Search for patterns in whole file

[dpz6]

Hi,

first of all thanks for anybody involved in this project. I just found this editor and think its amazing.

So far, I have one use case that I have not figured out in ImHex. I have a large binary file of unknown format that I try to understand. Somewhere in the structure of this unknown protocol there are some PNG files. It would help me a lot, if I could apply the PNG hexpat to the whole file, so I can see which sections of the file contain PNG files, so I can concentrate on the surrounding areas or the other parts of the file. I would greatly appreciate if someone could nudge me in the right direction or tell me if that is even possible.

[paxcut]

For png it looks like the first 4 bytes are 89 50 4E 47 (maybe the first one changes but the last three read PNG. locate the positions in your file that contain the chars and place the png pattern (just copy it from the png.hexpat file and paste it in your code)

[dpz6]

Thanks for the quick reply. I should probably have been more precise. I got this working when using just a normal PNG file (because the file starts at memory position 0x00). I don't know the pattern language yet but it looks to me from the PNG hexpat, that it requires the whole memory to correspond to one PNG file and that the PNG file has to start at memory position 0x00.

However, I did not get it working when the PNG file is embedded within some other data structure. Also, the end goal would be to find all occurences automatically and apply the hexpat. I guess I would need to write custom pattern language code to search for occurences of the magic bytes and apply the PNG hexpat in all of the places?

[paxcut]

I'll explain in more detail what I meant. All patterns consist of two main components

1. Custom type declarations that mirror the organization of the data in the binary file. Most likely there is a header pattern and a main body pattern that includes all the other declarations inside of it.
2. Placements of an instantiation of the header at offset 0 followed by the main body which expands to cover the entire file.

For the png pattern part 2) are these lines (attributes and visualizers removed for clarity):

 header_t header @ 0x00;
Chunks chunks @ 0x08;

In your case there will be several headers followed by their chunks and the will be placed at offsets that you need to find using the various functions the pattern language provides to search for sequences of bytes. You need to copy and paste the whole png pattern into the pattern editor window except the placement lines shown above (skip visualizer too).

Assuming that you have found PNGCount offsets in the file and that they are stored in

u128 offsets[PNGCount];

Then define new patterns a the bottom of the pattern editor

struct PNG {
    header_t header;
    Chunks chunks;
};

struct PNGsInFile {
    PNG png @ offsets[std::mem::array_index()];
};

PNGsInFile pngs[PNGCount];

For searching the file for bytes refer to the documentation for the mem library. this should get you started but feel free to post any questions you may have. (you may want to check the discord server for a more interactive support experience)