Skip to content

Commit ac359f8

Browse files
committed
Accept lone '?' as full-byte wildcard in FlexHex search.
1 parent 23f619a commit ac359f8

1 file changed

Lines changed: 14 additions & 4 deletions

File tree

python/binaryview.py

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10090,11 +10090,13 @@ def search(self, pattern: str, start: Optional[int] = None, end: Optional[int] =
1009010090
limit: Optional[int] = None, progress_callback: Optional[ProgressFuncType] = None, match_callback: Optional[DataMatchCallbackType] = None) -> QueueGenerator:
1009110091
r"""
1009210092
Searches for matches of the specified ``pattern`` within this BinaryView with an optionally provided address range specified by ``start`` and ``end``.
10093-
This is the API used by the advanced binary search UI option. The search pattern can be interpreted in various ways:
10093+
This is the API used by the advanced binary search UI option. The pattern is interpreted as one of:
1009410094
10095-
- specified as a string of hexadecimal digits where whitespace is ignored, and the '?' character acts as a wildcard
10096-
- a regular expression suitable for working with bytes
10097-
- or if the ``raw`` option is enabled, the pattern is interpreted as a raw string, and any special characters are escaped and interpreted literally
10095+
- ``"FlexHex"``: a sequence of byte tokens drawn from ``[0-9a-fA-F?]``, where ``??`` (or a whitespace-separated lone ``?``) is a full-byte wildcard and ``?X`` / ``X?`` matches a single nibble. Whitespace between byte tokens is optional, but a lone ``?`` must be whitespace-separated (so ``c3 ? 55`` is valid; ``c3?55`` is not).
10096+
- ``"Regex"``: a byte-level regular expression.
10097+
- ``"Raw String"``: a literal string match. Used when ``raw=True``, or as a fallback when the pattern is neither valid FlexHex nor a valid regex.
10098+
10099+
Use :py:meth:`detect_search_mode` to check which mode would be selected for a given pattern.
1009810100
1009910101
:param pattern: The pattern to search for.
1010010102
:type pattern: :py:class:`str`
@@ -10122,6 +10124,8 @@ def search(self, pattern: str, start: Optional[int] = None, end: Optional[int] =
1012210124
<BinaryView: '/bin/ls', start 0x100000000, len 0x182f8>
1012310125
>>> bytes(list(bv.search("50 ?4"))[0][1]).hex()
1012410126
'5004'
10127+
>>> bytes(list(bv.search("E8 ? ? ? ?"))[0][1]).hex() # call with 4-byte wildcard operand
10128+
'e83e380000'
1012510129
>>> bytes(list(bv.search("[\x20-\x25][\x60-\x67]"))[0][1]).hex()
1012610130
'2062'
1012710131
"""
@@ -10176,6 +10180,12 @@ def detect_search_mode(pattern: str, raw: bool = False) -> str:
1017610180
"""
1017710181
Detects the search mode that would be used by :py:meth:`search` for the given pattern.
1017810182
10183+
The mode is one of:
10184+
10185+
- ``"FlexHex"``: a sequence of byte tokens drawn from ``[0-9a-fA-F?]``, where ``??`` (or a whitespace-separated lone ``?``) is a full-byte wildcard and ``?X`` / ``X?`` matches a single nibble. Whitespace between byte tokens is optional, but a lone ``?`` must be whitespace-separated (so ``c3 ? 55`` is valid; ``c3?55`` is not).
10186+
- ``"Regex"``: a byte-level regular expression.
10187+
- ``"Raw String"``: a literal string match. Returned when ``raw=True``, or as a fallback when the pattern is neither valid FlexHex nor a valid regex.
10188+
1017910189
:param str pattern: The search pattern to analyze.
1018010190
:param bool raw: Whether to interpret the pattern as a raw string (default: False).
1018110191
:return: The detected search mode: ``"FlexHex"``, ``"Regex"``, or ``"Raw String"``.

0 commit comments

Comments
 (0)