Search ReadAllBytes for specific values - c#

I am writing a program that reads '.exe' files and stores their hex values in an array of bytes for comparison with an array containing a series of values. (like a very simple virus scanner)
byte[] buffer = File.ReadAllBytes(currentDirectoryContents[j]);
I have then used BitConverter to create a single string of these values
string hex = BitConverter.ToString(buffer);
The next step is to search this string for a series of values(definitions) and return positive for a match. This is where I am running into problems. My definitions are hex values but created and saved in notepad as defintions.xyz
string[] definitions = File.ReadAllLines(#"C:\definitions.xyz");
I had been trying to read them into a string array and compare the definition elements of the array with string hex
bool[] test = new bool[currentDirectoryContents.Length];
test[j] = hex.Contains(definitions[i]);
This IS a section from a piece of homework, which is why I am not posting my entire code for the program. I had not used C# before last Friday so am most likely making silly mistakes at this point.
Any advice much appreciated :)

It is pretty unclear exactly what kind of format you use of the definitions. Base64 is a good encoding for a byte[], you can rapidly convert back and forth with Convert.ToBase64String and Convert.FromBase64String(). But your question suggests the bytes are encoded in hex. Let's assume it looks like "01020304" for a new byte[] { 1, 2, 3, 4}. Then this helper function converts such a string back to a byte[]:
static byte[] Hex2Bytes(string hex) {
if (hex.Length % 2 != 0) throw new ArgumentException();
var retval = new byte[hex.Length / 2];
for (int ix = 0; ix < hex.Length; ix += 2) {
retval[ix / 2] = byte.Parse(hex.Substring(ix, 2), System.Globalization.NumberStyles.HexNumber);
}
return retval;
}
You can now do a fast pattern search with an algorithm like Boyer-Moore.

I expect you understand that this is a very inefficient way to do it. But except for that, you should just do something like this:
bool[] test = new bool[currentDirectoryContents.Length];
for(int i=0;i<test.Length;i++){
byte[] buffer = File.ReadAllBytes(currentDirectoryContents[j]);
string hex = BitConverter.ToString(buffer);
test[i] = ContainsAny(hex, definitions);
}
bool ContainsAny(string s, string[] values){
foreach(string value in values){
if(s.Contains(value){
return true;
}
}
return false;
}
If you can use LINQ, you can do it like this:
var test = currentDirectoryContents.Select(
file=>definitions.Any(
definition =>
BitConverter.ToString(
File.ReadAllBytes(file)
).Contains(definition)
)
).ToArray();
Also, make sure that your definitions-file is formatted in a way that matches the output of BitConverter.ToString(): upper-case with dashes separating each encoded byte:
12-AB-F0-34
54-AC-FF-01-02

Related

Decoding 'code string' to UTF8 and string

First, sorry about my knowledge ...
Above all I have string type value %B3%F3%C7%F9.
Since I receive it from other processor, I don't know how it made... (just I receive this string)
What I only know are
this is something encoded Korean language (I guess it is 농협)
the encode method is one of utf-8 or euc-kr
What I wnat to do is to decode this strange and coded string to utf-8 string.
(for example, decode %B3%F3%C7%F9 to 농협 and assign it string type variable)
Thanks for your attention
(I'm working in ASP.NET Core 1.1)
Your % values are basically URL encoding, so %F9 represents a byte value of 249, for example.
So the first thing you need to do is convert this into a byte array. I've done this a potentially inefficient way in my example. Once you've done that, you need to convert that byte array into a string using the EUC-KR encoding type.
public static void Main()
{
string data = "%B3%F3%C7%F9";
byte[] bData = new byte[data.Length / 3];
for (int i = 0; i < data.Length; i += 3)
{
int pos = i / 3;
bData[pos] = Convert.ToByte(data.Substring(i + 1, 2), 16);
}
data = System.Text.Encoding.GetEncoding("euc-kr").GetString(bData);
Console.WriteLine(data);
}
Fiddle

Error "Hex string have a odd number of digits" while converting int->hex->binary in C#

Aim :
To convert a integer value first to hexstring and then to byte[].
Example :
Need to convert int:1024 to hexstring:400 to byte[]: 00000100 00000000
Method:
For converting from integer to hex string i tried below code
int i=1024;
string hexString = i.ToString("X");
i got hexstring value as "400". Then i tried converting hex string to byte[] using below code
byte[] value = HexStringToByteArray(hexValue);
/* function for converting hexstring to byte array */
public byte[] HexStringToByteArray(string hex)
{
int NumberChars = hex.Length;
if(NumberChars %2==1)
throw new Exception("Hex string cannot have an odd number of digits.");
byte[] bytes = new byte[NumberChars / 2];
for (int i = 0; i < NumberChars; i += 2)
bytes[i / 2] = Convert.ToByte(hex.Substring(i, 2), 16);
return bytes;
}
Error:
Here i got the exception "Hex String cannot have a odd number of digits"
Solution: ??
You can force the ToString to return a specific number of digits:
string hexString = i.ToString("X08");
The exception is thrown by your own code. You can make your code more flexible to accept hex strings that have an odd number of digits:
if (hex.Length % 2 == 1) hex = "0"+hex;
Now you can remove the odd/even check, and your code will be alright.
Your code throws the exception you're seeing:
throw new Exception("Hex string cannot have an odd number of digits.");
You can improve the conversion method to also accept odd hex string lengths like this:
using System.Collections.Generic;
using System.Linq;
// ...
public byte[] HexStringToByteArray(string hex)
{
var result = new List<byte>();
for (int i = hex.Length - 1; i >= 0; i -= 2)
{
if (i > 0)
{
result.Insert(0, Convert.ToByte(hex.Substring(i - 1, 2), 16));
}
else
{
result.Insert(0, Convert.ToByte(hex.Substring(i, 1), 16));
}
}
return bytes.ToArray();
}
This code should iterate through the hex string from its end, adding new bytes to the beginning of the resulting list (that will be transformed into an array before returning the value). If a single digit remains, it will be treated separately.
Your hex string has an odd number of digits and you are explicitly checking for that and throwing the exception. You need to decide why you put this line of code in there and whether you need to remove that in favour of other logic.
Other options are:
add a "0" to the beginning of the string to make it even length
force whoever is calling that code to always provide an even length string
change the later code to deal with odd numbers of characters properly...
In comments you have suggested that the first is what you need to know in which case:
if(hex.Length%2==1)
hex = "0"+hex;
Put this at the beginning of your method and if you get an odd number in then you will add the zero to it automatically. You can of course then take out your later check and exception throw.
Of note is that you may want to validate the input string as hex or possibly just put a try catch round the conversion to make sure that it is a valid hex string.
Also since it isn't clear whether the string is a necessary intermediate step or just one that you think is necessary, you might be interested in C# int to byte[] which deals with converting to bytes without the intermediate string.

Convert List<boolean> to String

I got a boolean list with 92 booleans, I want the list to be converted to a string, I thought I ll take 8 booleans(bits) and put them in a Byte(8 bits) and then use the ASCII to convert it the byte value to a char then add the chars to a string. However after googeling for more then 2 hours, no luck atm. I tried converting the List to a Byte list but it didn t work either ^^.
String strbyte = null;
for (int x = 0; x != tmpboolist.Count; x++) //tmpboolist is the 90+- boolean list
{
//this loop checks for true then puts a 1 or a 0 in the string(strbyte)
if (tmpboolist[x])
{
strbyte = strbyte + '1';
}
else
{
strbyte = strbyte + '0';
}
}
//here I try to convert the string to a byte list but no success
//no success because the testbytearray has the SAME size as the
//tmpboolist(but it should have less since 8 booleans should be 1 Byte)
//however all the 'Bytes' are 48 & 49 (which is 1 and 0 according to
//http://www.asciitable.com/)
Byte[] testbytearray = Encoding.Default.GetBytes(strbyte);
PS If anyone has a better suggestion on how to code & decode a Boolean list to a String?
(Because I want people to share their boolean list with a string rather then a list of 90 1 and 0s.)
EDIT: got it working now! ty all for helping
string text = new string(tmpboolist.Select(x => x ? '1' : '0').ToArray());
byte[] bytes = getBitwiseByteArray(text); //http://stackoverflow.com/a/6756231/1184013
String Arraycode = Convert.ToBase64String(bytes);
System.Windows.MessageBox.Show(Arraycode);
//first it makes a string out of the boolean list then it uses the converter to make it an Byte[](array), then we use the base64 encoding to make the byte[] a String.(that can be decoded later)
I ll look into the encoding32 later, ty for all the help again :)
You should store your boolean values in a BitArray.
var values = new BitArray(92);
values[0] = false;
values[1] = true;
values[2] = true;
...
Then you can convert the BitArray to a byte array
var bytes = new byte[(values.Length + 7) / 8];
values.CopyTo(bytes);
and the byte array to a Base64 string
var result = Convert.ToBase64String(bytes);
Reversely, you can convert a Base64 string to a byte array
var bytes2 = Convert.FromBase64String(result);
and the byte array to a BitArray
var values2 = new BitArray(bytes2);
The Base64 string looks like this: "Liwd7bRv6TMY2cNE". This is probably a bit unhandy for sharing between people; have a look at human-oriented base-32 encoding:
Anticipated uses of these [base-32 strings] include cut-
and-paste, text editing (e.g. in HTML files), manual transcription via a
keyboard, manual transcription via pen-and-paper, vocal transcription over
phone or radio, etc.
The desiderata for such an encoding are:
minimizing transcription errors -- e.g. the well-known problem of confusing
'0' with 'O'
embedding into other structures -- e.g. search engines, structured or
marked-up text, file systems, command shells
brevity -- Shorter [strings] are better than longer ones.
ergonomics -- Human users (especially non-technical ones) should find the
[strings] as easy and pleasant as possible. The uglier the [strings] looks, the worse.
To start with, it's a bad idea to concatenate strings in a loop like that - at least use StringBuilder, or use something like this with LINQ:
string text = new string(tmpboolist.Select(x => x ? '1' : '0').ToArray());
But converting your string to a List<bool> is easy with LINQ, using the fact that string implements IEnumerable<char>:
List<bool> values = text.Select(c => c == '1').ToList();
It's not clear where the byte array comes in... but you should not try to represent arbitrary binary data in a string just using Encoding.GetString. That's not what it's for.
If you don't care what format your string uses, then using Base64 will work well - but be aware that if you're grouping your Boolean values into bytes, you'll need extra information if you need to distinguish between "7 values" and "8 values, the first of which is False" for example.
Since I am infering from your code you want a string with n digits of either 1 or 0 depending onthe internal lists bool value then how about...
public override string ToString()
{
StringBuilder output = new StringBuilder(91);
foreach(bool item in this.tempboolist)
{
output.Append(item ? "1" : "0");
}
return output.ToString();
}
Warning this was off the cuff typing, I have not validated this with a compiler yet!
This function does what you want:
public String convertBArrayToStr(bool[] input)
{
if (input == null)
return "";
int length = input.Count();
int byteArrayCount = (input.Count() - 1) / 8 + 1;
var bytes = new char[byteArrayCount];
for (int i = 0; i < length; i++ )
{
var mappedIndex = (i - 1) / 8;
bytes[mappedIndex] = (char)(2 * bytes[mappedIndex] +(input[i] == true ? 1 : 0));
}
return new string(bytes);
}

Convert from Byte array to a List

I'm converting a List<string> into a byte array like this:
Byte[] bArray = userList
.SelectMany(s => System.Text.Encoding.ASCII.GetByte(s))
.ToArray();
How can I convert it back to a List<string>? I tried using ASCII.GetString(s) in the code above, but GetString expected a byte[], not a single byte.
It's not possible to reverse your algorithm.
The problem can be seen if you consider what happens when you have two users called "ab" and "c". This will give the exact same bytes as if you have two users called "a" and "bc". There is no way to distinguish between these two cases with your approach.
Instead of inventing your own serialization format you could just the serialization that is built into the .NET framework, such as the BinaryFormatter.
As a bit of a sidenote, if you preserve the zero-byte string termination you can easily concatenate the strings and extract all information, e.g.
Byte[] bArray = userList
.SelectMany(s => System.Text.Encoding.ASCII.GetBytes(s + '\0')) // Add 0 byte
.ToArray();
List<string> names = new List<string>();
for (int i = 0; i < bArray.Length; i++)
{
int end = i;
while (bArray[end] != 0) // Scan for zero byte
end++;
var length = end - i;
var word = new byte[length];
Array.Copy(bArray, i, word, 0, length);
names.Add(ASCIIEncoding.ASCII.GetString(word));
i += length;
}
You need to insert a delimter between your strings so that you can split the big byte array back into the original users. The delimiter should be a character which cannot be part of a user name.
Example (assuming | cannot be part of a user name):
var bytes = System.Text.Encoding.ASCII.GetByte(string.Join("|", userList.ToArray()));
You can't do this since the delimiters of the array structure were lost in the SelectMany method.

Generic string encoder in C#

What I need is very simple, but before I reinvent the wheel, I would like to know if something similar exist in the framework already.
I would like to encode (and decode) strings from a predefined characters table. I have many strings that contains few characters. Here is a string I would like to encode:
cn=1;pl=23;vf=3;vv=0
This string size is 20 chars, so 20 bytes.
In the string, I only use the following characters: cn=1;p23vf0
A total of 11 characters. So each character can be encoded with 4 bits only isn't ? Reducing the total amount of bytes used to 10.
Is there any existing method in .NET that can take a string in parameter and the reference table array and return the encoded bytes ?
char[] reference = "cn=1;p23vf0".ToCharArray();
string input = "cn=1;pl=23;vf=3;vv=0";
byte[] encoded = someClass.Encode(input, reference);
string decoded = someClass.Decode(encoded, reference);
Assert.AreEqual(input, decoded);
Any compression algorithm uses Huffman encoding. Which is basically what you are looking for here. That encoding isn't exposed as a class separately, it is part of the algorithm of the DeflateStream and GZipStream classes. Which is what you ought to use, as long as your strings are a reasonable size. If they are short then there isn't any point in encoding them.
Interresting question... There isn't anything built in the framework, but it can be done for example like this:
public static byte[] Encode(string input, string reference) {
int size = 1;
while ((1 << ++size) < reference.Length);
byte[] result = new byte[(size * input.Length + 7) / 8];
new BitArray(
input
.Select(c => {
int index = reference.IndexOf(c);
return Enumerable.Range(0, size).Select(i => (index & (1 << i)) != 0);
})
.SelectMany(a => a)
.ToArray()
).CopyTo(result, 0);
return result;
}
public static string Decode(byte[] encoded, int length, string reference) {
int size = 1;
while ((1 << ++size) < reference.Length);
return new String(
new BitArray(encoded)
.Cast<bool>()
.Take(length * size)
.Select((b, i) => new { Index = i / size, Bit = b })
.GroupBy(g => g.Index)
.Select(g => reference[g.Select((b, i) => (b.Bit ? 1 : 0) << i).Sum()])
.ToArray()
);
}
The code is a bit complicated, but that is because it works with any number of bits per character, not just four.
You encode the string like in your question, except the string contains twelve different characters, not eleven:
string reference = "cn=1;pl23vf0";
string input = "cn=1;pl=23;vf=3;vv=0";
byte[] encoded = Encode(input, reference);
To decode the string you also need the length of the original string, as that is impossible to tell from the length of the encoded data:
string decoded = Decode(encoded, input.Length, reference);
(Alternatively to supplying the length you could of course introduce an EOF character, or a padding character similar to how base64 pads the data.)
There's no out-of-the-box class that does exactly this, but it's not too hard using the BitArray class of .NET.
Once you have a bit-array, you can convert it to a string, or a packed byte representation.
// modify this as appropriate to divide your original input string...
public IEnumerable<string> Divide( string s )
{
for( int i = 0; i < s.Length; i += 2 )
yield return s.Substring( i, 2 );
}
public IEnumerable<bool> AsBoolArray( byte b )
{
var i = 4; // assume we only want 4-bits
while( i-- > 0 )
{
yield return (b & 0x01) != 0;
b >>= 1;
}
}
// define your own mapping table...
var mappingTable =
new Dictionary<string,int>() { {"cn", 1}, {"pl",23}, {"vf",3}, {"vv",0} /*...*/ };
var originalString = "cncnvfvvplvvplpl";
// encode the data by mapping each string to the dictionary...
var encodedData = DivideString( originalString ).Select( s => mappingTable[s] );
// then convert into a bitVector based on the boolean representation of each value...
// The AsBoolArray() method return the 4-bit encoded bool[] for each value
var packedBitVector =
new BitArray( encodedData.Select( x => AsBoolArray(x) ).ToArray() );
// you can use BitArray.CopyTo() to get the representation out as a packed int[]
I think if you want to minimize size of string it's better to use System.IO.Compression.GZipStream here. It's very simple and will likely to compress your string much more than 2 times.
There is nothing like that built into the Base Class Library. You will have to build your own.
Take a look at the Encoder class from System.Text - some elements may be of help.
Would the StringBuilder class be of any help?
You can use the CrytpAPI. here is a good example, including the methods to Encrypt and Decrypt a string. I don't think it will "compress" your data for you, though.

Categories