Document and enforce the nibble mask search in rafind2 ##search

This commit is contained in:
pancake
2026-02-06 16:33:12 +01:00
committed by GitHub
parent cc3ef10024
commit 83fbbf1c8f
3 changed files with 39 additions and 29 deletions

View File

@@ -1,4 +1,4 @@
/* radare - LGPL - Copyright 2009-2025 - pancake */
/* radare - LGPL - Copyright 2009-2026 - pancake */
#define R_LOG_ORIGIN "rafind2"
@@ -438,7 +438,7 @@ static int show_help(const char *argv0, int line) {
" -q quiet: fewer output do not show headings or filenames.\n"
" -v print version and exit\n"
" -V [s:num | s:num1,num2] search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)\n"
" -x [hex] search for hexpair string (909090) (can be used multiple times)\n"
" -x [hex] search hexadecimal patterns. Inline nibble mask using `.` dots (94a2..34) (multiple keywords can be used)\n"
" -X show hexdump of search results\n"
" -z search for zero-terminated strings\n"
" -Z show string found on each search hit\n");

View File

@@ -509,38 +509,43 @@ R_API int r_hex_str2bin_until_new(const char *in, ut8 **out) {
R_API int r_hex_str2binmask(const char *in, ut8 *out, ut8 *mask) {
R_RETURN_VAL_IF_FAIL (in && out && mask, -1);
ut8 *ptr;
int ilen = strlen (in) + 1;
memcpy (out, in, ilen);
for (ptr = out; *ptr; ptr++) {
if (*ptr == '.') {
*ptr = '0';
char *kw = strdup (in);
char *ms = strdup (in);
if (!kw || !ms) {
free (kw);
free (ms);
return -1;
}
char *k, *m;
for (k = kw, m = ms; *k; k++, m++) {
if (*k == '.') {
*k = '0';
*m = '0';
} else if (IS_HEXCHAR (*k)) {
*m = 'f';
}
}
int len = r_hex_str2bin ((char*)out, out);
bool has_nibble = false;
if (len < 0) {
has_nibble = true;
len = -(len + 1);
int klen = r_hex_str2bin (kw, out);
int mlen = r_hex_str2bin (ms, mask);
free (kw);
free (ms);
bool has_nibble = (klen < 0);
if (klen < 0) {
klen = -(klen + 1);
}
if (len != -1) {
memcpy (mask, in, ilen);
if (mlen < 0) {
mlen = -(mlen + 1);
}
if (klen > 0) {
if (mlen < klen) {
memset (mask + mlen, 0xff, klen - mlen);
}
if (has_nibble) {
memcpy (mask + ilen, "f0", 3);
}
for (ptr = mask; *ptr; ptr++) {
if (IS_HEXCHAR (*ptr)) {
*ptr = 'f';
} else if (*ptr == '.') {
*ptr = '0';
}
}
len = r_hex_str2bin ((char*)mask, mask);
if (len < 0) {
len++;
return -klen;
}
return klen;
}
return len;
return -1;
}
R_API st64 r_hex_bin_truncate(ut64 in, int n) {

View File

@@ -81,7 +81,7 @@ Show version information
.It Fl V Ar s:num | s:num1,num2
Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)
.It Fl x Ar hex
Search for hexpair string (909090) (can be used multiple times)
Search for hexpair string (909090) with optional nibble mask using dots (41.42) (can be used multiple times)
.It Fl X
Show hexdump of search results
.It Fl z
@@ -104,6 +104,11 @@ Search for a hex pattern in all the files from directory:
$ rafind2 -x "909090" directory_path
.Ed
.Pp
Search for hex pattern with nibble mask (dot masks single nibble):
.Bd -literal -offset indent
$ rafind2 -x "41.42" file.bin
.Ed
.Pp
Identify the file type:
.Bd -literal -offset indent
$ rafind2 -i binary_file