Re: Searching binary data

[Juerd]

my $match = pack 'H*', 
            '53005f00560045005200530049004f004e005f004' .
            '9004e0046004f0000000000bd04effe00000100';

open (FILE, 'foo') or die $!;
while (<FILE>) {
    print "Found: $1, $2, $3, $4\n"
        while s/$match(\S{4})(\S{4})(\S{4})(\S{4})/;
}
close FILE;

(Warning: untested code.)

U28geW91IGNhbiBhbGwgcm90MTMgY
W5kIHBhY2soKS4gQnV0IGRvIHlvdS
ByZWNvZ25pc2UgQmFzZTY0IHdoZW4
geW91IHNlZSBpdD8gIC0tIEp1ZXJk

[theorbtwo]

I think you want ".", rather then "\S" in your regex. Also, I think your matching code will miss cases where there is more then one match per line.

However, the basic idea of packing is exactly what you want. You also probably want to use ord and printf %x to print your results in hex. (or unpack).

---

We are using here a powerful strategy of synthesis: wishful thinking. -- The Wizard Book

[Juerd]

I think you want ".", rather then "\S" in your regex

I copied that from the original post. I have no idea what sort of file is being used.

Also, I think your matching code will miss cases where there is more then one match per line.

The inner while (the statement modifier) takes care of that.

U28geW91IGNhbiBhbGwgcm90MTMgY
W5kIHBhY2soKS4gQnV0IGRvIHlvdS
ByZWNvZ25pc2UgQmFzZTY0IHdoZW4
geW91IHNlZSBpdD8gIC0tIEp1ZXJk

[theorbtwo]

Whoops, missed the statement modifer while; reading code too quickly while doing other things at the same time.

As to using \S vs ., in your code it's matching arbitrary random data. In his, it's maching hex, so it's known nonspace.

---

We are using here a powerful strategy of synthesis: wishful thinking. -- The Wizard Book

[Shendal]

After some coersion, your response led me down the proper path. Here's my updated code snippet:

my $match = pack 'H*',
            '53005f00560045005200530049004f004e005f004' .
            '9004e0046004f0000000000bd04effe00000100';
open(FILE,$file) or die $!;
while (<FILE>) {
  if (/$match(\S{2})(\S{2})(\S{2})(\S{2})/) {
    print "Found match!";
    print join('.',map {unpack 'H*',$_; } ($1,$2,$3,$4);
  }
}
close(FILE);

I think my confusion rested in how perl would handle a binary file. Seems that the DWIM held true... I was making it harder than it was.

Thanks for your help!

Cheers,
Shendal