Searching values in multiple files at... Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Support Forum » Hex Editing » Searching values in multiple files at defined offset « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Pierre MALICET
Posted on Monday, Aug 5, 2002 - 12:31:   

Hello

I'm looking for a value (for example 0x:005F)at the position 0552 in different files.
I'm using the Open Folder menu, with options :
-Must contain specified hex value

and : 005f in the first field, cond : offset mod 1 = 1362 (1362=decimal value for 0x:0552)

I'm sure that several files contains this value at this position. But I obtain '0 file found'

Why ?

Thanks for help

Pierre
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Aug 5, 2002 - 13:36:   

> Why ?

Because of the mathematical definition of the modulo operation. I cannot work that way. Any integer modulo 1 gives zero. Please feel free to check this out for yourself with a calculator.

You could use the condition "offset mod 10000 = 1362" instead.
Top of pagePrevious messageNext messageBottom of page Link to this message

Pierre MALICET
Posted on Monday, Aug 5, 2002 - 16:57:   

Sorry, the modulo 1 was stupid.
But my problem remain...
I want to open all the files they have got the value XX at the offset YYYY from the begin of the file. The sizes of theses files are not identicals.

A difficulty exist within the rapport between the value of modulo and the size of the file (SizeOfFile).

For example, SizeOfFile = 100 bytes, I am searching the value 00 at offset 10.
If modulo is set to 11, the condition is verified for the offset 10, but also 21,32,43,54, ......until 98 : wrong files may be loaded.
If modulo is set to 101( or any value greater than SizeOfFile-Offset), the condition is right verified for the only offset 10, ... It is OK.

But WinHex don't accept value greater than 57290 (?) for the modulo. If the size of the file is greater than 2*57290 bytes + offset ....several solutions exists again.

Is it possible to define an offset without modulo (unique offset) ?

Thanks

Pierre
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Aug 5, 2002 - 17:45:   

> But WinHex don't accept value greater than
> 57290 (?) for the modulo.

Yes, it does. 2,147,483,647 is the maximum.

> Is it possible to define an offset without
> modulo (unique offset) ?

No.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Aug 5, 2002 - 20:51:   

I confirm that if the mod value is larger than 57,290, occurrences at offsets smaller than 57,290 are not found. This will be fixed with WinHex 10.5 SR-2.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have an account.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.