Question

因此，我为此一直在进行谷歌搜索，但是我找不到适合自己情况的解决方案。我可以找到有关字节数组的信息。但我希望对我的案件也有一个更简单的解决方案。也许只是我使用了错误的搜索字词，不知道。

无论如何，我已经有一个可以正常工作的代码了：

    static void Main(string[] args)
    {
        // Open the file to search in
        BinaryReader br = new BinaryReader(File.OpenRead("D:/Users/Joey/Desktop/prod"));
        for (int i = 0; i <= br.BaseStream.Length; i++)
        {
            // Search the file for the given byte
            if (br.BaseStream.ReadByte() == (byte)0xC0)
            {
                Console.WriteLine("Found the byte at offset " + i); //write to the console on which offset it has been found
            }
        }
    }

此示例有效。但是，我需要它能够搜索多个字节。例如：C0035FD6

我觉得我缺少了这么简单的东西，但我似乎无法弄清楚。

如果有人为我找到了解决方案，那就太好了：D

Answer 1

您可以使用此扩展名搜索AOB：

public static class StreamExtensions
{
    public static IEnumerable<long> ScanAOB(this Stream stream, params byte[] aob)
    {
        long position;
        byte[] buffer = new byte[aob.Length - 1];

        while ((position = stream.Position) < stream.Length)
        {
            if (stream.ReadByte() != aob[0]) continue;
            if (stream.Read(buffer, 0, aob.Length - 1) == 0) continue;

            if (buffer.SequenceEqual(aob.Skip(1)))
            {
                yield return position;
            }
        }
    }

    public static IEnumerable<long> ScanAOB(this Stream stream, params byte?[] aob)
    {
        long position;
        byte[] buffer = new byte[aob.Length - 1];

        while ((position = stream.Position) < stream.Length)
        {
            if (stream.ReadByte() != aob[0]) continue;
            if (stream.Read(buffer, 0, aob.Length - 1) == 0) continue;

            if (buffer.Cast<byte?>().SequenceEqual(aob.Skip(1), new AobComparer()))
            {
                yield return position;
            }
        }
    }

    private class AobComparer : IEqualityComparer<byte?>
    {
        public bool Equals(byte? x, byte? y) => x == null || y == null || x == y;
        public int GetHashCode(byte? obj) => obj?.GetHashCode() ?? 0;
    }
}

示例：

void Main()
{
    using (var stream = new MemoryStream(FakeData().ToArray()))
    {
        stream.ScanAOB(0x1, 0x2).Dump("Addresses of: 01 02");
        stream.Position = 0;
        stream.ScanAOB(0x03, 0x12).Dump("Addresses of: 03 12");
        stream.Position = 0;
        stream.ScanAOB(0x04, null, 0x06).Dump("Addresses of: 04 ?? 06");
    }
}

// Define other methods and classes here
IEnumerable<byte> FakeData()
{
    return Enumerable.Range(0, 2)
        .SelectMany(_ => Enumerable.Range(0, 255))
        .Select(x => (byte)x);
}

Answer 2

试一下。您将需要验证阵列是否正确。在二进制流中，字节数组只是从offset字节开始，其大小为count个字节的字节集合。

//here is where you initialize your array. you may need to tweak the values to match your byte range (array)
byte[] dataArray = new byte[9] { 0x93, 0x0E, 0x40, 0xF9, 0x53, 0x00, 0x00, 0xB5, 0xDE };

//here is where you initialize the NEW array you want to write where your matching array lives
byte[] newArray = new byte[9] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

// Open the file to search in
BinaryReader br = new BinaryReader(File.OpenRead("D:/Users/Joey/Desktop/prod"));
for (int i = 0; i <= br.BaseStream.Length; i++)
{
    // Search the file for the STARTING byte of my match
    if (br.BaseStream.ReadByte() == (byte)0x93)
    {
        Console.WriteLine("Found the starting byte at offset " + i); //write to the console on which offset it has been found
        byte[] tempArray = new byte[9];
        tempArray = br.ReadBytes(9);
        //now compare the arrays to see if you have a full match:
        int matched = 0;
        for (int j=0; j<tempArray.Length; j++)
        {
            if(tempArray[j] == dataArray[j])
            {
                 matched++;
            }
        }

        //if the arrays match, write your new values:
        if(matched == tempArray.Length-1)
        {
            br.BaseStream.Write(newArray, i, 9);
            break; //exit the loop when finished                    
        }                    
    }
}

C＃-二进制十六进制字节的读取顺序

2 个答案: