The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.
|
 |
|
Dev Shed Forums
> Programming Languages
> C Programming
|
searching hex code pattern in buffer.
Discuss searching hex code pattern in buffer. in the C Programming forum on Dev Shed. searching hex code pattern in buffer. C programming forum discussing all C derivatives, including C#, C++, Object-C, and even plain old vanilla C. These languages are low level languages, and used on projects such as device drivers, compilers, and even whole computer operating systems.
|
|
 |
|
|
|
|

Dev Shed Forums Sponsor:
|
|
|

February 12th, 2004, 08:26 AM
|
|
Registered User
|
|
Join Date: Dec 2003
Posts: 14
Time spent in forums: < 1 sec
Reputation Power: 0
|
|
|
searching hex code pattern in buffer.
Hi,
I'm trying to find a hex code pattern in a memory buffer, this pattern has no absolute offset location so I have to search the entire buffer for the pattern.
I would like to know is there an existing function for c/c++ that does this ? so I don't have to re-invent the wheel.
thnx...
P.S
If there isn't an existing function, any suggestions on how to actually do this ? searching a string in a string buffer is simple but I've never tried a hex pattern search.
|

February 12th, 2004, 09:03 AM
|
 |
I'm Baaaaaaack!
|
|
Join Date: Jul 2003
Location: Maryland
|
|
|
Are you looking for the binary data and setting the search by giving the compiler/program a value in hex or is there a hex string embedded in your string? One way is a binary search the other is a string search. Since they are looking for completely different things it is critical to know the difference. The actual search mechanism can be exactly the same, you have one array of values that you are searching for and another array in which you search for it. There are probably library functions to do this sort of thing (strstr comes to mind), but it should be trivial to write your own. The binary versions will require knowledge of the length of the search array and the target array, the string version can rely on NULL termination.
|

February 12th, 2004, 04:37 PM
|
|
Registered User
|
|
Join Date: Dec 2003
Posts: 14
Time spent in forums: < 1 sec
Reputation Power: 0
|
|
|
binary search.
I'm trying to do a binary search. I can attempt to write a function to do it which shouldn't be too hard, but before I attempt to re-invent the wheel I just like to know is there a predefine function somewhere that actually does this already, preferally optimised for speed. Maybe inline ASM ? (I don't know ASM so can't optimise the code if I wrote it in C)
Speed is the critical issue in the search routine.
|

February 12th, 2004, 05:18 PM
|
 |
I'm Baaaaaaack!
|
|
Join Date: Jul 2003
Location: Maryland
|
|
|
It is always critical to first get the algorithm working, then worry about optimization. For instance, if you are processing network packets or reading from a file or database, it may be that your program is actually waiting all the time for input and the search is not the bottle neck. Why waste time optimizing code that won't improve your program's run time?
I don't know of any search algorithms that are part of the C standard libs, but there may be some that are a regular part of most distributions. I am much less familiar with what is available in C++, but as I said, it should be easy enough to write one and if you find you really need better performance you can always post what you have written here. I am a speed freak and enjoy the challenge of optimization so would be happy to try to help.
|

February 12th, 2004, 06:53 PM
|
|
Registered User
|
|
Join Date: Dec 2003
Posts: 14
Time spent in forums: < 1 sec
Reputation Power: 0
|
|
|
sample code.
I'm actually trying to process network packets. Basically looking at packets and finding a certain hex pattern to identify what kind of protocol it's using. (OSCAR (ICQ/AIM) for example).
Here's a sample code what I tried,
//============================================
// Returns zero-based offset to the key
// inside buffer or -1 if not found
int FindMem (
void* pBuf, /* Buffer where to search */
void* pFindThis, /* Points to the key to look for */
int iBufLen, /* How many bytes in 'pBuf' */
int iKeyLen /* How many bytes in 'pFindThis' */ )
{
int iOfs;
int iAttempts;
char* pScanBuf = (char*) pBuf;
if ((iAttempts = 1 + (iBufLen - iKeyLen)) > 0) {
iOfs = 0;
while (iAttempts--) {
if (memcmp (pScanBuf++, pFindThis, iKeyLen) == 0) {
return iOfs;
}
iOfs++;
}
}
return -1;
}
//============================================
See any way to optimise it ? find any bugs ?
With speed considerations I actually need to search in the packet payload for a parttern, and there's 1000's of patterns. This doesn't mean it has to search 1000's of times, the search will stop once a match is made.
|

February 12th, 2004, 07:36 PM
|
 |
I'm Baaaaaaack!
|
|
Join Date: Jul 2003
Location: Maryland
|
|
Please use "code" tags!
This is a bit more terse:
Code:
#include <stdio.h>
#include <string.h>
int FindMem2(char* pBuf, /* Buffer where to search */
char* pFindThis,/* Points to the key to look for */
int iBufLen, /* How many bytes in 'pBuf' */
int iKeyLen /* How many bytes in 'pFindThis' */ ) {
int i=0, max;
if (iKeyLen < iBufLen)//expected
max = iBufLen - iKeyLen + 1;
else//just in case
return -1;
while (i<max) {
if (!memcmp(&pBuf[i], pFindThis, iKeyLen))
return i;
i++;
}
return -1;
}
int main(){
char *target1 = "this is the target string, find me";
char *find1 = "find me";
char target2[28] = {0x1,0x2,0x3,0x4,0x5,0x6,0x7,0x8,0x9,0x0,0x9,0x8,0x7,0x6,0x5,0x4,0x3,0x2,0x11,0x22,0x33,0x44,0x55,0x 66,0x77,0x45, 0xff, 0xab};
char find2[3] = {0x7,0x6,0x5};
int retVal;
retVal = FindMem2(target1, find1, strlen(target1), strlen(find1));
if (retVal > -1){
printf("FindMem2 Found string at index %d\n", retVal);
}else{
printf("FindMem2 Couldn't find match or error condition\n");
}
retVal = FindMem2(target2, find2, 28, 3);
if (retVal > -1){
printf("FindMem2 Found binary at index %d\n", retVal);
}else{
printf("FindMem2 Couldn't find binary match or error condition\n");
}
return 0;
}
|
Developer Shed Advertisers and Affiliates
| Thread Tools |
Search this Thread |
|
|
|
| Display Modes |
Rate This Thread |
Linear Mode
|
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
|
|