Jump to content

Binary reading


Recommended Posts

I've been trying to make my little BinaryToString work for the whole day. And still after searching the forums couple of times I haven't been able to do it so i'm wondering if someone knows what's wrong with my code.

But why does the following code work with a text-file which has just some gibberish in it, but not with a proper exe-file, which returns MZ and a box (and I've read the other topics of the same subject, but haven't been able to solve it even though others have):

$s_File = "test.txt"

$i_FileSize = FileGetSize($s_File)

$h_File = FileOpen($s_File, 16)

$s_data = FileRead($h_File, 15000)

FileClose($h_File)

MsgBox(0, "test", $s_data)

MsgBox(0, "test", BinaryToString($s_data))

Func _BinToString($binary)

$filename = Hex(Random(0,65535^2,1))&".temp.txt"

$fp = FileOpen($filename,18)

FileWrite($fp,$binary)

FileClose($fp)

$string = FileRead($filename)

FileDelete($filename)

Return $string

EndFunc

Someone babbled about some buggie thing on 3.2.2.x but it looks like some have it working. I'm using 3.2.4.9.

Thanks

Link to comment
Share on other sites

Thanks for your replies. And like you noticed, I pasted some stuff I just tested (I didn't even call that function and I'm sorry, but I had a bit rough weekend). But the _thing_ is, that it doesn't seem to work with exe or any other file types, which just give MZ[]. And that's what I want to do...

Link to comment
Share on other sites

And that's what I want to do...

What do you want to do? Edit files, search in them for some strings or just display them?

Doesn't it occur to you, that it's not the BinaryToString that fails, it's the MessageBox. Which does not display NULL (00) chars and accept them only as string terminators.

If displaying the binary file the way like Notepad does is that what you want to do, then I guess you gotta convert all these zero bytes to something else (I think that's what Notepad does, convert them to spaces). If you want to do something else, especially if it involves editing, don't pay attention to what gets displayed in Win controls and what not.

Edited by Siao

"be smart, drink your wine"

Link to comment
Share on other sites

Thanks for your replies, again.

To Siao, they did talk about msgbox not working on quite many posts, but i just couldn't believe it because the txt file worked, my bad =( And i have a DICOM-file and i wanted to read its header and search for a particular string. I just didn't know where it was so i wanted to check the result with msgbox. In the end i used notepad to do it (the string is in normal text).

Anyways, i realized that i could search with hex segment:offset, but i really don't know anything about hex-editing and some hex-editors even don't support s:o address. I'm pretty clueless what to do, but i'll start searching for more info.

Thanks you all!

Link to comment
Share on other sites

i have a DICOM-file and i wanted to read its header and search for a particular string. I just didn't know where it was so i wanted to check the result with msgbox. In the end i used notepad to do it (the string is in normal text).

Doesn't sound complicated.

$file = FileOpen($name, 16)

$temp = FileRead($file)

FileClose($file)

$addr = StringInStr(BinaryToString($temp), $yourstring)

Or you can extract specific byte(s) with BinaryMid and compare them to something directly...

"be smart, drink your wine"

Link to comment
Share on other sites

Nice! But I need to open many files and the information is in a different place on every file when reading with binary. So do you have any idea how to extract the following kind of info from a file "0010,0010 Patient's Name: Test Patient "... I think I can use something like "_StringToHex(BinaryToString($file))" but how can i search with that kind of segment:offset address (0010:0010). Because the header is splitted with those addresses and the patient's name is always at the same address.

Link to comment
Share on other sites

Hiya again!

Surprise surprise, I managed to crack that problem myself. Actually I just accidentally lost on to a website which had a small example which made me realize how to do it. You just had to use _StringToHex and search for "10 00 10 00" with StringInStr, which was a bit weird because the "address" was 0010:0010.

Thx for you two for the help!

PS. I couldn't find a way to edit my previous post... Is it possible with a noob-account?

Link to comment
Share on other sites

Hi,

so we need "BinaryInBin" func to be equivalent of "StringInStr" to find position? Maybe someone's done it already? - Then there's "StringInBin"?...

Randall

PS - So if you convert it to string for the search of positions in String with "StringInStr", can those positions be directly multiplied out and used on the original binary to use BinaryMid ?

PPS - I see you have your answer; can you do a UDF for those func I have Christened?

Edited by randallc
Link to comment
Share on other sites

so we need "BinaryInBin" func to be equivalent of "StringInStr" to find position?

If the data is in a form that you can search with normal string (like in my case I had "patient" when reading with notepad) you can use siao:s way. Or if you have some kind of hex-address then you can find it with stringinstr too. My problem was that the file didn't have any text before the name, just some binarygibberish and the name is different every time.

I just want to paste the code I ended up using:

include <String.au3>

$StartOffset = 16; There's some varying hexes before the name so i want to jump over them.


$File = "jh.rec.dcm"
$OpenedFile = FileOpen($File, 16)
$StartofFile = FileRead($OpenedFile, 5000)   ; My file was 250mb so I really don't want to read it all
FileClose($OpenedFile)

$FileInString = StringMid(BinaryToString($StartofFile), 1, 2000)

$PartialInHex = _StringToHex($FileInString)

$start = StringInStr($PartialInHex, "10001000504E") + $StartOffset   ; Search the starting point before the name and jump over the varying hexes
$end = StringInStr($PartialInHex, "5e5e5e") - $start + 6             ; Search the ending point of the name and include those three ^ (they're always there and after them is varying)

$result = _HexToString(StringMid($PartialInHex, $start, $end))

MsgBox(0, "", $result)

I know that it isn't beautiful, but it works! Thought I don't know if it works if there's more than one of the same hex strings (that's why I searched for more than 10001000)

PS.

So if you convert it to string for the search of positions in String with "StringInStr", can those positions be directly multiplied out and used on the original binary to use BinaryMid ?

I'm kinda missing your point (my native language isn't english)... And I'm such a noob that I don't know how to make an UDF, thought I'm going learn how because I have a Java version check script which I want to use easier in my later scripts.
Link to comment
Share on other sites

That "0x504E" is "PN" and it's a tag name, which stands for "patient's name". Which is followed by two bytes representing the length of the name, and then by the actual name.

Anyway, if you ever need some more info from your dicom files, instead of writing a proper DICOM format parser, you could use a free commandline tool like this http://barre.nom.fr/medical/dicom2/ for that task, and then use AutoIt to get the info from it's output, if that's even necessary...

Edited by Siao

"be smart, drink your wine"

Link to comment
Share on other sites

Hi,

so we need "BinaryInBin" func to be equivalent of "StringInStr" to find position? Maybe someone's done it already? - Then there's "StringInBin"?...

Randall

PS - So if you convert it to string for the search of positions in String with "StringInStr", can those positions be directly multiplied out and used on the original binary to use BinaryMid ?

PPS - I see you have your answer; can you do a UDF for those func I have Christened?

$offset = StringInStr(BinaryToString($bin), $string) returns decimal offset of the $string,

then you can use BinaryMid($bin, $offset, $count) to extract it.

If $string initially is not a string (hex or another binary), just convert it too.

I don't think there's a need for UDFs for such trivial thing.

Edited by Siao

"be smart, drink your wine"

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...