find Hex value

[salim]

HI , i want to be able find an Hex Value into a binary file

let's suppose i have a File named : test.exe or what ever so i want to find the the Hex Value : 546869732070726F6772616D which is the ' This program ' in ASCII in this test.exe .

is there any way .


thank you

[Muetze1]

Hi and welcome to this board!

First of all, one basic hint: hexadecimal, decimal, binary, octal or whatever you want, are only different ways to display values. The values themself are always the same but the display differs. You also shows this in your question, because 546869732070726F6772616D is the same as "This program", only the display format differs.

Due this fact: don't care about the display format, just look for the values. So whatever you want to search, convert all inputs (in what display format it ever is entered) to the values it self and search for the given value.

For looking in a binary file, take a look in the help about TFilestream. This class will offer you all needed for this.

[salim]

thank you Muetze1
[quote
Due this fact: don't care about the display format, just look for the values. So whatever you want to search, convert all inputs (in what display format it ever is entered) to the values it self and search for the given value.
quote]

i really don't understand you , could you please drop me an exemple using this : 546869732070726F6772616D


thank you agin

[Muetze1]

You got a hexadecimal sring. In hexadecimal there are two characters one byte (each char represents one nibble (4 Bits)). So split the string into pairs of two characters. After this, evaluate these pairs to their respective values (IntToStr() also converts hexadecimal values. But to decide the decimal and hexadecimal representation, IntToStr() needs a $ as prefix). Look in the help for further information: Copy(), Pos(), Delete, IntToStr() etc.

[salim]

Hi Muetze1 , when trying the conversion :
i have a little confusion :

when i read my file into an Hexeditor : i found the ASCII value ( MZ ) is 4D5A in hex , but in this article it's written ' if Signature = $5A4D { 'MZ' } then ' why it's changed from 4D5A into the Value
$5A4D

really in confusion :

[BUG]

Zitat:

Zitat von salim

why it's changed from 4D5A into the Value $5A4D

In my opinion, this happens because of the Endianness.

MfG,
Bug