NO

Author Topic: Is any algorithm to search binary strings?  (Read 236 times)

Offline bitcoin

  • Member
  • *
  • Posts: 133
Is any algorithm to search binary strings?
« on: June 11, 2021, 10:57:37 pm »
Hello,

Are any public algorithm to find binary pattern (string)? As example - I wan't to find string "\x55\x8B\xEC\x90\x90" in PE file, strstr don't works.

Online Grincheux

  • Member
  • *
  • Posts: 321
  • Never be pleased, always improve
    • Arachne
« Last Edit: June 11, 2021, 11:36:25 pm by Grincheux »
-------------------------
Kenavo / Bye

Offline Vortex

  • Member
  • *
  • Posts: 552
    • http://www.vortex.masmcode.com
Re: Is any algorithm to search binary strings?
« Reply #2 on: June 12, 2021, 10:47:19 am »
Hi bitcoin,

Grincheux is right, the Boyer Moore Algorithms can do the job. Here are some procedures provided by the Masm32 package :

Quote
Boyer Moore Algorithms

BMBinSearch proc startpos:DWORD,
                 lpSource:DWORD,srcLngth:DWORD,
                 lpSubStr:DWORD,subLngth:DWORD

BMHBinsearch proc startpos:DWORD,
                  lpSource:DWORD,srcLngth:DWORD,
                  lpSubStr:DWORD,subLngth:DWORD

SBMBinSearch proc startpos:DWORD,
                  lpSource:DWORD,srcLngth:DWORD,
                  lpSubStr:DWORD,subLngth:DWORD


Description

The three algorithms are variations of a Boyer Moore binary search design that is well suited for very high speed searching of binary or text data for a subpattern.


Parameters

1. startpos Zero based start address to nominate where to start searching.
2. lpSource The address of the data to be searched.
3. srcLngth The length of the search data.
4. lpSubStr The address of the pattern to search for.
5. subLngth The length of the pattern to search for.

Code it... That's all...

Offline Vortex

  • Member
  • *
  • Posts: 552
    • http://www.vortex.masmcode.com
Re: Is any algorithm to search binary strings?
« Reply #3 on: June 12, 2021, 11:29:05 am »
Hi bitcoin,

Here is a quick example for you :

Code: [Select]
#include <stdio.h>

extern int __stdcall BMBinSearch(int,char *,int,char *,int);

int main(void)
{
char s[]={0x1,0x2,0x4,0x10,0x3,0x0,0x5,0x6,0x12};
char t[]={0x3,0x0,0x5};
int u;
u=BMBinSearch(2,s,9,t,3);
printf("Zero based offset of the pattern 0x3,0x0,0x5 = %d",u);
}

Code it... That's all...

Offline Pelle

  • Administrator
  • Member
  • *****
  • Posts: 2139
    • http://www.smorgasbordet.com
Re: Is any algorithm to search binary strings?
« Reply #4 on: June 12, 2021, 12:20:34 pm »
If you just want a "KISS" C solution, something like this should work too...

Code: [Select]
void *memstr(const void *memptr, size_t memlen, const char *strptr)
{
    if (*strptr == '\0')
        return (void *)memptr;

    size_t patlen = strlen(strptr), len;
    const unsigned char *pat = (const unsigned char *)strptr;
    const unsigned char *ptr = memptr;
    const unsigned char *end = ptr + memlen - patlen + 1;

    for (;;)
    {
        for ( ; ptr < end && *ptr != *pat; ++ptr)
            ;

        if (ptr == end)
            break;

        for (len = 1; len < patlen && ptr[len] == pat[len]; ++len)
            ;
        if (len == patlen)
            return (void *)ptr;

        ++ptr;
    }

    return NULL;
}
/Pelle

Offline bitcoin

  • Member
  • *
  • Posts: 133
Re: Is any algorithm to search binary strings?
« Reply #5 on: June 12, 2021, 02:01:55 pm »
Thank you! All works!