Delphi Function Problem

[SuperCRacker]

Hi all,

I'm facing these days a problem with my delphi coding. To be brief, the problem is that Delphi doesn't provide in its internal functions a function that can search for a hex value in a file. I coded my own function but it seems that it takes too much time, I also looked around in the net, but nothing found. If you can help me either by suggesting a delphi function found on the net, or a delphi component or your own algo (even in different language) or maybe an API function that could do this job . The most important thing is that it must take less time (very quick). Thnks for your help.

SC.

[cektop]

Problem most probably lies in how you access the file. I presume that you are doing reading with read or readln functions. You shouldnt do it that way. Create buffer of eg. 1024 or more bytes and read file with BlockRead. There is even an example of file copy function with BlockRead and BlockWrite. They will speed up the job greatly.

Searching for a value in a buffer be a problem...

[SuperCRacker]

Actually i do use blockread and blockwrite functions. Could you write a piece of code on how to code this function??

SC.

Edited March 25, 2006 by SuperCRacker

[zako]

Actually i do use blockread and blockwrite functions. Could you write a piece of code on how to code this function??

SC.

As I see it assuming the file is not structured, the problem with using block read and searching the buffer would be if you are searching a dword that happens to be stored at offset 1022 ie. the file is not dword aligned then you are'nt going to find it.

[SuperCRacker]

zako the problem to solve is speed and not search results possibilities, thnks

SC.

[zako]

zako the problem to solve is speed and not search results possibilities, thnks

SC.

Just trying to help, maybe I misunderstood, still I don't see what difference speed makes if you don't find what you're looking for. Lots of example code here, maybe you find what you need.

/http://www.delphibasics.co.uk/ByFunction.asp?Main=Files&Sub=Control

[SuperCRacker]

thnks zako for the link, but i haven't found something interesting that might help me in my task. I have coded a new function with different approach, hope it'll be efficient. Some more tests of this function will be done during this week...

SC.

[Nacho_dj]

Try this and then please feedback here if it is getting the performance you need...

"Fastest way to search a string in a file"
/>http://www.delphifaq.com/faq/delphi/strings/f86.shtml

Cheers

Nacho_dj

[Nacho_dj]

Here I have found another link to a fast searching of strings for Delphi applications:
/>http://delphi.icm.edu.pl/newl/d40/f080_001.htm

There you can find the following abstract of the downloadable Delphi code:

unit cxpos, a class extension (+sample implementations) of expos (extended pos), the extremely high performance unit of SubString/Pattern Search & Replace, using the new, proposed Sofyan-Hafizh BoundCheck algorithm, plus assembler (x86) tricks in an advanced delphi programming. This is the fastest implementation of pattern search algorithm, the replace function is *at-least* 25x faster than the standard delphi's StringReplace on a very light task, raised exponentially according to the weight (2000x++) on heavy duties.

Sample App.: SR32.EXE (obsoletes alsed32.exe) also as a sample usage for GetOpts, QuoteStr & FileScan unit (full source code included), a very fast+powerful patcher(S/R), especially when others couldn't handle no more (say: a huge file>100MB)

To download the code:
/>http://delphi.icm.edu.pl/ftp/d40free/cxpos.zip

I hope this is helping you

Nacho_dj

[SuperCRacker]

Thnks Nacho i will check your links for further testing ... I will report you my findings.

SC.

[Nacho_dj]

Thnks Nacho i will check your links for further testing ... I will report you my findings.

SC.

Hello Supercracker:

Did you have the time to test the routines?

Anyway I need the same for a tool I am coding. I have coded a search but it is not getting the performance as fast as, for instance, has OllyDbg when searching for a string of bytes.

So, I'll need to implement this. Maybe I am testing it before than you!

Keep me informed on your tests mate!

Nacho_dj

[SuperCRacker]

YEAH Got it ... I coded my own function and is 10000 time quick than the older one. The idea is using pointers instead of variables. Nacho i checked your links but nothing seem to be interesting.

P.S : Teddy you can catch me in msn to have your first beta version Quicker than ....

SC.

[Nacho_dj]

Supercracker, nice to see you have solved it!

Would you like to share how did you code your procedures? I need to improve a searching, too

Thanks and good luck with your tool

Nacho_dj

BTW: Anyway, I tried the .exe that is included in the .zip of last link I gave here, and it is fast like a plane, performing a search in a certain big sized file

[SuperCRacker]

Now i have been searching for this function to search for a certain hex value in a file, but i have jsut solved how to serach for it in a running process not in disk file. It's a little bit complicated but if you have habit to code in delphi it won't be very difficult. Let's go, here's a piece of code :

type TByte:array[0..maxint shr 2-1] of Byte;

PTByte:^Byte;

//You'll need to load the specified running process in the calling process (the program)

//I have used GlobalAlloc to do the job (I won't write the code because it's getting us far from the goal)

//Now that you have read the whole process you will get an address pointing to it (memptr)

//Now use this piece of code , for example you're searching for $12345678

for i:=1 to "Allocated Size" do

begin

if PByte(memptr)^[i-1]=Byte($12345678) then

begin

Result:=i-1;

end;

end;

Note that just the idea is written, and this code won't work until you apply some modifications to it.

Hope that this will help you,

SC.

[Teddy Rogers]

I just got your message! I'm around for a little while...

Ted.

[Nacho_dj]

Hey SuperCracker, thanks a lot mate!

I have a question about what you are using.

If you Byte cast an integer, it has to be converted to a Byte, so in your example $12345678 will turn $78, loosing the other bytes, isn't it?

I am doing a searching similar to yours, with dinamic arrays of Bytes, the only difference is I am comparing every byte individually with the pattern ones, that is, if the array of bytes is ArrayofByte, and the pattern searched is PatternofBytes I do:

// Code inside a function

for i := 0 to Lentgh(PatternofBytes) - 1 do

if ArrayofByte <> PatternofBytes then

Break;

if i < Length(PatternofBytes) -1 then

Result := FALSE

I am not getting the performance I would like doing so.

I need searching more than an integer value, but a string of bytes, as a pattern. It is because I was asking you.

I have coded a complete tool, that patches in file (well especifically it patches in a buffer that has to be dumped in a file) and in a process loaded in memory, it will be released soon. My only problem was like yours, the speed of searching, because I need searching in differents blocks of memory, thus delaying the performance of the tool, because I don't feel happy waiting among 20-30 seconds for a tool patching an appli.

I keep trying...

Cheers

Nacho_dj