AOB / pattern / signature scan to get offsets // is it possible?

0 votes
asked Jun 1, 2018 in Hexinator by christian (120 points)
recategorized Jun 5, 2018 by christian

Hi, I just bought Hexinator and I really like it. I working with ~90 MB data files. I already found the area in the file where the needed data is stored (behind the headers and setup stuff I do not need).

The data start offset is different from data file to data file (there are user defined fields before that are terminated with 00 00 (UTF-16LE), so always different length, also other bytes I have not understood by now)... But before the data offset I always have the same signature of bytes.

  • Title says it all... Is it possible?
  • Do an AOB scan and get the offset?
  • Maybe the LUA interpreter has this on-board?

1 Answer

0 votes
answered Jun 17, 2018 by andreas (2,180 points)

For example the JPEG grammar includes a script that scans for a certain value.

You can also have a look at the HexStringLength scripted data type referenced here: scripts.html

In general you can call the same built-in functions with Lua or Python however Python is better when dealing with bit operations.

So yes: it's definitely possible. Please let me know if you need additional assistance.