Reputation: 425
I have a udcli output that looks like these (Just assume that the commands perfectly makes sense, there were just made by random byte generator actually)
00000000000005b9 dc4753 fadd qword [edi+0x53]
00000000000005bc 226d9e and ch, [ebp-0x62]
00000000000005bf 81a4a495dc47ff4b and dword [esp-0xb8236b], 0xe0076b4b
-6b07e0
00000000000005ca e667 out 0x67, al
00000000000005cc 9acc27d432520f call dword 0xf52:0x32d427cc
Notice the 3rd-4th line on which there is an extra line that extends form the 3rd line.
Now, what I'm trying to do is to get the difference on the address of the next line to the previous line. I'm doing this by using my own awk script.
My problem is, when awk read the 3rd and 4th line, it gives me an output like these
3 dc4753 fadd qword [edi+0x53]
3 226d9e and ch, [ebp-0x62]
3 81a4a495dc47ff4b and dword [esp-0xb8236b],
-1471
1482 e667 out 0x67, al
2 9acc27d432520f call dword 0xf52:0x32d427cc
where the 1st column is size of the instruction (difference of 2 addresses)
Now my question is, how can I make awk ignore that particular line so it outputs properly. Is this possible with grep instead?
My current awk script
udcli file.out | awk 'BEGIN{getline; print "0\t" $2 "\t" $3 "\t" $4 "\t" $5; a = 0; b = strtonum("0x"$1);} {a = strtonum("0x"$1); print a - b "\t" $2 "\t" $3 "\t" $4 "\t" $5; b = a;}'
Upvotes: 0
Views: 59
Reputation: 15204
Hard to say for sure w/o seeing your actual awk-script, but something like this should help you on your way ...
awk '$1~/^000/' ...
Upvotes: 1