在Vim(或其他地方)中使用正则表达式搜索十六进制转储 [英] Searching through a hex dump using regex in Vim (or elsewhere)

问题描述

我正在寻找一种搜索一系列十六进制数字的文本表示形式的方法.我在二进制文件的十六进制转储中搜索，如下所示:

I’m looking for a way to search for the text representation of a series of hexadecimal numbers. I search in the hex dump of a binary file that looks like so:

0x000001A0: 36 5B 09 76 99 31 55 09 78 99 34 51 49 BF E0 03
0x000001B0: 28 0B 0A 03 0B E0 07 28 0B 0A 03 0B 49 58 09 35

问题在于模式可能会滚动到下一行.例如，在上面的两行中，我无法立即搜索03 28 0B，因为它跨越了两行.

The issue is that the pattern may roll over onto the next line. For instance, in the above two lines, I wouldn’t be able to immediately search for 03 28 0B because it spans two lines.

最近的帖子告诉我，正则表达式是一种解决方法，但是我不熟悉正则表达式，并且不知道使用什么:Notepad ++，Vim，Word或其他任何东西.

I have been told from recent posting that regex is the way to go, but I’m unfamiliar with it and do not know what to use: Notepad++, Vim, Word, or anything else.

:显示以上内容的文本文件是从二进制文件派生的，我可以使用记事本++.

EDIT 1: The text file that shows the above was derived from a binary file and I can use Notepad++.

例如，假设我正在尝试尽可能接近11:45:00(军事时间). 03 28 0B 0A 03 0B分散在上面的两行中，可以理解为"2011年3月10日第3秒40分钟11小时".我正在浏览此文件，试图找到距11:45:00的距离.

EDIT 2: To give an example, say I'm trying to get as close to 11:45:00 (military time) as possible. 03 28 0B 0A 03 0B scattered over the two lines above, can be read as "3 seconds, 40 minutes, 11 hours on the 10th day of March 2011". I'm looking to go through this file trying to find how close I can get to 11:45:00.

推荐答案

让我提出以下采用许多十六进制数字的映射 从用户输入或视觉选择中创建合适的图案，以及 开始搜索.

Let me propose the following mappings that take a number of hex digits from user input or visual selection, create appropriate pattern, and start a search for it.

nnoremap <silent> <expr> <leader>x/ SearchHexBytes('/', 0)
nnoremap <silent> <expr> <leader>x? SearchHexBytes('?', 0)
vnoremap <silent> <leader>x/ :call SearchHexBytes('/', 1)<cr>/<cr>
vnoremap <silent> <leader>x? :call SearchHexBytes('?', 1)<cr>?<cr>

function! SearchHexBytes(dir, vis)
    if a:vis
        let [qr, qt] = [getreg('"'), getregtype('"')]
        norm! gvy
        let s = @"
        call setreg('"', qr, qt)
    else
        call inputsave()
        let s = input(a:dir)
        call inputrestore()
    endif
    if s =~ "[^ \t0-9A-Fa-f]"
        echohl Error | echomsg 'Invalid hex digits' | echohl None
        return
    endif
    let @/ = join(split(s, '\s\+'), '\%(\s*\|\n0x\x\+:\s*\)')
    return a:dir . "\r"
endfunction

这篇关于在Vim(或其他地方)中使用正则表达式搜索十六进制转储的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！