to any "compare a bit at a time" searching, and I didn't want it to be three times as long just by writing a sequence of hex numbers - as it changes nothing]

    --
    Mats
    Last edited by matsp; 12-21-2007 at 02:23 PM.
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  7. #7
    Registered User
    Join Date
    Aug 2005
    Location
    Austria
    Posts
    1,990
    I'd try something like this
    Code:
    #include <cstring>
    #include <iostream>
    
    using namespace std;
    
    int main() {
        char hexstr[] = { 12, 0, 21, 14 };
        char buffer[] = { 55, 19, 88, 12, 0, 21, 14, 99, 12 };
        char * p = 0;
        for ( int i = 0; i < sizeof(buffer) - sizeof(hexstr); ++ i ) {
            if ( buffer[i] = hexstr[0] ) {
                if ( memcmp(&buffer[i], hexstr, sizeof(hexstr)) == 0 ) {
                    p = &buffer[i];
                    break;
                }
            }
        }
        if ( p) {
            cout << "found at position " << p - buffer << endl;
        }
        else
            cout << "not found" << endl;
    }
    You could use std::string and string::find. In this case you wouldn't need the loop to search the buffer.
    Kurt
    Last edited by ZuK; 12-21-2007 at 02:31 PM.

  8. #8
    Registered User
    Join Date
    Dec 2007
    Posts
    23
    yes of course, and i do want to learn, that's why i did not just say "give me some code to do this"..
    so far i tried to write such a procedure in a file test.cpp
    Code:
    #include <iostream>
    #include <fstream>
    using namespace std;
    
    int main(int argc, char *argv[]) {
    
    //argc and argv not used yet, using the bin of myself...
    
            char *FileName;
            char *HexString;
            char *ReadBuffer;
            FileName = "test";
            HexString = "110fa8";
            ifstream filestream(FileName,  ios::binary | ios::ate);
            if (filestream.is_open()) {
             ReadBuffer = new char [6];
             filestream.read(ReadBuffer, -6);
             cout<<memcmp(ReadBuffer, HexString, 6)<<endl;
             filestream.close();
             return 0;
            } else {
             cout<<"Opening file failed."<<endl;
             return 1;
            }
    }
    if i am correct i should get 0 if there is a match, and a -1 if there
    is none. with `od` i made sure this hex-code is part of the file.
    I think it's wrong to try to compare a char* with memcmp, but
    that's my question, how to compare hex-data?

    thanks,

    toby

  9. #9
    Registered User t3chn0n3rd's Avatar
    Join Date
    Dec 2007
    Location
    kansas city
    Posts
    25

    hex editor

    I think you can download a hexeditor on shareware.com and edit or browse a binary.

    I have done this numerous times with various games to edit them

  10. #10
    Registered User
    Join Date
    Dec 2007
    Posts
    23
    oh, thanks ZuK, i didn't refresh the webpage, so i didn't see your answer before
    i replied to the post..

  11. #11
    Registered User
    Join Date
    Dec 2007
    Posts
    23
    @t3chn0n3rd : thanks, but i do not just want to browse some files and edit them..

  12. #12
    Registered User VirtualAce's Avatar
    Join Date
    Aug 2001
    Posts
    9,607
    ...hex-code string within a binary file
    I was not aware there was a difference. Hex code is just a base 16 interpretation of binary base 2. Just as decimal is base 10. You can get hex codes from text files if you convert the characters into their ASCII or Unicode equivalents. The only diff between binary and text is how the values are interpreted.

    This is a simple file operation that shouldn't take too long at all. Look at ifstream and stream manipulators.

  13. #13
    Registered User
    Join Date
    Dec 2007
    Posts
    23
    ok, so i tried this, but this always gives me a negative output, except if i set all the
    integers for the HexString to 0. I do not see why, can anyone give me a clue?

    Code:
    #include <iostream>
    #include <stdio.h>
    #include <fstream>
    using namespace std;
    
    int main(int argc, char *argv[]) {
    
    //argc and argv not used yet, using the bin of myself...
    
            char *FileName;
            char HexString[3] = {0,0,0};
            char *ReadBuffer;
            double length = 0;
            double i=0;
            FileName = "test";
            ifstream filestream(FileName,  ios::binary);
            if (filestream.is_open()) {
              ReadBuffer = new char [3];
              filestream.seekg (0, ios::end);
              length = filestream.tellg();
             // filestream.seekg (0, ios::beg);
             while (length>=i) {
              filestream.read(ReadBuffer,3);
              cout<<memcmp(&ReadBuffer[0], HexString, 3);
              cout<<" :: ";
              cout<<i<<" / "<<length<<endl;
              filestream.seekg((int)+i);
              i++;
             }
             filestream.close();
             return 0;
            } else {
             cout<<"Opening file failed."<<endl;
             return 1;
            }
    }
    thanks,

    toby

  14. #14
    Registered User
    Join Date
    Mar 2005
    Location
    Mountaintop, Pa
    Posts
    1,058
    Unfortunately, the code you posted above has a lot of issues. I've made the basic corrections in the following code.

    Code:
    #include <iostream> 
    #include <fstream> 
    #include <stdio.h>
    using namespace std;
    
    main(int argc, char *argv[]) {
    
        //argc and argv not used yet, using the bin of myself...
        char szInput[3] = {0};
        unsigned char m;
        char *FileName;
        unsigned long length = 0;
        unsigned long  i=0;
        FileName = "test";
        ifstream filestream(FileName,  ios::binary);
        if (filestream.is_open()) {
            filestream.seekg (0, ios::end);
            length = filestream.tellg();
             filestream.seekg (0, ios::beg);
            while (length > i)
            {
                filestream.read(reinterpret_cast < char * > (&m), sizeof(m));
                sprintf(szInput, "%02x", m);
    			cout <<  szInput << endl;
                filestream.seekg((int)++i);
            }
            filestream.close();
            return 0;
        } 
        else {
            cout<<"Opening file failed."<<endl;
            return 1;
        }
    }
    Now you'll have to concentrate on your search routine.

  15. #15
    Registered User
    Join Date
    Dec 2007
    Posts
    23
    wow, thank you so much!! thank you all!
    finally it works and i got it to search for
    the hex-codes passed!

    thanks!

    toby

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. C++ std routines
    By siavoshkc in forum C++ Programming
    Replies: 33
    Last Post: 07-28-2006, 12:13 AM
  2. Dikumud
    By maxorator in forum C++ Programming
    Replies: 1
    Last Post: 10-01-2005, 06:39 AM
  3. Unknown Memory Leak in Init() Function
    By CodeHacker in forum Windows Programming
    Replies: 3
    Last Post: 07-09-2004, 09:54 AM
  4. Reading Binary file to find Checksum
    By Abbila in forum C++ Programming
    Replies: 0
    Last Post: 09-25-2002, 09:52 PM