LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 07-29-2009, 10:09 AM   #1
kpachopoulos
Member
 
Registered: Feb 2004
Location: Athens, Greece
Distribution: Gentoo,FreeBSD, Debian
Posts: 704

Rep: Reputation: 30
scan binary file for word and print words before and after


Hi,
i'd like to scan a binary file for a given word and in case this word is found, print a number of characters (no distinction made between human readable or not) before and a number of character after. For example 10chars+ MY_WORD +10chars.

I am not quite experienced; should i use awk or grep? Use a pattern like a "..........MY_WORD.........."?

Thanks a lot
 
Old 07-29-2009, 05:51 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,003
Blog Entries: 54

Rep: Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757
If SEARCHTERM occupies ${#SEARCHTERM} chars, and if STRING=$(grep /path/to/target -m1 -A1 -B1 -a SEARCHTERM), then CHARSBEFORE=${//SEARCHTERM*/} (and CHARSAFTER=${//*SEARCHTERM/} ), so the offset of CHARSBEFORE would be $[${#CHARSBEFORE}-10], so I think you want to display ${CHARSBEFORE:$[${#CHARSBEFORE}-10]:${#CHARSBEFORE}}. Does that make sense?
 
Old 07-30-2009, 03:59 AM   #3
kpachopoulos
Member
 
Registered: Feb 2004
Location: Athens, Greece
Distribution: Gentoo,FreeBSD, Debian
Posts: 704

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by unSpawn View Post
If SEARCHTERM occupies ${#SEARCHTERM} chars, and if STRING=$(grep /path/to/target -m1 -A1 -B1 -a SEARCHTERM), then CHARSBEFORE=${//SEARCHTERM*/} (and CHARSAFTER=${//*SEARCHTERM/} ), so the offset of CHARSBEFORE would be $[${#CHARSBEFORE}-10], so I think you want to display ${CHARSBEFORE:$[${#CHARSBEFORE}-10]:${#CHARSBEFORE}}. Does that make sense?
Sorry, have rarely used something like this and i do not get it. It could be more help, if you could explain a little. Thanks a lot.
 
Old 07-30-2009, 05:46 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,003
Blog Entries: 54

Rep: Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757
If SEARCHTERM=GNU, then total amount of chars in string is 'echo ${#SEARCHTERM}', and displaying first 2 chars (starts at zero) of it is 'echo ${SEARCHTERM:0:2}'
Take as STRING=$(grep /bin/ls -m1 -A1 -B1 -a GNU), you'll have chars in before and after your SEARCHTERM.
Before is CHARSBEFORE=${//SEARCHTERM*/}.
After is CHARSAFTER=${//*SEARCHTERM/}.
Since you want to display 10 chars starting from the end of the string you need the range to be (total amount of chars minus ten) - (total amount of chars).
When debugging 'set' (as in xve) and 'eval' are your friends:
Code:
eval echo ${#CHARSBEFORE}
eval echo $[${#CHARSBEFORE}-10]
eval echo ${CHARSBEFORE:$[${#CHARSBEFORE}-10]:${#CHARSBEFORE}}
Better?
 
Old 07-30-2009, 10:13 AM   #5
theNbomr
LQ 5k Club
 
Registered: Aug 2005
Distribution: OpenSuse, Fedora, Redhat, Debian
Posts: 5,395
Blog Entries: 2

Rep: Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903
unSpawn seems to be trying to show how grep can be used to display leading and trailing context. While I think his commandline example is broken (should be more like 'grep -m1 -A1 -B1 -a GNU /bin/ls'), it seems that he is grabbing one line of 'text' before and after each matching instance, and then, using some bash text manipulation operators, truncating the leading and trailing context to the desired amount of characters. This probably works, but assumes that the leading and trailing context characters are all on the single preceding and succeeding lines (whatever we mean by 'line' in a binary file).
This points to what I see as a fundamental problem with the whole approach: grep, awk, etc., are text oriented tools, which expect newline delimited text, and binary files simply aren't like that. Moreover, displaying raw binary data rarely makes sense, as the effect will be different depending on the terminal in use, and it's runtime configuration. I would suggest re-evaluating your requirements, and/or considering the use of a tool such as od, possibly in combination with grep or other text processor.
--- rod.
 
Old 07-30-2009, 10:30 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,003
Blog Entries: 54

Rep: Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757Reputation: 2757
I did take his "print a number of characters (no distinction made between human readable or not) before and a number of character after" quite literally. Good advice.
 
  


Reply

Tags
awk, grep, pattern


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
substitute few words + change all the lines starting with a specific word + put blank rahmathullakm Programming 6 01-18-2009 11:35 AM
shell script to find an word or words from a line rakesh.tandur Linux - General 5 05-13-2008 01:57 PM
[SOLVED] find a word in a file, and change a word beneath it ?? vikas027 Programming 10 02-14-2008 09:46 PM
problem in reading Microsoft word as a binary file ljqu_happy Programming 15 02-02-2005 10:10 AM


All times are GMT -5. The time now is 12:40 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration