AOB / pattern / signature scan to get offsets // is it possible?

Question

Hi, I just bought Hexinator and I really like it. I working with ~90 MB data files. I already found the area in the file where the needed data is stored (behind the headers and setup stuff I do not need).

The data start offset is different from data file to data file (there are user defined fields before that are terminated with 00 00 (UTF-16LE), so always different length, also other bytes I have not understood by now)... But before the data offset I always have the same signature of bytes.

• Title says it all... Is it possible?
• Do an AOB scan and get the offset?
• Maybe the LUA interpreter has this on-board?

Answer 1

For example the JPEG grammar includes a script that scans for a certain value.

You can also have a look at the HexStringLength scripted data type referenced here: scripts.html

In general you can call the same built-in functions with Lua or Python however Python is better when dealing with bit operations.

So yes: it's definitely possible. Please let me know if you need additional assistance.