find hex codes in files

[cdkiller]

hello,

i try to search a hex string in a file and replace it, but it doesn't do it.

Ok now here are the hex string i have read it from hex workschop:

4164 6444 8B4D 088B 51

this was the hex code and the ansi string for that in hex workshop is "AddD.M..Q"

in notepad it is so: "AddD‹M‹Q"

and this is what i want to find in a file the hex bytes.

can someone help me or make a little function to find that ?

thanks for help.

cu
cdkiller :-D

[ripper8472]

du musst zuerst die hex werte in normale binärdaten umwandeln. die prozedur dazu steht weiter unten.
wenn du deine hex werte in etwas brauchbares umgewandelt hast, dann lade die datei in einen string und benutze pos(), um nach deinem string zu suchen. du könntest auch selber eine suchfunktion schreiben, die direkt mit der datei arbeitet. such dazu nach vorkommen des ersten zeichens von deinem suchstring. wenn du ein vorkommen gefunden hast, dann prüfe, ob die folgenden zeichen in der datei auch übereinstimmen.

Gruß, Christoph



you first need to convert your hex data to binary as it is saved in your file.
use this procedure and extend it to your needs (it is not tested and may need modifications):

Delphi-Quellcode:

function hextochar(hexstring:string[2]):char;
var
  i:integer;
  c:char;
  hexchars:string;
begin
  hexchars:='0123456789ABCDEF';
  c:=char((pos(hexstring[2],hexchars)-1) or ((pos(hexstring[1],hexchars)-1) shr 4));
  result:=c;
end;

once you have converted your search data, you can load the file (hopefully not a large one) into a string and then use pos(yourdata,filedata).
you could also write a custom find function that works directly with that file. just read char by char and check if it matches yourdata[1] (first char of the string you want). if it matches, then proceed by checking the next char in file against yourdata[2] and so on.

[cdkiller]

in your code there is a error in the function which i cannot find.

if i try to hextochar('41')(or other hex chars) the output in my variable is always 

why ?

cu
cdkiller

[scp]

It should be shl 4 not shr 4

[cdkiller]

ok thanks. :wall:

but this is not all. i have more problems with the function which should find these strings.

first i have convert the hex bytes into the char format whith the code at the top.

now i have also strings to search like this:

AddD 4.84

and

AddD 4.83

so my dearch function:

Delphi-Quellcode:

function FindInFile(const FileName   : string;
                    SearchWord : string; MatchCase : Boolean) : Integer;
var
  fs     : TFileStream;
  Buffer : array [1..10000] of Char;
  Size   : Integer;
  idx    : Integer;
  i      : Integer;
begin
  Result := -1;
  idx := 1;
  if not MatchCase then
   SearchWord := UpperCase(SearchWord);
  fs := TFileStream.Create(FileName, fmopenreadwrite or fmsharedenynone);
  try
    Repeat
      Application.ProcessMessages;
      Size := (Fs.Size - Fs.Position);
      if Size > 10000 then Size := 10000;
      Fs.ReadBuffer(Buffer, Size);
      if not MatchCase then
      begin
        for i := 1 to Size do
          Buffer[i] := Uppercase(Buffer)[i];
      end;
      for i := 1 to Size do
      begin
        if (Buffer[i] = SearchWord[idx]) then
          Inc(idx)
        else
          idx := 1;
        if (idx = Length(SearchWord)) then
        begin
          Result := (fs.Position - Size) + i - idx + 1;
          Exit;
        end;
      end;
    until fs.Position >= fs.Size;
  finally
   fs.Free;
  end;
end;

when i start the search it should first search the 4.84 instances and when it doesn't exists it should search after 4.83. The problem is, that the function stop if they had found the 4 of 4.84 or 4.83 and they they things that is 4.84 and they do not search after 4.83

what is the problem in my code ? it must detect exactly the 4.84 or 4.83.

thanks

[scp]

Idx begins with value 1.
So if all Chars are matched Idx has a value of Length(SearchWord)+1
Declare the If-Statement like this:

Delphi-Quellcode:

        if (idx = Length(SearchWord)+1) then
        begin

[cdkiller]

ok i have found the error.

now it is perfect.

but here is also a problem because how can i get the bytes after the addD string ?

example:

in one file here are the string:

AddD---4.83.52-0070

and in an other file i have:

AddD---4.83.60-0068

the - are be spaces in the file.

and i want that my program search after this string and show a message with the version number (4.83xxx)
this version number is not always the same which you can see.

only th start (4.83) is the same.

can someone help me how i can read the version number out of the file ?

my search function returns the the position of the string in the file.
then the cursor must be before the A of the AddD string.

what i search is how can i read after the add the version number ? i am not sure but the spaces after the addD string can also be more as 3.

i hope you know what i mean.
thanks

[scp]

You can search for 'AddD ' (If it has not less but more than 3 spaces) then you should read the data into a buffer and find out the postion of the version number if you compare the chars until it is <> ' '.

Delphi-Quellcode:

  ThePos := FindInFile('D:\_ftest.txt', 'AddD   ', true);
  fs := TFileStream.Create;
  try
    fs.Seek(ThePos + length('AddD   '), soFromBeginning);
    fs.ReadBuffer(Buffer, SizeOf(Buffer));
    i := 0;
    repeat
      Inc(i);
    until (Buffer[i] <> ' ') or (i >= SizeOf(Buffer));
  finally
    fs.Free;
  end;

To find the next entry you should add an additional parameter to FindInFile() which contains the current position in the file.

[cdkiller]

? i can't understand your code ?

it is not easier to load the file in a filestream. then seek to the postion of the AddD string + 8 chars forwad
that the cursor is after "AddD ".

than the version number is 14 chars long. from the position read the filestream in a buffer which is 14 chars long.

but when i tried to prompt the buffer, it is empty. why ?

[cdkiller]

ok i have found it.

it this okay or have it errors btw can it reads other files not correct ?

Delphi-Quellcode:

procedure TForm1.Button3Click(Sender: TObject);
var
thepos: integer;
fs: TFileStream;
Buffer: array[0..6] of char;
buffer2: array[0..3] of char;
i : integer;
version: string;
begin
version := '';
thepos := ScanFile('testfile.dat','AddD',true);
if thepos = -1 then showmessage('2232323');
fs := TFileStream.Create('testfile.dat', fmOpenReadWrite);
try
fs.Seek(thepos+8,soFromBeginning);
fs.ReadBuffer(Buffer,sizeof(Buffer));
version := version + Buffer;
finally
fs.free;
end;
version := version + '.';
if thepos = -1 then showmessage('2232323');
fs := TFileStream.Create('testfile.dat', fmOpenReadWrite);
try
fs.Seek(thepos+16,soFromBeginning);
fs.ReadBuffer(Buffer2,sizeof(Buffer2));
version := version + Buffer2;
finally
fs.free;
end;

showmessage(version);
end;