|
hi am using FileStream(paths, FileMode.Open, FileAccess.ReadWrite) to find a certain hex value in a file
but what i need to know is the address of the hex value in hex ie 000001FF
how do i do this ,code below works at finding the hex value
Dim fs As New FileStream(paths, FileMode.Open, FileAccess.ReadWrite)
Dim b As Integer = fs.ReadByte()
While b <> -1
If b = &HF Then
fs.Seek(-1, SeekOrigin.Current)
MsgBox("Values Found at Address")
'fs.WriteByte(&H69)
End
banging my head on my desk |
| tangomouse Sunday, October 18, 2009 1:06 PM |
This will put in a list box all the addresses in Notepad.exe where the byte &H85 are found
Imports System.IO
Public Class Form1
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Dim dump As New FileDump
Dim Buffer() As Byte = dump.Read("c:\Windows\notepad.exe")
For x As Integer = 0 To Buffer.Count - 1
If Buffer(x) = &H85 Then
ListBox1.Items.Add("&H" & Hex(x))
End If
Next
End Sub
End Class
Public Class FileDump : Inherits FileIO.FileSystem
Public Function Read(ByVal fName As String) As Byte()
Return ReadAllBytes(fName)
End Function
End Class
- Marked As Answer bytangomouse Sunday, October 18, 2009 11:34 PM
-
|
| Crazypennie Sunday, October 18, 2009 10:06 PM |
What do you mean by "the address of the hex value" ?
|
| Crazypennie Sunday, October 18, 2009 6:51 PM |
as in lets say i am searching a file for hex value &HFF , i need to know the location of the said value and if the location of the value is not the one am looking for then continue untill i find the hex val at a said location ,dont know if this makes any sense
tbh i have got another problem ,i need to find a group of hex values ,"&H0F,&H85,&H90" so my above code dont work ,ive tried to get the 3 hex values as a string
all i want to do is find this in a file "0F8590" but its hex
i have a head ache !
|
| tangomouse Sunday, October 18, 2009 8:23 PM |
Still not sure of what you want... Do you want to know on which line and at what caractere position in this line the hex number can be found in the file ? If yes, this code is an exemple of that
Imports System.IO
Public Class Form1
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Dim SR As StreamReader = New StreamReader("TestFile.txt")
Dim Line As String
Dim L, C As Integer
L = 0
Do
L = L + 1
Line = SR.ReadLine()
If Line.Contains("&H85") Then
C = Line.IndexOf("&H85") + 1
ListBox1.Items.Add("&H85 was found in the line " & L & "and at the caractere position " & C)
End If
Loop Until Line Is Nothing
sr.Close()
End Sub
End Class
|
| Crazypennie Sunday, October 18, 2009 8:48 PM |
ok ill try to clear this up
below is a screen shot of a hex editor ,i have highlighted the hex i want to find "not the exact one but will do"
http://i35.tinypic.com/xfzgi.png
as you can see arrow points to the address or location of that hex ,i want to find that hex and change it but there will most likely be several of the same hex`s ,but i just want the one at such n such ,tried your code and got a nullreferance exception at this "If Line.Contains("&H85") Then"
|
| tangomouse Sunday, October 18, 2009 9:24 PM |
i need to know the location of the said value and if the location of the value is not the one am looking for then continue untill i find the hex val at a said location ,dont know if this makes any sense
No it doesn't. If you want to see if the value at a specific location is something why don't you just look at that location instead of searching for all values of "something" |
| Dave299 Sunday, October 18, 2009 9:28 PM |
No CP, the poster wants to know the address where the value is of the hex is located.
I don't think you'll be able to use it because the absolute address changes and moves around in a NET like fashion.
Renee |
| Renee Culver Sunday, October 18, 2009 9:31 PM |
No CP, the poster wants to know the address where the value is of the hex is located.
I don't think you'll be able to use it because the absolute address changes and moves around in a NET like fashion.
Renee
yup u got it i have a head ache ,and cant think straight ,maybe if i sleep on it ill find the answer |
| tangomouse Sunday, October 18, 2009 9:35 PM |
This will put in a list box all the addresses in Notepad.exe where the byte &H85 are found
Imports System.IO
Public Class Form1
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Dim dump As New FileDump
Dim Buffer() As Byte = dump.Read("c:\Windows\notepad.exe")
For x As Integer = 0 To Buffer.Count - 1
If Buffer(x) = &H85 Then
ListBox1.Items.Add("&H" & Hex(x))
End If
Next
End Sub
End Class
Public Class FileDump : Inherits FileIO.FileSystem
Public Function Read(ByVal fName As String) As Byte()
Return ReadAllBytes(fName)
End Function
End Class
- Marked As Answer bytangomouse Sunday, October 18, 2009 11:34 PM
-
|
| Crazypennie Sunday, October 18, 2009 10:06 PM |
thank you.!!! worked a treat ,a little modification found the correct address. in decimal it is 1915 where the 3 hex values start
For x As Integer = 0 To Buffer.Count - 1
If Buffer(x) = &HF Then
If Buffer(x + 1) = &HBB Then
If Buffer(x + 2) = &H9 Then
address = "&H" & Hex(x) & " Location in decimal " + Str(x)
ListBox1.Items.Add(address)
End If
End If
End If
Next
just one question does Dim buffer() as byte = dump.read("app") load the full contents of the file? if so could i use StreamReader("myapp") to search byte by byte? or a chunk of 3 bytes
because i need to read the next two bytes as well and compare them ,reason why is i need to check a file to see if its been modified at that address and if so then replace default hex values back ,or do i just keep it like that above code which works
|
| tangomouse Sunday, October 18, 2009 11:34 PM |
Yes, it reads the all file in one operation.
At this point, you have an array of byte that hold all the bytes in the file.
Your code is the right way to search for 3 bytes
|
| Crazypennie Sunday, October 18, 2009 11:45 PM |
I just thought I would add that those are "relative addresses" that is, relative to a starting address usually of zero in a multi-tasking OS. The address is different to an absolute adress which that program has also.
Renee |
| Renee Culver Monday, October 19, 2009 12:40 AM |
Renee, once loaded in memory, the address become senseless in manage code. I think that the op is more interrested to find some tables or values from the files headers. To follow the the headers path, even in file as simple as .ICO you need to find the address of the headers and filesignatures
|
| Crazypennie Monday, October 19, 2009 12:52 AM |
I know Craziepennie, I know. In managed code the address of the variable is being stored on a "heap stack" and the code does notknow when the address will change. So the address may be meaningless.
Renee |
| Renee Culver Monday, October 19, 2009 4:33 AM |
index > Visual Basic Express Edition > get the address of a hex value