Comments on: bgrep – A Binary Grep

By: jal

jal — Mon, 12 Jul 2010 10:11:15 +0000

patch for large file :

#define _FILE_OFFSET_BITS 64

By: lirel

lirel — Thu, 10 Jun 2010 23:04:03 +0000

this is how i search for my cryptsetup LUKS header after loosing my partition table:
sudo dd if=/dev/sda bs=512| ./bgrep 4c554b53babe000174776f6669736800
for twofisch
and generic luks magic + version number:
sudo dd if=/dev/sda bs=512| ./bgrep 4c554b53babe0001

i wonder if it gets faster when the seachstring is longer?

By: Міша

Міша — Mon, 24 May 2010 19:59:00 +0000

Great!

Some comments, though:

a) it should, probably, use mmap() by default, instead of reading into buffer;
b) it should be possible to specify the offset at which to begin (and end) searching as options;
c) it should be possible to specify the filename into which the bytes starting from the matched sequence up to the specified size will be written; knowing the offset from bgrep, one can do this with dd, but doing it in one operation would be nicer.

By: Sancho

Sancho — Mon, 23 Nov 2009 19:23:47 +0000

When working in a 64bit environ, make sure to include:glibc-devel-64bit*.rpm otherwise the buffer wraps for the offset as shown:
dd if=/dev/sdso bs=262144 |./bgrep 025e001900000078
stdin: 09a50000
21786+0 records in
21785+0 records out
5710807040 bytes (5.7 GB) copied, 411.014 seconds, 13.9 MB/s

The record was at 4.250GB offset 0×109a50000 yet bgrep reported 0×09a50000

After loading the 64bit glibc-devel:
gcc -O3 -m64 bgrep.c -o bgrep
dd if=/dev/sdso bs=1048576 count=4255|./bgrep 025e001900000078
stdin: 109a50000
4255+0 records in
4255+0 records out
4461690880 bytes (4.5 GB) copied, 79.261 seconds, 56.3 MB/s

Thanks for the awesome tool

By: bja888

bja888 — Mon, 16 Nov 2009 14:26:26 +0000

Another thank you!

By: bgrep二进制搜索 | 偶爱背单词

bgrep二进制搜索 | 偶爱背单词 — Fri, 11 Sep 2009 07:44:13 +0000

[...] http://debugmo.de/?p=100 ，可以用mingw编译windows版本。 // Written in April 2009 by Felix Domke [...]

By: sh

sh — Thu, 20 Aug 2009 07:38:57 +0000

GNU grep does support binary string search when using Perl regex. Just use the -P option.

[sh@pc ~]$ grep -slrP ‘\x05\x00\xc0′ /boot
/boot/vmlinuz-2.6.29.5-191.fc11.x86_64
/boot/grub/ffs_stage1_5
/boot/grub/ufs2_stage1_5
/boot/grub/stage2
/boot/vmlinuz-2.6.29.4-167.fc11.x86_64
/boot/efi/EFI/redhat/grub.efi
/boot/vmlinuz-2.6.29.6-213.fc11.x86_64

By: nemo

nemo — Sun, 05 Jul 2009 23:49:04 +0000

tmbinc: oh, somewhere along the line I totally missed the recursiveness of bgrep. lovelier and lovelier =)

By: tmbinc

tmbinc — Wed, 01 Jul 2009 13:39:37 +0000

Nemo: bgrep can also recursively look for files, so a “bgrep 504B0304 .” should do the same as your “find . -type f -print0 | xargs -n1 -0 bgrep 504B0304″.

By: thorx.net » Blog Archive » binary grep to find mp3s stored in zip

thorx.net » Blog Archive » binary grep to find mp3s stored in zip — Wed, 01 Jul 2009 13:22:13 +0000

[...] like all good problems, someone had scratched this ones itch – and I quickly found bgrep. (Here is the link again and in the clear, because this is the central point of this blog: [...]