Vista - Read and search through a binary file

"Robertico" <Nomail@xxxxxx> wrote in message
news:eJZVatZmIHA.5084@xxxxxxTake a look at [System.Net.IPAddress]::NetworkToHostOrder(). Assuming you
are running on an x86 based platform, this will convert big endian to little
endian.

--
Keith

Another attempt, this time using the System.Text.Encoding Class to convert each [byte[]] from BigEndian encoding to LittleEndian encoding.

$file = <file's path>
$pattern = '131B1B087C156108AE151B'
$prevBytes = 8
$bytes = [string]::join('', (gc $file -en byte | % {'{0:X2}' -f $_}))
$bigEndian = [text.encoding]::bigEndianUnicode
$littleEndian = [text.encoding]::unicode
[regex]::matches($bytes, $pattern, 1) |
% {
$i = $_.index - $prevBytes * 2
[string]::join('', $bytes[$i..($i + $prevBytes * 2 - 1)]) |
% {
$hexBytes = $_
$byteArray = 0..($hexBytes.length - 1) | ? {!($_ -band 1)} |
% {
$i = $_
"0x$($hexBytes.subString($i,2))"
}
$littleEndianBytes = [text.encoding]::convert($bigEndian, $littleEndian, $byteArray)
[string]::join('', ($littleEndianBytes | % {'{0:X2}' -f $_}))
# next line produces same output as the previous line
# [bitConverter]::toString($littleEndianBytes) -replace '-'
}
}

--
Kiron

Krion,

This one does the trick :-))
e.g. the return value in Big Endian is '097AD6060956354F' en after the
conversion to Little Endian it becomes '4F35560906D67A09'.

Thanks a lot !

Now it's working and time to study why it's working :-))

Robertico



"Kiron" <Kiron@xxxxxx> wrote in message
news:C4D22AE4-2DCE-426E-B53B-77E2A3D4B68E@xxxxxx
Robertico,
I'm no expert on Endianness but I understand the difference is in the order
of the bytes, so maybe by reversing the $byteArray you get what you want. If
not, I hope someone with more knowledge on Endianness provides the correct
or a better method.

Try this:

$file = <file's path>
$pattern = '131B1B087C156108AE151B'
$prevBytes = 8
$bytes = [string]::join('', (gc $file -en byte | % {'{0:X2}' -f $_}))
[regex]::matches($bytes, $pattern, 1) |
% {
$i = $_.index - $prevBytes * 2
[string]::join('', $bytes[$i..($i + $prevBytes * 2 - 1)]) |
% {
$hexBytes = $_
$byteArray = 0..($hexBytes.length - 1) | ? {!($_ -band 1)} |
% {
$i = $_
"0x$($hexBytes.subString($i,2))"
}
[array]::reverse($byteArray)
[bitConverter]::toString($byteArray) -replace '-'
}
}

--
Kiron