Solved

Searching byte sequence in file. Problem with certain byte values

Posted on 2007-04-01
6
249 Views
Last Modified: 2010-05-18
Hello,

I'm coding a little utility that searches for a given byte sequence in a file. The source code is as follows:
#include "stdafx.h"
#include <fstream>
#include <iostream>
using namespace std;


int _tmain(int argc, _TCHAR* argv[])
{
      char readChar;
      unsigned char searchPattern[] = { 0xEB, 0x34, 0x54, 0x44 };
      fstream fileReader;
      fileReader.open("d:\\Development\\TestData\\test.txt", ios::in | ios::binary);
      
      cout << "Searching for pattern: ";
      for(int i = 0; i < sizeof(searchPattern); i++){
            printf("0x%x ", searchPattern[i]);
            
      }
      cout << endl;

      if(fileReader.is_open()){
            cout << "File opened" << endl;
            while(!fileReader.eof()){
                  fileReader.read(&readChar, sizeof(readChar));
                  printf("Current byte: 0x%x\n", readChar);

                  /*First byte of search pattern is found. Seek pointer in file is
                   *adjusted by -1. sizeof(searchPattern) bytes are read from that
                   *position and then compared to the searchPattern. If there is a
                   *match, the file-offset is saved. If no match, seek pointer is
                   *adjusted again to continue search
                  */
                  if(readChar == searchPattern[0]){
                        
                        char compareBuffer[sizeof(searchPattern)];
                        fileReader.seekg((int)fileReader.tellg()-1);                        
                        fileReader.read(compareBuffer, sizeof(compareBuffer));
                        bool match = true;
                        for(int i = 0; i < sizeof(compareBuffer); i++){
                              match = compareBuffer[i] == searchPattern[i];
                              if(!match){
                                    break;
                              }
                              printf("Byte match found: 0x%x for searchPattern byte %d\n", compareBuffer[i], i+1);
                        }
                        if(!match){
                              //No match, adjust file pointer
                              fileReader.seekg((int)fileReader.tellg() - sizeof(searchPattern) + 1);
                              cout << "No match, offset adjusted to: " << (int)fileReader.tellg()<< endl;

                        } else {
                              //Save file offset of match
                              cout << "Offset of first byte for match: " << (int)fileReader.tellg() - sizeof(searchPattern) << endl;

                        }
                  }
            }
      } else {
            cout << "Error opening file";
      }
      fileReader.close();
      return 0;
}

It works fine when searching for numbers and letters. But as soon as i put something like 0xEB into the search pattern, the pattern wont be found anymore, even the pattern is in my test file. Here is the output i get when running the tool on my test-file which includes the 0xEB byte:

Searching for pattern: 0xeb 0x34 0x54 0x4
File opened
Current byte: 0x67
Current byte: 0xffffffeb
Current byte: 0x38
Current byte: 0x37
Current byte: 0x32
Current byte: 0x38
Current byte: 0x37
Current byte: 0x36
Current byte: 0x38
Current byte: 0x36
Current byte: 0x38
Current byte: 0x37
Current byte: 0x67
Current byte: 0x66
Current byte: 0x68
Current byte: 0x67
Current byte: 0x66
Current byte: 0x68
Current byte: 0x67
Current byte: 0x6b
Current byte: 0x67
Current byte: 0x67
Current byte: 0x38
Current byte: 0xffffffeb
Current byte: 0xffffffeb

The problem seems to be that for the 0xEB bytes there are FFFFFF added. I dont know why this happens, can someone help me with this?
0
Comment
Question by:b3n_
  • 3
  • 2
6 Comments
 
LVL 11

Accepted Solution

by:
DeepuAbrahamK earned 30 total points
ID: 18834631
It 0xffffffff shows because it shows the full 4 bytes.
(Hex)0xffffffff = 11111111111111111111111111111111 (in binary)

Since you are using int, it will show full 4 bytes, make it to 'short i' or downcast it to  (short)

Best Regards,
DeepuAbrahamK
0
 
LVL 53

Assisted Solution

by:Infinity08
Infinity08 earned 20 total points
ID: 18834684
Try using unsigned char instead of char.
0
 
LVL 53

Expert Comment

by:Infinity08
ID: 18834713
Did DeepuAbrahamK's post help you ?

Changing i from int to short will not change anything for your problem as far as I can see ...

And short is usually 2 bytes, not 1 byte.
0
Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

 

Author Comment

by:b3n_
ID: 18834723
it helped because he pointed out the general problem. i gave you points too cause your solution helped me fix the program. maybe i should have given you some more points, sorry for that.
0
 
LVL 53

Expert Comment

by:Infinity08
ID: 18834787
No, that's not the reason I asked - I just wanted to make sure that you knew that using "short" will not fix the problem.

I wasn't critiquing the way you allocated points, because that's your decision - you alone know which posts helped you :)
0
 
LVL 11

Expert Comment

by:DeepuAbrahamK
ID: 18834932
b3n, I have overlooked that, I think you got my intension correctly.. Thanks
0

Featured Post

Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
java inner class, for the sole use of parameter passing 21 77
C++ get user from AD  (VS6) 7 72
Using Diagnostic tools in VS2015: Unresoved allocations 19 82
Safe conversion? 4 67
What is C++ STL?: STL stands for Standard Template Library and is a part of standard C++ libraries. It contains many useful data structures (containers) and algorithms, which can spare you a lot of the time. Today we will look at the STL Vector. …
Introduction This article is a continuation of the C/C++ Visual Studio Express debugger series. Part 1 provided a quick start guide in using the debugger. Part 2 focused on additional topics in breakpoints. As your assignments become a little more …
The viewer will learn how to clear a vector as well as how to detect empty vectors in C++.
The viewer will be introduced to the technique of using vectors in C++. The video will cover how to define a vector, store values in the vector and retrieve data from the values stored in the vector.

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now