Board index » delphi » Search specific bytes in a EXE file?

Search specific bytes in a EXE file?

Is there any fast function or component can search specific bytes in a EXE
file? I tried compare byte by byte, but it's too slow!!

Please help!!

Thank in advance!

-----------== Posted via Deja News, The Discussion Network ==----------
http://www.dejanews.com/       Search, Read, Discuss, or Start Your Own    

 

Re:Search specific bytes in a EXE file?


hi,

you can use a TMemoryStream , works well.

var MyFile:TMemoryStream;

MyFile:=TMemoryStream.Create;
MyFile.LoadFromFile(.......);

and thats it :p , now you can use seek and read.

bye,

oliver.

Quote
yeet...@iname.com wrote:
> Is there any fast function or component can search specific bytes in a EXE
> file? I tried compare byte by byte, but it's too slow!!

> Please help!!

> Thank in advance!

> -----------== Posted via Deja News, The Discussion Network ==----------
> http://www.dejanews.com/       Search, Read, Discuss, or Start Your Own

Re:Search specific bytes in a EXE file?


Quote
In article <7ahbfu$e7...@nnrp1.dejanews.com>, yeet...@iname.com writes:
>Is there any fast function or component can search specific bytes in a EXE
>file? I tried compare byte by byte, but it's too slow!!

Use TMemoryStream - I typically looked through a 1.25Mb file for a 4 byte
string in about 1.5 seconds on a P100 48Mb Win95 with Delphi 2 without any
clever search techiques. I just read 4 bytes, compared, stepped back 3 bytes
and repeated until EOF.

 Is that too slow for you ?

Alan Lloyd
alangll...@aol.com

Re:Search specific bytes in a EXE file?


FYI, there is a far faster way of searching.

1) Let's say you're searching for a 4 byte string abcd (where a, b, c, and d
are any value) (set n to 4)

2) You first get byte#n,

3) if that is d, then you search backward (or however you decide to see if
the preceeding 4 bytes are abc (and if they are exit with a success)

4) if it's not d or if there's no match, then the string isn't these 4 bytes
(well, you got here -- right!).  You then use a lookup table to decide which
byte to look at next,
all bytes other than a, b, and c have the value 4 (length of search string)
(d will evaluate to 4 if it is present only once in the string)
bytes a, b, c, (and maybe d) have a value which is the distance between
their last occurrance and the end of the string (c = 1, b = 2, a = 3).  A
special case is d.  If it is in the string more than once, the value for it
is for the distance between the second last occurance and the end.

5) use the lookup to decide the offset to the next character you'll search
for. (n := n + offset)

6) if the next search pos is not the end of the string, go back to 2

This is an extremely efficient search technique for long strings, but can be
expanded to search for any objects, they need not be characters.  All you
need is some way to enumerate them and produce an array of possible values
that can be looked up VERY fast.

Just some interesting trivia from Steve :-)

Steve

p.s. I've used this to search for a 1024 byte array within an 80 million
byte array and it's surprisingly quick :-)

Quote
AlanGLLoyd wrote in message

<19990218164719.20272.00000...@ngol03.aol.com>...
Quote

>In article <7ahbfu$e7...@nnrp1.dejanews.com>, yeet...@iname.com writes:

>>Is there any fast function or component can search specific bytes in a EXE
>>file? I tried compare byte by byte, but it's too slow!!

>Use TMemoryStream - I typically looked through a 1.25Mb file for a 4 byte
>string in about 1.5 seconds on a P100 48Mb Win95 with Delphi 2 without any
>clever search techiques. I just read 4 bytes, compared, stepped back 3
bytes
>and repeated until EOF.

> Is that too slow for you ?

>Alan Lloyd
>alangll...@aol.com

Re:Search specific bytes in a EXE file?


In article <7ahbfu$e7...@nnrp1.dejanews.com>, yeet...@iname.com writes

Quote
>Is there any fast function or component can search specific bytes in a EXE
>file? I tried compare byte by byte, but it's too slow!!

Go to the Delphi Super Page (http://www.sunsite.icm.edu.pl/delphi) and
take a look at bmh111a.zip, written by Jody R. Cairns. Jody has written
a unit which searches a file using the Boyer-Moore-Horspool pattern
searching algorithm.

I use it in my apps to search for and store passwords in EXE files, and
it is _very_ fast (a lot faster than byte-by-byte comparisons).

HTH.
--
Steve Turner
Leeds, England

Other Threads