Hex Search

Background

This is a fairly low level utility to search for patterns in binary files.

Why

Programs such as the editor in Microsoft Visual Studio can do this but it's sometimes useful to get a list of start offsets for patterns to compare with the location of other known patterns so that their positions can be cross-referenced for order and proximity.

This program does not modify files, so debug, hexed or the editor in Microsoft Visual Studio are required to actually modify files.

Usage

Usage: hexsearch string infile
string=[[0-9|A-F|a-f][0-9|A-F|a-f]]+

Example

Search a text file for the presence of the 8-bit ASCII string 'this':
hexsearch 74686973 infile

For those that don't know, the hex representation of a string can be found by writing a simple text file and then opening the file with the command line tool 'debug.exe' (supplied with DOS and Windows) or 'hexed.exe' (which was popular a few years ago).

The following input file

test, this is a test
this is the second line

Produces the following output

Found at offset
6 (0x6)
22 (0x16)
On very large files this can allow the programmer to home in on areas on the file using a debugger or hex editor for editing binary files.

Notes

1. The input string can only be upto 128 bytes long, this is a constant in the program,
2. The offset values are 0 address based,
3. The output offsets are displayed in decimal (and hexadecimal).

Remember

Intel CPUs are little endian based so the value 320 in decimal, stored in an 'unsigned long', would be encoded as 40010000 in hexadecimal notation. On Motorola CPUs this would be stored as 00000140. The hexsearch command line would be 'hexsearch 40010000 infile' to find the value in an Intel x86 executable.

Download

The Win32 console application is available in the download page.

Back to index.