CODEWITHSUNDEEP
c#bytearrayspattern-matching
user556396
user556396

Reputation: 597

Get all occurrences of a byte pattern with varying bytes from a byte array?

How can I match a byte array to a larger byte array and get the unique data and the location in the byte array that the pattern ends?

FF FF FF FF XX XX XX XX FF FF FF FF (any length of any bytes goes here) 2E XX XX XX 00

I have the above pattern (where XX is any byte) and i need to get bolded parts plus the location in the array of the last byte, How can I do this? (note: I need to get all occurrences of this pattern)

I cannot convert it to a string as it has null bytes (0x00) and they are often part of the first four XX XX XX XX bytes.

I've been trying to figure this out for a while now and would appreciate it if you guys could help me out! Thanks.

Edit: the above bytes are in hex

Upvotes: 0

Views: 1143

Answers (1)

Jim Mischel
Jim Mischel

Reputation: 133995

Who says you can't convert it to a string?

byte[] bytes = new byte[]
{
    0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x31, 0x32, 0x33, 0x34, 0xff, 0x2a, 0x00
};
var s = Encoding.Default.GetString(bytes);
Console.WriteLine(bytes.Length);
Console.WriteLine(s.Length);
foreach (var c in s)
{
    Console.Write("0x{0:X2}, ", (int)c);
}
Console.WriteLine();

Both the array and the string are shown with a length of 13. And the bytes output from the string are the same as the bytes in the array.

You can convert it to a string. Then you can use regular expressions to find what you're looking for.

Note that Encoding.Default might not be what you're looking for. You want an 8-bit encoding that doesn't modify any of the characters.

But if you want an algorithmic way to do it, there are a couple of ways that spring to mind. First way (and probably easiest) is to scan forward looking for 2E followed by three bytes, and then a 00. Then start at the beginning again and see if you find FF FF FF FF XX XX XX XX FF FF FF FF. That's not the fastest way to do things, but it's pretty easy.

Note that if you search backwards from the 2E, you could end up "finding" a shorter string. That is, if your input was:

FF FF FF FF XX XX XX XX FF FF FF FF 01 02 FF FF FF FF XX XX XX XX FF FF FF FF 0A 0B 2E XX XX XX 00

There are two occurrences of the starting pattern. If you searched backwards from the 2E, you'd match the second one, which probably isn't what you want.

The other way is to build yourself a little state machine that searches forward. That'll be faster, but a bit more difficult.

Upvotes: 2

Related Questions