我正在尝试在二进制文件中搜索一系列十六进制值，但是，我遇到了一些我无法完全解决的问题。 (1) 我不确定如何搜索整个文件并返回所有匹配项。目前，我的 f.seek 仅在我认为可能的值(value)范围内运行，这并不好。 (2) 我想返回可能匹配的十进制或十六进制的偏移量，尽管我每次都得到 0，所以我不确定我做错了什么。
example.bin
AA BB CC DD EE FF AB AC AD AE AF BA BB BC BD BE
BF CA CB CC CD CE CF DA DB DC DD DE DF EA EB EC
代码:
# coding: utf-8
import struct
import re
with open("example.bin", "rb") as f:
f.seek(30)
num, = struct.unpack(">H", f.read(2))
hexaPattern = re.compile(r'(0xebec)?')
m = re.search(hexaPattern, hex(num))
if m:
print "found a match:", m.group(1)
print " match offset:", m.start()
也许有更好的方法来完成这一切？
请您参考如下方法:
- I'm not sure how to search the entire file and return all the matches.
- I'd like to return the offset in either decimal or hex
import re
f = open('data.txt', 'wb')
f.write('\xAA\xBB\xEB\xEC')
f.write('\xAA\xBB\xEB\xEC')
f.write('\xAA\xBB\xEB\xEC')
f.write('\xAA\xBB\xEB\xEC')
f.write('\xAA\xBB\xEB\xEC')
f.write('\xAA\xBB\xEB\xEC')
f.write('\xAA\xBB\xEB\xEC')
f.close()
f = open('data.txt', 'rb')
data = f.read()
f.close()
pattern = "\xEB\xEC"
regex = re.compile(pattern)
for match_obj in regex.finditer(data):
offset = match_obj.start()
print "decimal: {}".format(offset)
print "hex(): " + hex(offset)
print 'formatted hex: {:02X} \n'.format(offset)
--output:--
decimal: 2
hex(): 0x2
formatted hex: 02
decimal: 6
hex(): 0x6
formatted hex: 06
decimal: 10
hex(): 0xa
formatted hex: 0A
decimal: 14
hex(): 0xe
formatted hex: 0E
decimal: 18
hex(): 0x12
formatted hex: 12
decimal: 22
hex(): 0x16
formatted hex: 16
decimal: 26
hex(): 0x1a
formatted hex: 1A
文件中的位置像列表一样使用基于 0 的索引。
e.finditer(pattern, string, flags=0)
Return an iterator yielding MatchObject instances over all non-overlapping matches for the RE pattern in string. The string is scanned left-to-right, and matches are returned in the order found.Match objects support the following methods and attributes:
start([group])
end([group])
Return the indices of the start and end of the substring matched by group; group defaults to zero (meaning the whole matched substring).
