Search/replacing data in a binary file?

[wallgod]

I was searching the PureBasic forums for a way to find and replace bytes in a binary file, but I haven't yet come across what I'm looking for. What is the best way to do this?

For example, functionality like this would be ideal:

Code: Select all

result.i = HexReplaceInFile("test.exe", "F606017415538D", "8026007415538D")

Converting strings to hex and back is not what I'm struggling with. What I'm finding difficult is handling a binary file in memory and search/replacing bytes. I am very new to PureBasic, so please excuse my n00bish question.

[netmaestro]

Always the same length?

[wallgod]

Yes, always the same length.

[netmaestro]

I didn't test it but this looks reasonable:

Code: Select all

length = 32 ; or whatever it is

*searchdata  = AllocateMemory(length)
*replacedata = AllocateMemory(length)
*testdata    = AllocateMemory(length)

;///////////////////////////////////////////////////////////
; Here place your search and replace data in the mem blocks 
;///////////////////////////////////////////////////////////

If OpenFile(0, "myfile.bin")
  readpos = 0
  thiseof = Lof(0) - length
  While (Not Eof(0)) And readpos <= thiseof
    FileSeek(0, readpos)
    ReadData(0, *testdata, length)
    If CompareMemory(*testdata, *searchdata, length)
      WriteData(readpos, *replacedata, length)
    EndIf
    readpos + 1
  Wend
  CloseFile(0)
EndIf

[wallgod]

Thank you, netmaestro. Much appreciated! However, I'm still a little confused on how to use this method. I understand the logic, but specifying what to look for and what to replace it with, is where I'm confused now. Would you mind giving me an example of how an actual search replace would look? I do have the HEXerTools library installed, if that helps.

[netmaestro]

Note that I fixed a typo which would cause it to fail. Afaik an actual example would look like this one here:

http://www.purebasic.fr/english/viewtop ... 76&start=3

[wallgod]

Note that I fixed a typo which would cause it to fail. Afaik an actual example would look like this one here:

http://www.purebasic.fr/english/viewtop ... 76&start=3

LOL, okay okay... I'll play with it. Point taken. Thanks again.

[wallgod]

I don't know how to place data into memory blocks.

Code: Select all

*searchdata = "hello"
*replacedata = "there"

returns the error "trying to write a string into a numerical variable"

Sigh... the embarrassment of being a n00b.

[rsts]

I don't know how to place data into memory blocks.

Code: Select all

*searchdata = "hello"
*replacedata = "there"

returns the error "trying to write a string into a numerical variable"

Sigh... the embarrassment of being a n00b.

Code: Select all

*searchdata = @"hello"
*replacedata = @"there"

cheers

[wallgod]

I don't know how to place data into memory blocks.

Code: Select all

*searchdata = "hello"
*replacedata = "there"

returns the error "trying to write a string into a numerical variable"

Sigh... the embarrassment of being a n00b.

Code: Select all

*searchdata = @"hello"
*replacedata = @"there"

cheers

Ahhh... merci! What does that @ actually mean?

[rsts]

When you set *searchdata = "hello" you're attempting to set the string "hello" as a memory address, thus the error.

setting *searchdata = @"hello" sets the memorypointer *searchdata to the location in memory of the string "hello" or @(the memory location of)"hello"

cheers

[wallgod]

When you set *searchdata = "hello" you're attempting to set the string "hello" as a memory address, thus the error.

setting *searchdata = @"hello" sets the memorypointer *searchdata to the location in memory of the string "hello" or @(the memory location of)"hello"

cheers

Oh okay, so if i set *searchdata = @"hello", it jumps to the first position in the memory block containing that string?

BTW, I tested this and it went very slowly and ultimately did not change anything in the file.

Code: Select all

Procedure.s AsciiToHex(binData$)
    tdata$ = Space(Len(binData$)*2)
    BinToHex(@binData$,Len(binData$),@tdata$,#False)
    ProcedureReturn tdata$
EndProcedure

Procedure.s HexToAscii(hexdata$)
    hdata$ = Space(Len(hexdata$))
    HexToBin(@hexdata$,Len(hexdata$),@hdata$)
    ProcedureReturn hdata$
EndProcedure

length = 7 ; or whatever it is

*searchdata  = AllocateMemory(length)
*replacedata = AllocateMemory(length)
*testdata    = AllocateMemory(length)

;///////////////////////////////////////////////////////////
*searchdata = @HexToAscii("F606017415538D")
*replacedata = @HexToAscii("8026007415538D")
MessageRequester("","get here?",#MB_OK)
;///////////////////////////////////////////////////////////

If OpenFile(0, "test.dll")
  readpos = 0
  thiseof = Lof(0) - length
  While (Not Eof(0)) And readpos <= thiseof
    FileSeek(0, readpos)
    ReadData(0, *testdata, length)
    If CompareMemory(*testdata, *searchdata, length)
      WriteData(readpos, *replacedata, length)
    EndIf
    readpos + 1
  Wend
  CloseFile(0)
EndIf

Any ideas? I'm sure the search string (in hex) is in the file.

[rsts]

Would need to see bin2hex and hex2bin as I'm not sure what's going on here.

May be some unnecessary or incorrect conversions occuring.

cheers

[wallgod]

I use HEXerTools for the hex stuff (bin2hex and hex2bin), and I've tested it to be working correctly, for normal strings at least. I'd be happy to use binary or some other approach. What do you folks suggest for this? Keep in mind the offset will not always be the same, so it would need to be a search/replace.

[cas]

Try this, i didn't tested it:

Code: Select all

ToFind$       = "F606017415538D"
ToReplace$    = "8026007415538D"

length        = Len(ToFind$)/2

*searchdata   = AllocateMemory(length)
*replacedata  = AllocateMemory(length)
*testdata     = AllocateMemory(length)

;///////////////////////////////////////////////////////////
; Here place your search and replace data in the mem blocks

For k=0 To length-1
  PokeB(*searchdata+k ,Val("$"+PeekS(@ToFind$+(k*2)   ,2)))
  PokeB(*replacedata+k,Val("$"+PeekS(@ToReplace$+(k*2),2)))
Next

;///////////////////////////////////////////////////////////

If OpenFile(0, "myfile.bin")
  readpos = 0
  thiseof = Lof(0) - length
  While (Not Eof(0)) And readpos <= thiseof
    FileSeek(0, readpos)
    ReadData(0, *testdata, length)
    If CompareMemory(*testdata, *searchdata, length)
      WriteData(0, *replacedata, length)
    EndIf
    readpos + 1
  Wend
  CloseFile(0)
EndIf