mirror of
https://github.com/radareorg/radare2.git
synced 2026-04-20 16:39:07 +02:00
Document and enforce the nibble mask search in rafind2 ##search
This commit is contained in:
@@ -1,4 +1,4 @@
|
||||
/* radare - LGPL - Copyright 2009-2025 - pancake */
|
||||
/* radare - LGPL - Copyright 2009-2026 - pancake */
|
||||
|
||||
#define R_LOG_ORIGIN "rafind2"
|
||||
|
||||
@@ -438,7 +438,7 @@ static int show_help(const char *argv0, int line) {
|
||||
" -q quiet: fewer output do not show headings or filenames.\n"
|
||||
" -v print version and exit\n"
|
||||
" -V [s:num | s:num1,num2] search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)\n"
|
||||
" -x [hex] search for hexpair string (909090) (can be used multiple times)\n"
|
||||
" -x [hex] search hexadecimal patterns. Inline nibble mask using `.` dots (94a2..34) (multiple keywords can be used)\n"
|
||||
" -X show hexdump of search results\n"
|
||||
" -z search for zero-terminated strings\n"
|
||||
" -Z show string found on each search hit\n");
|
||||
|
||||
@@ -509,38 +509,43 @@ R_API int r_hex_str2bin_until_new(const char *in, ut8 **out) {
|
||||
|
||||
R_API int r_hex_str2binmask(const char *in, ut8 *out, ut8 *mask) {
|
||||
R_RETURN_VAL_IF_FAIL (in && out && mask, -1);
|
||||
ut8 *ptr;
|
||||
int ilen = strlen (in) + 1;
|
||||
memcpy (out, in, ilen);
|
||||
for (ptr = out; *ptr; ptr++) {
|
||||
if (*ptr == '.') {
|
||||
*ptr = '0';
|
||||
char *kw = strdup (in);
|
||||
char *ms = strdup (in);
|
||||
if (!kw || !ms) {
|
||||
free (kw);
|
||||
free (ms);
|
||||
return -1;
|
||||
}
|
||||
char *k, *m;
|
||||
for (k = kw, m = ms; *k; k++, m++) {
|
||||
if (*k == '.') {
|
||||
*k = '0';
|
||||
*m = '0';
|
||||
} else if (IS_HEXCHAR (*k)) {
|
||||
*m = 'f';
|
||||
}
|
||||
}
|
||||
int len = r_hex_str2bin ((char*)out, out);
|
||||
bool has_nibble = false;
|
||||
if (len < 0) {
|
||||
has_nibble = true;
|
||||
len = -(len + 1);
|
||||
int klen = r_hex_str2bin (kw, out);
|
||||
int mlen = r_hex_str2bin (ms, mask);
|
||||
free (kw);
|
||||
free (ms);
|
||||
bool has_nibble = (klen < 0);
|
||||
if (klen < 0) {
|
||||
klen = -(klen + 1);
|
||||
}
|
||||
if (len != -1) {
|
||||
memcpy (mask, in, ilen);
|
||||
if (mlen < 0) {
|
||||
mlen = -(mlen + 1);
|
||||
}
|
||||
if (klen > 0) {
|
||||
if (mlen < klen) {
|
||||
memset (mask + mlen, 0xff, klen - mlen);
|
||||
}
|
||||
if (has_nibble) {
|
||||
memcpy (mask + ilen, "f0", 3);
|
||||
}
|
||||
for (ptr = mask; *ptr; ptr++) {
|
||||
if (IS_HEXCHAR (*ptr)) {
|
||||
*ptr = 'f';
|
||||
} else if (*ptr == '.') {
|
||||
*ptr = '0';
|
||||
}
|
||||
}
|
||||
len = r_hex_str2bin ((char*)mask, mask);
|
||||
if (len < 0) {
|
||||
len++;
|
||||
return -klen;
|
||||
}
|
||||
return klen;
|
||||
}
|
||||
return len;
|
||||
return -1;
|
||||
}
|
||||
|
||||
R_API st64 r_hex_bin_truncate(ut64 in, int n) {
|
||||
|
||||
@@ -81,7 +81,7 @@ Show version information
|
||||
.It Fl V Ar s:num | s:num1,num2
|
||||
Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)
|
||||
.It Fl x Ar hex
|
||||
Search for hexpair string (909090) (can be used multiple times)
|
||||
Search for hexpair string (909090) with optional nibble mask using dots (41.42) (can be used multiple times)
|
||||
.It Fl X
|
||||
Show hexdump of search results
|
||||
.It Fl z
|
||||
@@ -104,6 +104,11 @@ Search for a hex pattern in all the files from directory:
|
||||
$ rafind2 -x "909090" directory_path
|
||||
.Ed
|
||||
.Pp
|
||||
Search for hex pattern with nibble mask (dot masks single nibble):
|
||||
.Bd -literal -offset indent
|
||||
$ rafind2 -x "41.42" file.bin
|
||||
.Ed
|
||||
.Pp
|
||||
Identify the file type:
|
||||
.Bd -literal -offset indent
|
||||
$ rafind2 -i binary_file
|
||||
|
||||
Reference in New Issue
Block a user