findloc problem!

[Shokoniraya]

i dont know its a problem or not, but i will tell you anyway, aluigi

Code: Select all

print "TEST1"
findloc OBJE binary "\x4F\x42\x4A\x45"
print "%OBJE%"
print "TEST2"

you can see a file with name inw and a bat file to do it, but if i remove OBJE in offset 22 in inw file with hex, then rest of script can be start to print other part! (its happen just if binary cant find with findloc)

[atom0s]

Not sure what your issue is, looks to work fine for me.
Prints:

TEST1
22
TEST2

If I remove the pattern, it prints:
TEST1

Looks to work fine.

[aluigi]

Just to stay safe I think that it's ever better to use variable names that don't match the constant value, even if it's a binary value.

@Shokoniraya
Try calling the OBJE variable as TEST and check if you still have the problem.

[Shokoniraya]

nothing changed and still has problem

[aluigi]

I don't see any problem, everything works perfectly.
Remember that findloc terminates quickbms by default if the pattern is not found.
Are you sure you don't need to use the following?

findloc OBJE binary "\x4F\x42\x4A\x45" 0 "NOT FOUND"

[Shokoniraya]

And I want to ask something
is there any way to find a binary with a unknow byte?
Like this: "\xFF\xFF\XFF\x??\xFE"
because \x?? has a different value in every files and how can i solve that?

[aluigi]

Unfortunately doesn't exist a jolly character for findloc

[Shokoniraya]

solved with findloc OBJE binary "" 0 ""
looks like quickbms has problem with string NAME p in -s option and that is why my script not working

[aluigi]

There is not "string NAME p" in your posts.
Are you sure you used it correctly?

[Shokoniraya]

There is not "string NAME p" in your posts.
Are you sure you used it correctly?

No, findloc problem solved with "" 0 ""
so, string NAME p has problem in -s option, that's a new problem

[aluigi]

Show me how you used the -s option, full command.

[Shokoniraya]

Show me how you used the -s option, full command.

Code: Select all

quickbms.exe -s "get SIZE asize ; get NAMER basename ; string NAME p \"%s%s\" \"FILE_\" NAMER ; log NAME 0 SIZE" "" MY_FILE.7z
pause

file name will turning to s
but string NAME + YOUR_STRING will works fine
so i can use same as above line and just check it and you will see (tested on quickbms 9.2.0)
and can you test -s option on huge scripts? (long scripts, a script with a lot on line (huge), sorry more my limited grammer)

i think there is another problem with huge scripts, can you test it? or its because string NAME p?

[aluigi]

Here it works correctly.
I used it on file2.bin and it tried to dump the file FILE_file2

[Shokoniraya]

file name will dump as s
Windows: 8.1
QuickBMS version: 9.2.0
i replaced (") to (\") and i replace enter to ( ; )

i posted my .bat file and do on Test.7z

Code: Select all

quickbms.exe -s "get SIZE asize ; get NAMER basename ; string NAME p \"%s%s\" \"FILE_\" NAMER ; log NAME 0 SIZE" "" Test.7z

[aluigi]

The reason is that in .bat files the % char is interpreted.
You need to escape it by replacing %s with %%s

[Shokoniraya]

The reason is that in .bat files the % char is interpreted.
You need to escape it by replacing %s with %%s

works fine!
can you tell me other replacing words more than this?
["]To[\"]
[enter-Char] To[ ; ]
[%]To[%%]
is there any other thing to replace?

[aluigi]

I think they are almost all the escapes.

Both command-line and .bat use |, <, > and & as special separators and redirectors, in that case they require to be "quoted" if part of the argument.

On Linux the situation is a bit more complex, with at least ^ and $.