Robertico

v1) Is just what i needed.
Apologies for mistaken the use of bits / bytes.
I needed the previous bytes :-))

I discovered that [regex]::matches($bytes, $pattern) is case sensitive !

v2) give's an error on this line
$bytes = (gc $file -en byte | % {'{0:x2}' -f $_}) -join ''
Error: "You must provide a value expression on the right-hand of the
'-'-operator"

Robertico

"Kiron" <Kiron@xxxxxx> wrote in message
news:BE8CE4C6-11F8-45A4-A8B7-B1839382A1CD@xxxxxx
Try this:

# v1
$file = <file's path>
$pattern = '131B1B087C156108AE151B'
$prevBytes = 8
$bytes = [string]::join('', (gc $file -en byte | % {'{0:x2}' -f $_}))
[regex]::matches($bytes, $pattern) |
% {
$i = $_.index - $prevBytes * 2
[string]::join('', $bytes[$i..($i + $prevBytes * 2 - 1)])
}

# v2 CTP
$file = <file's path>
$pattern = '131B1B087C156108AE151B'
$prevBytes = 8
$bytes = (gc $file -en byte | % {'{0:x2}' -f $_}) -join ''
select-string $pattern -inp $bytes -all |
% {$_.matches |
% {
$i = $_.index - $prevBytes * 2
$bytes[$i..($i + $prevBytes * 2 - 1)] -join ''
}
}

--
Kiron