I think awk is probably the best tool for this to work, but this can be done with sed :
sed '/^[^ ]* *00 *|/{ :a s/\(|.*[^(]\)\([0-9a-f][1-9a-f]\)/\1(\2)/ ta :b s/\(|.*[^(]\)\([1-9a-f][0-9a-f]\)/\1(\2)/ tb }' data
The script searches for lines containing 00 before the pipe and only applies operations to those lines. There are two replacement operations, each wrapped in a loop. Lines :a and :b are labels. The ta and tb commands represent a conditional transition to the named label if a replacement has been made since the last transition. Two permutations are almost symmetrical; the first deals with any number that does not end with 0; the second deals with any number that does not start with 0; between them they ignore 00 . Samples look for the handset, any character sequence that does not end with an open parenthesis ( , and the corresponding pair of numbers; it replaces it so that the number ends in parentheses. Loops are necessary because the g modifier does not start from the beginning again, and the patterns work back through the numbers .
Given this data file (slightly extended version):
foobar 42 | ff 00 00 00 00 foobaz 00 | 0a 00 0b 00 00 foobie 00 | 00 00 00 00 00 bar 00 | ab ba 00 cd 00 fizbie 00 | ab ba 00 cd 90 fizzbuzz 00 | ab ba 00 cd 09
output from script:
foobar 42 | ff 00 00 00 00 foobaz 00 | (0a) 00 (0b) 00 00 foobie 00 | 00 00 00 00 00 bar 00 | (ab) (ba) 00 (cd) 00 fizbie 00 | (ab) (ba) 00 (cd) (90) fizzbuzz 00 | (ab) (ba) 00 (cd) (09)
To add an educational average p after each of the wildcard commands so that you can see how the wildcard works:
foobar 42 | ff 00 00 00 00 foobaz 00 | 0a 00 (0b) 00 00 foobaz 00 | (0a) 00 (0b) 00 00 foobaz 00 | (0a) 00 (0b) 00 00 foobie 00 | 00 00 00 00 00 bar 00 | ab ba 00 (cd) 00 bar 00 | ab (ba) 00 (cd) 00 bar 00 | (ab) (ba) 00 (cd) 00 bar 00 | (ab) (ba) 00 (cd) 00 fizbie 00 | ab ba 00 (cd) 90 fizbie 00 | ab (ba) 00 (cd) 90 fizbie 00 | (ab) (ba) 00 (cd) 90 fizbie 00 | (ab) (ba) 00 (cd) (90) fizbie 00 | (ab) (ba) 00 (cd) (90) fizzbuzz 00 | ab ba 00 cd (09) fizzbuzz 00 | ab ba 00 (cd) (09) fizzbuzz 00 | ab (ba) 00 (cd) (09) fizzbuzz 00 | (ab) (ba) 00 (cd) (09) fizzbuzz 00 | (ab) (ba) 00 (cd) (09)
source share