Python: regex search pattern for binary files (half byte)

Question

I use the following regular expression pattern to search for 0xDEAD4FAD in a binary:

my_pattern = re.compile(b"\xDE\xAD\x4F\xAD") 

but how can I generalize the search pattern to search for 0xDEAD4xxx? can't cut through half a byte

Answer 1

Regular expressions allow you to search by range. Thus, to find a byte whose first chunk is "4", use:

 pattern = re.compile(b"[\x40-\x4F]") 

The following test shows that it produces the desired output:

 >>> for byte in ('\x3f', '\x40', '\x42', '\x4f', '\x50'): print bool(pattern.search(byte)) ... False True True True False 

To answer your specific question about finding 0xDEAD4xxx, use:

 my_pattern = re.compile(b"\xDE\xAD[\x40-\x4F].") 

Answer 2

I suspect that it would be best for you to convert a binary string to an ASCII hex string and apply regular expressions to it. I do not believe that the regular expression is designed to work with binary data; you can make it work, but don't be surprised if there are surprises along the way.

Answer 3

If I were in your situation, I would try hexdump with grep.