search

digitalw0lf / hextor

Hextor - Hexadecimal editor and binary data analyzing toolkit
Other
100 stars 15 forks source link

Support wildcards when replacing #2

Closed qiufmgm closed 3 years ago

qiufmgm commented 3 years ago

First of all, thank you for developing this software.

Suggest to add features: Support wildcards when replacing.

tks.

digitalw0lf commented 3 years ago

I thought of something like that, but could not decide on a suitable syntax. Maybe like this:

In search pattern, every value in "{}" becomes a sub-expression. Values can be named by specifying an identifier after a type, e.g.: {u32 x: 0..99} Also, every sequense in round brackets "()" becomes a sub-expression. It may contain several "{}" values inside, e.g.: ({ansi:'a'..'z':1..100}{u8:0})

In "replace" pattern, one can use sub-expression in two ways: 1) By index, like in RegExp: $1, $2 etc. 2) By names: ${x}. It's possible to specify expressions with values, e.g: ${x+1} will increase found value

What do you think? Maybe you have some use cases which will give me new ideas.

(btw, first feedback on github. Glad to see)

qiufmgm commented 3 years ago

This is my idea: For example, if I want to find out "33 ?? ?? 35" and I want to replace it with "EE 33 ?? BB" . When writing to the file，Hextor does not care what byte is in the third position of Target hex values. My English is a little weak.

digitalw0lf commented 3 years ago

Ok, got it. In RegExp-like syntax, it will be possible using this patterns: "33 ?? (??) 35" -> "EE 33 $1 BB"

digitalw0lf commented 3 years ago

It's early to close. This is not implemented yet)

qiufmgm commented 3 years ago

In hexadecimal mode, it is recommended to use ‘??’ as a wildcard instead of sub-expression mode. Text mode can use sub-expression, hexadecimal mode use question mark.

In hexadecimal mode,Maybe like this: 6A 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? E8 -> EB 11 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? E8

digitalw0lf commented 3 years ago

Done. Docs: https://github.com/digitalw0lf/hextor/wiki/Search-and-replace#replacement-subexpression-substitution

An example from previous comment can be accomplished using:

Find 6A 00 (68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? E8), replace with EB 11 $1 or Find 6A 00 (68 {u8::4} 68 {u8::4} 6A 00 E8 {u8::4} E8), replace with EB 11 $1

Max-RM commented 5 months ago

Ok, got it. In RegExp-like syntax, it will be possible using this patterns: "33 ?? (??) 35" -> "EE 33 $1 BB"

can you make such a Hex pattern work too: ? example: 7? ?? B0 01 48 8? ?C 7? - where half of the byte is unknown.

digitalw0lf commented 5 months ago

can you make such a Hex pattern work too: ? example: 7? ?? B0 01 48 8? ?C 7? - where half of the byte is unknown.

Hello. Although not exactly like in your example, the same result can be achieved currently using the following syntax:

{u8:0x70..0x7F} ?? B0 01 48 {u8:0x80..0x8F} {u8:0x0C,0x1C,0x2C,0x3C,0x4C,0x5C,0x6C,0x7C,0x8C,0x9C,0xAC,0xBC,0xCC,0xDC,0xEC,0xFC}

Yes, I know it doesn't look very elegant. I'll keep it as a feature request for now.

@Max-RM Can you please tell a bit more about use cases when you need to search for something like ?C ?

Max-RM commented 5 months ago

can you make such a Hex pattern work too: ? example: 7? ?? B0 01 48 8? ?C 7? - where half of the byte is unknown.

Hello. Although not exactly like in your example, the same result can be achieved currently using the following syntax:

{u8:0x70..0x7F} ?? B0 01 48 {u8:0x80..0x8F} {u8:0x0C,0x1C,0x2C,0x3C,0x4C,0x5C,0x6C,0x7C,0x8C,0x9C,0xAC,0xBC,0xCC,0xDC,0xEC,0xFC}

Yes, I know it doesn't look very elegant. I'll keep it as a feature request for now.

@Max-RM Can you please tell a bit more about use cases when you need to search for something like ??C

Thanks for answer. About "use cases" it can help for searching Hex patterns with unknown half of byte.