Hex Search
Background
This is a fairly low level utility to search for patterns in binary files.
Why
Programs such as the editor in Microsoft Visual Studio can do this but it's sometimes useful
to get a list of start offsets for patterns to compare with the location of other known patterns
so that their positions can be cross-referenced for order and proximity.
This program does not modify files, so debug, hexed or the editor in Microsoft Visual Studio are
required to actually modify files.
Usage
Usage: hexsearch string infile
string=[[0-9|A-F|a-f][0-9|A-F|a-f]]+
Example
Search a text file for the presence of the 8-bit ASCII string 'this':
hexsearch 74686973 infile
For those that don't know, the hex representation of a string can be found by writing a simple
text file and then opening the file with the command line tool 'debug.exe' (supplied with DOS and
Windows) or 'hexed.exe' (which was popular a few years ago).
The following input file
test, this is a test
this is the second line
|
Produces the following output
Found at offset
6 (0x6)
22 (0x16)
|
On very large files this can allow the programmer to home in on areas on the file using a debugger
or hex editor for editing binary files.
Notes
1. The input string can only be upto 128 bytes long, this is a constant in the program,
2. The offset values are 0 address based,
3. The output offsets are displayed in decimal (and hexadecimal).
Remember
Intel CPUs are little endian based so the value 320 in decimal, stored in an 'unsigned long', would be
encoded as 40010000 in hexadecimal notation. On Motorola CPUs this would be stored as 00000140. The hexsearch
command line would be 'hexsearch 40010000 infile' to find the value in an Intel x86 executable.
Download
The Win32 console application is available in the download page.
Back to index.