Home > Re_posts > 010editor脚本语法深入分析

010editor脚本语法深入分析

July 10, 2016

简介

010editor是一款十六进制编辑器，和winhex相比支持更灵活的脚本语法，可以对文件、内存、磁盘进行操作。

常用的模板库：

常见后缀: cab gzip rar zip cda midi mp3 ogg wav avi flv mp4 rm pdf iso vhd lnk dmp dex androidmanifest class
Drive.bt 解析mbr fat16 fat43 hfs ntfs等
elf.bt 解析linux elf格式的文件
exe.bt 解析windows pe x86/x64 格式文件(dll sys exe …)
macho.bt 解析mac os可执行文件
registrayhive.bt 解析注册表(hive)文件
bson.bt 解析二进制json

常用的脚本库(*.1sc)

CountBlocks.1sc 查找指定数据块
DecodeBase64.1sc 解码base64
EncodeBase64.1sc 编码base64
Entropy.1sc 计算熵
JoinFIle.1sc SplitFile.1sc 分隔合并文件
Js-unicode-escape.1sc Js-unicode-unescape.1sc URLDecoder.1sc js编码解码
CopyAsAsm.1sc CopyAsBinary.1sc CopyAsCpp.1sc CopyAsPython.1sc 复制到剪贴板
DumpStrings.1sc 查找所有ascii unicode字符串

语法特点

010editor脚本语言语法类似于c++，这种结构体不同之处在于：

访问变量时，从文件读取并显示，赋值变量时，写入文件
可以使用控制语句如if/for/while

例子:

struct FILE 
{
	struct HEADER 
	{
		char type[4];
		int version;
		int numRecords;
	} header;
	struct RECORD 
	{
	int employeeId;
	char name[40];
	float salary;
	} record[ header.numRecords ];
} file;

基本语法

表达式

支持标准c的操作符：+ - * / ~ ^ & | % ++ – ?: « » ()
支持的比较操作符：< ? <= >= == != !
支持的赋值操作符：= += -= *= /= &= ^= %= |= «= »=
布尔运算符：&& || !
常数：
- 10进制 456
- 16进制 0xff 25h 0EFh
- 8进制 013
- 2进制 0b011
- u后缀表示unsigned/L后缀表示8字节int64值
- 指数 1e10
- 浮点数 2.0f 2.0

变量

定义脚本变量

int x;
float a = 3.5f;
unsigned int myVar1, myVar2;

常量

const int TAG_EOF = 0x3545;

内建常量：true false TRUE FALSE M_PI PI

数据类型

8字节 char byte CHAR BYTE uchar ubyte UCHAR UBYTE
16字节 short int16 SHORT INT16 ushort uint16 USHORT UINT16 WORD
32字节 int int32 long INT INT32 LONG uint uint32 ulong UINT UINT32 ULONG DWORD
64字节 int64 quad QUAD INT64 __int64 uint64 uquad UQUAD UINT64 __uint64 QWORD
浮点 float FLOAT double DOUBLE hfloat HFLOAT
其他 DOSDATE DOSTIME FILETIME OLETIME time_t

使用typedef

typedef unsigned int myInt;
typedef char myString[15];
myString s = "Test";

使用enum

enum MYENUM { COMP_1, COMP_2 = 5, COMP_3 } var1;
enum <ushort> MYENUM { COMP_1, COMP_2 = 5, COMP_3 } var1;

数组和字符串

int myArray[15];
int myArray[ FileSize() - myInt * 0x10 + (17 << 5) ];//大小可以是变量
char str[15] = "First";
string s = "Second";
string r1 = str + s;
string r2 = str;
r2 += s;
return (r1 == r2);

宽字符

wchar_t str1[15] = L"How now";
wstring str2 = "brown cow";
wstring str3 = str1 + L' ' + str2 + L'?';

可以通过WStringToString StringToWString转换

控制语句

if语句

if( x < 5 )
    x = 0;

if( y > x )
    max = y;
else
{
    max = x;
    y = 0;
}

for语句

for( i = 0, x = 0; i < 15; i++ )
{
    x += i;
}

while语句

while( myVar < 15 )
{
    x *= myVar;
    myVar += 2;
}

do
{
    x *= myVar;
    myVar += 2;
}
while( myVar < 23 );

switch语句

switch( <variable> )
{
    case <expression>: <statement>; [break;]
    ...
    default : <statement>;
}

switch( value )
{
    case 2 : result = 1; break;
    case 4 : result = 2; break;
    case 8 : result = 3; break;
    case 16 : result = 4; break;
    default : result = -1;
}

循环控制：break continue return

函数

string str = "Apple";
return Strlen( str );

Printf( "string='%s' length='%d'\n", str, Strlen( str ) );

void OutputInt( int d )
{
    Printf( "%d\n", d );
}
OutputInt( 5 );

char[] GetExtension( char filename[], int &extLength )
{
    int pos = Strchr( filename, '.' );
    if( pos == -1 )
    {
        extLength = 0;
        return "";
    }
    else
    {
        extLength = Strlen( filename ) - pos - 1;
        return SubStr( filename, pos + 1 );
    }
}

参数可以通过值或引用传递，010editor脚本不支持指针，但是可以用[]表示数组。程序中不需要main函数，代码从第一行开始执行

关键字

sizeof
startof 用于计算变量起始地址。 SetCursorPos( startof( lines[0] ) );
exists 检查某变量是否声明

int i;
string s;
while( exists( file[i] ) )
{
s = file[i].frFileName;
Printf( "%s\n", s );
i++;
}

function_exists 检查函数是否定义

if( function_exists(CopyStringToClipboard) )
{
...
}

this 引用当前结构体

void PrintHeader( struct HEADER &h )
{
    Printf( "ID1 = %d\n", h.ID1 );
    Printf( "ID2 = %d\n", h.ID2 );
}
struct HEADER
{
    int ID1;
    int ID2;
    PrintHeader( this );
} h1;

parentof 访问包含变量的结构和union

void PrintHeader( struct HEADER &h )
{
    Printf( "ID1 = %d\n", h.ID1 );
    Printf( "ID2 = %d\n", h.ID2 );
}
struct HEADER
{
    int ID1;
    int ID2;
    struct SUBITEM
    {
        int data1;
        int data2;
        PrintHeader( parentof(this) );
    } item1;
    PrintHeader( parentof(item1) );
} h1;

预处理

define
#define PI 3.14159265

#define CHECK_VALUE if( value > 5) { \
Printf( "Invalid value %d\n", value ); \
Exit(-1); }

#define FILE_ICON 12
#define FOLDER_ICON (FILE_ICON+100)

内建常量

_010EDITOR 010editor运行后定义
_010_WIN 运行在windows上定义
_010_MAC
_010_LINUX
_010_64BIT

条件编译

#ifdef | #ifndef <constant_name>
(...)
[ #else ]
(...)
#endif
#ifndef CONSTANTS_H
#define CONSTANTS_H

警告和错误

#ifdef NUMBITS
value = value + NUMBITS;
#else
#warning "NUMBITS not defined!"
#endif

#ifndef CURRENT_OS
#error "CURRENT_OS must be defined. Compilation stopped."
#endif

include

#include "Vector.bt"

脚本限制

禁止使用指针，可以使用引用传参数禁止使用#if预处理禁止使用多维数组禁止使用goto

模板基础

声明模板变量

特殊属性

< format=hex|decimal|octal|binary,
fgcolor=<color>,
bgcolor=<color>,
comment="<string>"|<function_name>,
name="<string>"|<function_name>,
open=true|false|suppress,
hidden=true|false,
read=<function_name>,
write=<function_name>
size=<number>|<function_name> >

format 设置

int crc <format=hex>;
int flags <format=binary>;

color设置

int id <fgcolor=cBlack, bgcolor=0x0000FF>;
SetForeColor( cRed );
int first; // will be colored red
int second; // will be colored red
SetForeColor( cNone );
int third; // will not be colored

注释设置

int machineStatus <comment="This should be greater than 15.">;
int machineStatus <comment=MachineStatusComment>;
string MachineStatusComment( int status )
{
    if( status <= 15 )
        return "*** Invalid machine status";
    else
        return "Valid machine status";
}

显示名设置

byte _si8 <name="Signed Byte">;

顺序：在声明模板变量后，当前文件指针后移，通过FTell获取当前位置，通过FSeek FSkip移动指针通过ReadByte ReadShort ReadInt任意读取而不移动指针

局部变量

local int i, total = 0;
int recordCounts[5];
for( i = 0; i < 5; i++ )
total += recordCounts[i];
double records[ total ];

打开状态设置

<open=true/false>展开/收敛节点

字符串

char str[];
string str;
wchar_t str[];
wstring str;

隐藏设置

<hidden=true/false>

结构体联合体

struct myStruct {
    int a;
    int b;
    int c;
};

struct myStruct {
    int a;
    int b;
    int c;
} s1, s2;

struct myIfStruct {
    int a;
    if( a > 5 )
        int b;
    else
        int c;
} s;

struct {
    int width;
    struct COLOR {
        uchar r, g, b;
    } colors[width];
} line1;

typedef struct {
    ushort id;
    int size;
} myData;

union myUnion {
    ushort s;
    double d;
    int i;
} u;

//带参数结构体
struct VarSizeStruct (int arraySize)
{
int id;
int array[arraySize];
};

typedef struct (int arraySize)
{
int id;
int array[arraySize];
} VarSizeStruct;
VarSizeStruct s1(5);
VarSizeStruct s2(7);

010editor允许重复模板变量

int x;/x[0]
int y;
int x;//x[1]

local int i;
for( i = 0; i < 5; i++ )
int x;//x[0-5]

010editor默认认为结构体大小一致，这样生成大量结构体数组的速度较快，若实际结构体大小不一致则可能产生问题，此时用optimize=false，如下例：

typedef struct {
    int id;
    int length;
    uchar data[ length ];
} RECORD;
RECORD record[5] <optimize=false>;

位域

int alpha : 5;
int : 12;
int beta : 15;

enum <ushort> ENUM1 { VAL1_1=25, VAL1_2=29, VAL1_3=7 } var1 : 12;
enum <ushort> ENUM2 { VAL2_1=5, VAL2_2=6 } var2 : 4;

用户变量

指定如何显示和修改数据

typedef ushort FIXEDPT <read=FIXEDPTRead, write=FIXEDPTWrite>;
string FIXEDPTRead( FIXEDPT f )
{
    string s;
    SPrintf( s, "%lg", f / 256.0 );
    return s;
}
void FIXEDPTWrite( FIXEDPT &f, string s )
{
    f = (FIXEDPT)( Atof( s ) * 256 );
}

typedef float VEC3F[3] <read=Vec3FRead, write=Vec3FWrite>;
string Vec3FRead( VEC3F v )
{
    string s;
    SPrintf( s, "(%f %f %f)", v[0], v[1], v[2] );
    return s;
}
void Vec3FWrite( VEC3F &v, string s )
{
    SScanf( s, "(%f %f %f)", v[0], v[1], v[2] );
}

On-Demand结构体

通过指定size解决大量变量消耗内存问题

typedef struct
{
int header;
int value1;
int value2;
} MyStruct <size=12>;

typedef struct {
<...>
uint frCompressedSize;
uint frUncompressedSize;
ushort frFileNameLength;
ushort frExtraFieldLength;
if( frFileNameLength > 0 )
    char frFileName[ frFileNameLength ];
if( frExtraFieldLength > 0 )
    uchar frExtraField[ frExtraFieldLength ];
if( frCompressedSize > 0 )
    uchar frData[ frCompressedSize ];
} ZIPFILERECORD <size=SizeZIPFILERECORD>;

int SizeZIPFILERECORD( ZIPFILERECORD &r )
{
    return 30 + // base size of the struct
    ReadUInt(startof(r)+18) + // size of the compressed data
    ReadUShort(startof(r)+26) + // size of the file name
    ReadUShort(startof(r)+28); // size of the extra field
}

模板限制

禁止多维数组

typedef struct
{
    float row[4];
}
MATRIX[4];

MATRIX m;

接口函数

书签

void AddBookmark( int64 pos, string name, string typename, int arraySize=-1, int forecolor=cNone, int backcolor=0xffffc4, int moveWithCursor=false )
AddBookmark( GetCursorPos(), "endmarker","ZIPENDLOCATOR", -1, cRed );
int GetBookmarkArraySize( int index )
int GetBookmarkBackColor( int index )
int GetBookmarkForeColor( int index )
int GetBookmarkMoveWithCursor( int index )
string GetBookmarkName( int index )
int64 GetBookmarkPos( int index )
string GetBookmarkType( int index )
int GetNumBookmarks()
void RemoveBookmark( int index )
//断言
void Assert( int value, const char msg[] = "" )
Assert( numRecords > 10,"numRecords should be more than 10." );
//剪贴板
void ClearClipboard()
void CopyBytesToClipboard( uchar buffer[], int size, int charset=CHARSET_ANSI, int bigendian=false )
void CopyStringToClipboard( const char str[], int charset=CHARSET_ANSI )
void CopyToClipboard()
void CutToClipboard()
int GetClipboardBytes( uchar buffer[], int maxBytes )
int GetClipboardIndex()
string GetClipboardString()
void PasteFromClipboard()
int SetClipboardIndex( int index )

文件

int DeleteFile( char filename[] )    //删除文件，文件不能在编辑器中打开
void FileClose()//关闭当前文件
int FileCount()//获取editor打开的文件数
int FileExists( const char filename[] )//检测文件存在
int FileNew( char interface[]="", int makeActive=true )//创建爱你文件
int FileOpen( const char filename[], int runTemplate=false, char interface[]="", int openDuplicate=false )//打开文件
int FileSave() 
int FileSave( const char filename[] ) 
int FileSave( const wchar_t filename[] ) 
int FileSaveRange( const char filename[], int64 start, int64 size ) 
int FileSaveRange( const wchar_t filename[], int64 start, int64 size )//保存文件
void FileSelect( int index )//选择读写的文件
int FindOpenFile( const char path[] ) 
int FindOpenFileW( const wchar_t path[] )//查找并打开文件
int GetFileAttributesUnix()
int GetFileAttributesWin()
int SetFileAttributesUnix( int attributes )
int SetFileAttributesWin( int attributes )
int GetFileCharSet()
char[] GetFileInterface()
int SetFileInterface( const char name[] )
char[] GetFileName()
wchar_t[] GetFileNameW()
int GetFileNum()
int GetReadOnly()
int SetReadOnly( int readonly )
string GetTempDirectory()
char[] GetTempFileName()
char[] GetTemplateName() 
wchar_t[] GetTemplateNameW()
char[] GetTemplateFileName() 
wchar_t[] GetTemplateFileNameW()
char[] GetScriptName() 
wchar_t[] GetScriptNameW()
char[] GetScriptFileName() 
wchar_t[] GetScriptFileNameW()
char[] GetWorkingDirectory() 
wchar_t[] GetWorkingDirectoryW()
int RenameFile( const char originalname[], const char newname[] )
void RequiresFile()
void RequiresVersion( int majorVer, int minorVer=0, int revision=0 )
void RunTemplate( const char filename[]="", int clearOutput=false )
int SetWorkingDirectory( const char dir[] ) 
int SetWorkingDirectoryW( const wchar_t dir[] )

输入

char[] InputDirectory( const char title[], const char defaultDir[]="" )
double InputFloat( const char title[], const char caption[], const char defaultValue[] )
int InputNumber( const char title[], const char caption[], const char defaultValue[] )
char[] InputOpenFileName( char title[], char filter[]="All files (*.*)", char filename[]="" )
TOpenFileNames InputOpenFileNames( char title[], char filter[]="All files (*.*)", char filename[]="" )
	int i;
	TOpenFileNames f = InputOpenFileNames(
	"Open File Test",
	"C Files (*.c *.cpp)|All Files (*.*)" );
	for( i = 0; i < f.count; i++ )
	Printf( "%s\n", f.file[i].filename );
int InputRadioButtonBox( const char title[], const char caption[], int defaultIndex, const char str1[], const char str2[], const char str3[]="", const char str4[]="", const char str5[]="", const char str6[]="", const char str7[]="", const char str8[]="", const char str9[]="", const char str10[]="", const char str11[]="", const char str12[]="", const char str13[]="", const char str14[]="", const char str15[]="" )
char[] InputSaveFileName( char title[], char filter[]="All files (*.*)", char filename[]="", char extension[]="" )
char[] InputString( const char title[], const char caption[], const char defaultValue[] )
wstring InputWString( const char title[], const char caption[], const wstring defaultValue )
int InsertFile( const char filename[], int64 position )
int IsEditorFocused()
int IsModified()
int IsNoUIMode()
int MessageBox( int mask, const char title[], const char format[] [, argument, ... ] )
void OutputPaneClear()
int OutputPaneSave( const char filename[] )
void OutputPaneCopy()
int Printf( const char format[] [, argument, ... ] )
	Printf( "Num = %d, Float = %lf, Str = '%s'\n", 15, 5, "Test" );
void StatusMessage( const char format[] [, argument, ... ] )

int64 GetSelSize()
int64 GetSelStart()
void SetSelection( int64 start, int64 size )

//颜色
int GetForeColor()
int GetBackColor()
void SetBackColor( int color ) 
void SetColor( int forecolor, int backcolor ) 
void SetForeColor( int color )

int GetBytesPerLine()//获取显示列数

//时间
string GetCurrentTime( char format[] = "hh:mm:ss" )
string GetCurrentDate( char format[] = "MM/dd/yyyy" )
string GetCurrentDateTime( char format[] = "MM/dd/yyyy hh:mm:ss" )

void DisableUndo()//禁止undo
void EnableUndo()//允许undo

//设置显示值
void DisplayFormatBinary() 
void DisplayFormatDecimal() 
void DisplayFormatHex() 
void DisplayFormatOctal()

int Exec( const char program[], const char arguments[], int wait=false ) int Exec( const char program[], const char arguments[], int wait, int &errorCode )
void Exit( int errorcode )
void Warning( const char format[] [, argument, ... ] )
void Terminate( int force=true )
char[] GetArg( int index ) wchar_t[] GetArgW( int index )//获取传递给脚本的命令
char[] GetEnv( const char str[] )//获取环境变量
int SetEnv( const char str[], const char value[] )
int GetNumArgs()

void ExpandAll()//展开节点
void ExportCSV( const char filename[] )//导出
void ExportXML( const char filename[] )//导出

int64 GetCursorPos()//获取当前指针
void SetCursorPos( int64 pos )
void Sleep( int milliseconds )

I/O函数

void BigEndian()//设置大小头端
int IsBigEndian()
int IsLittleEndian()
void LittleEndian()

double ConvertBytesToDouble( uchar byteArray[] ) //数据转换
float ConvertBytesToFloat( uchar byteArray[] ) 
hfloat ConvertBytesToHFloat( uchar byteArray[] )
int ConvertDataToBytes( data_type value, uchar byteArray[] )
void DeleteBytes( int64 start, int64 size )//删除数据
void InsertBytes( int64 start, int64 size, uchar value=0 )//插入数据
void OverwriteBytes( int64 start, int64 size, uchar value=0 )

char ReadByte( int64 pos=FTell() ) //读取数据
double ReadDouble( int64 pos=FTell() ) 
float ReadFloat( int64 pos=FTell() ) 
hfloat ReadHFloat( int64 pos=FTell() ) 
int ReadInt( int64 pos=FTell() ) 
int64 ReadInt64( int64 pos=FTell() ) 
int64 ReadQuad( int64 pos=FTell() ) 
short ReadShort( int64 pos=FTell() )
uchar ReadUByte( int64 pos=FTell() ) 
uint ReadUInt( int64 pos=FTell() ) 
uint64 ReadUInt64( int64 pos=FTell() ) 
uint64 ReadUQuad( int64 pos=FTell() ) 
ushort ReadUShort( int64 pos=FTell() )
void ReadBytes( uchar buffer[], int64 pos, int n )
char[] ReadString( int64 pos, int maxLen=-1 )
int ReadStringLength( int64 pos, int maxLen=-1 )
wstring ReadWString( int64 pos, int maxLen=-1 )
int ReadWStringLength( int64 pos, int maxLen=-1 )
wstring ReadWLine( int64 pos, int maxLen=-1 )
char[] ReadLine( int64 pos, int maxLen=-1, int includeLinefeeds=true )

void WriteByte( int64 pos, char value ) //写入数据
void WriteDouble( int64 pos, double value ) 
void WriteFloat( int64 pos, float value ) 
void WriteHFloat( int64 pos, float value ) 
void WriteInt( int64 pos, int value ) 
void WriteInt64( int64 pos, int64 value ) 
void WriteQuad( int64 pos, int64 value ) 
void WriteShort( int64 pos, short value ) 
void WriteUByte( int64 pos, uchar value ) 
void WriteUInt( int64 pos, uint value ) 
void WriteUInt64( int64 pos, uint64 value ) 
void WriteUQuad( int64 pos, uint64 value ) 
void WriteUShort( int64 pos, ushort value )
void WriteBytes( const uchar buffer[], int64 pos, int n )
void WriteString( int64 pos, const char value[] )
void WriteWString( int64 pos, const wstring value )

int DirectoryExists( string dir )
int MakeDir( string dir )
int FEof()
int64 FileSize()
TFileList FindFiles( string dir, string filter )
	TFileList fl = FindFiles( "C:\\temp\\", "*.zip" );
	int i;
	Printf( "Num files = %d\n", fl.filecount );
	for( i = 0; i < fl.filecount; i++ )
	{
	Printf( " %s\n", fl.file[i].filename );
	}
	Printf( "\n" );
	Printf( "Num dirs = %d\n", fl.dircount );
	for( i = 0; i < fl.dircount; i++ )
	{
	Printf( " %s\n", fl.dir[i].dirname );
	}
int FPrintf( int fileNum, char format[], ... )
int FSeek( int64 pos )
int FSkip( int64 offset )
int64 FTell()

int64 TextAddressToLine( int64 address )
int TextAddressToColumn( int64 address )
int64 TextColumnToAddress( int64 line, int column )
int64 TextGetNumLines()
int TextGetLineSize( int64 line, int includeLinefeeds=true )
int64 TextLineToAddress( int64 line )
int TextReadLine( char buffer[], int64 line, int maxsize, int includeLinefeeds=true )
int TextReadLineW( wchar_t buffer[], int64 line, int maxsize, int includeLinefeeds=true )
void TextWriteLineW( const wchar_t buffer[], int64 line, int includeLinefeeds=true )
void TextWriteLine( const char buffer[], int64 line, int includeLinefeeds=true )

字符串函数

//类型转换
double Atof( const char s[] )
int Atoi( const char s[] )
int64 BinaryStrToInt( const char s[] )
	return BinaryStrToInt( "01001101" );
char[] ConvertString( const char src[], int srcCharSet, int destCharSet )
	CHARSET_ASCII CHARSET_ANSI CHARSET_OEM CHARSET_EBCDIC CHARSET_UNICODE CHARSET_MAC CHARSET_ARABIC CHARSET_BALTIC CHARSET_CHINESE_S CHARSET_CHINESE_T CHARSET_CYRILLIC CHARSET_EASTEUROPE CHARSET_GREEK CHARSET_HEBREW CHARSET_JAPANESE CHARSET_KOREAN_J CHARSET_KOREAN_W CHARSET_THAI CHARSET_TURKISH CHARSET_VIETNAMESE CHARSET_UTF8
string DosDateToString( DOSDATE d, char format[] = "MM/dd/yyyy" )
string DosTimeToString( DOSTIME t, char format[] = "hh:mm:ss" )
string EnumToString( enum e )
string FileTimeToString( FILETIME ft, char format[] = "MM/dd/yyyy hh:mm:ss" )
	int hour, minute, second, day, month, year;
	string s = FileTimeToString( ft );
	SScanf( s, "%02d/%02d/%04d %02d:%02d:%02d",
	month, day, year, hour, minute, second );
	year++;
	SPrintf( s, "%02d/%02d/%04d %02d:%02d:%02d",
	month, day, year, hour, minute, second );
int StringToDosDate( string s, DOSDATE &d, char format[] = "MM/dd/yyyy" )
int StringToDosTime( string s, DOSTIME &t, char format[] = "hh:mm:ss" )
int StringToFileTime( string s, FILETIME &ft, char format[] = "MM/dd/yyyy hh:mm:ss" )
int StringToOleTime( string s, OLETIME &ot, char format[] = "MM/dd/yyyy hh:mm:ss" )
int StringToTimeT( string s, time_t &t, char format[] = "MM/dd/yyyy hh:mm:ss" )
char[] StringToUTF8( const char src[], int srcCharSet=CHARSET_ANSI )
wstring StringToWString( const char str[], int srcCharSet=CHARSET_ANSI )

//内存操作
int Memcmp( const uchar s1[], const uchar s2[], int n )
void Memcpy( uchar dest[], const uchar src[], int n, int destOffset=0, int srcOffset=0 )
void Memset( uchar s[], int c, int n )
string OleTimeToString( OLETIME ot, char format[] = "MM/dd/yyyy hh:mm:ss" )
int RegExMatch( string str, string regex ); //正则匹配
int RegExMatchW( wstring str, wstring regex );
int RegExSearch( string str, string regex, int &matchSize, int startPos=0 ); 
int RegExSearchW( wstring str, wstring regex, int &matchSize, int startPos=0 );
	if( RegExMatch( "test@test.ca",
	"\\b[A-Za-z0-9.%_+\\-]+@[A-Za-z0-9.\\-]+\\.[A-Za-z]{2,4}\\b" )
	== false )
	{
	Warning( "Invalid email address" );
	return -1;
	}
	int result, size;
	result = RegExSearch(
	"12:03:23 AM - 192.168.0.10 : www.sweetscape.com/",
	"\\d{1,3}\\.\\d{1,3}.\\d{1,3}.\\d{1,3}", size );
	Printf( "Match at pos %d of size %d\n", result, size );
void Strcat( char dest[], const char src[] )
int Strchr( const char s[], char c )
int Strcmp( const char s1[], const char s2[] ) 
void Strcpy( char dest[], const char src[] )
char[] StrDel( const char str[], int start, int count ) 
int Stricmp( const char s1[], const char s2[] )
int Strlen( const char s[] )
int Strncmp( const char s1[], const char s2[], int n )
void Strncpy( char dest[], const char src[], int n ) 
int Strnicmp( const char s1[], const char s2[], int n )
int Strstr( const char s1[], const char s2[] )
char[] SubStr( const char str[], int start, int count=-1 )
string TimeTToString( time_t t, char format[] = "MM/dd/yyyy hh:mm:ss" )
char ToLower( char c ) wchar_t ToLowerW( wchar_t c )
char ToUpper( char c ) wchar_t ToUpperW( wchar_t c )
void WMemcmp( const wchar_t s1[], const wchar_t s2[], int n )
void WMemcpy( wchar_t dest[], const wchar_t src[], int n, int destOffset=0, int srcOffset=0 )
void WMemset( wchar_t s[], int c, int n )
void WStrcat( wchar_t dest[], const wchar_t src[] )
int WStrchr( const wchar_t s[], wchar_t c )
int WStrcmp( const wchar_t s1[], const wchar_t s2[] )
void WStrcpy( wchar_t dest[], const wchar_t src[] )
wchar_t[] WStrDel( const whar_t str[], int start, int count ) 
int WStricmp( const wchar_t s1[], const wchar_t s2[] )
char[] WStringToString( const wchar_t str[], int destCharSet=CHARSET_ANSI )
char[] WStringToUTF8( const wchar_t str[] )
int WStrlen( const wchar_t s[] )
int WStrncmp( const wchar_t s1[], const wchar_t s2[], int n )
void WStrncpy( wchar_t dest[], const wchar_t src[], int n )
int WStrnicmp( const wchar_t s1[], const wchar_t s2[], int n ) 
int WStrstr( const wchar_t s1[], const wchar_t s2[] )
wchar_t[] WSubStr( const wchar_t str[], int start, int count=-1 )

char[] FileNameGetBase( const char path[], int includeExtension=true ) //获取文件名
wchar_t[] FileNameGetBaseW( const wchar_t path[], int includeExtension=true )
char[] FileNameGetExtension( const char path[] ) 
wchar_t[] FileNameGetExtensionW( const wchar_t path[] )
char[] FileNameGetPath( const char path[], int includeSlash=true ) 
wchar_t[] FileNameGetPathW( const wchar_t path[], int includeSlash=true )
char[] FileNameSetExtension( const char path[], const char extension[] ) 
wchar_t[] FileNameSetExtensionW( const wchar_t path[], const wchar_t extension[] ) 

//格式化字符串
int SPrintf( char buffer[], const char format[] [, argument, ... ] )
int SScanf( char str[], char format[], ... )

数学函数

double Abs( double x )
double Ceil( double x )
double Cos( double a )
double Exp( double x )
double Floor( double x)
double Log( double x )
double Max( double a, double b )
double Min( double a, double b)
double Pow( double x, double y)
int Random( int maximum )
double Sin( double a )
double Sqrt( double x )
data_type SwapBytes( data_type x )
double Tan( double a )

//工具函数

//计算校验和
int64 Checksum( int algorithm, int64 start=0, int64 size=0, int64 crcPolynomial=-1, int64 crcInitValue=-1 )
	CHECKSUM_BYTE CHECKSUM_SHORT_LE CHECKSUM_SHORT_BE CHECKSUM_INT_LE CHECKSUM_INT_BE CHECKSUM_INT64_LE CHECKSUM_INT64_BE CHECKSUM_SUM8 CHECKSUM_SUM16 CHECKSUM_SUM32 CHECKSUM_SUM64 CHECKSUM_CRC16 CHECKSUM_CRCCCITT CHECKSUM_CRC32 CHECKSUM_ADLER32
int ChecksumAlgArrayStr( int algorithm, char result[], uchar *buffer, int64 size, char ignore[]="", int64 crcPolynomial=-1, int64 crcInitValue=-1 )
int ChecksumAlgArrayBytes( int algorithm, uchar result[], uchar *buffer, int64 size, char ignore[]="", int64 crcPolynomial=-1, int64 crcInitValue=-1 )
int ChecksumAlgStr( int algorithm, char result[], int64 start=0, int64 size=0, char ignore[]="", int64 crcPolynomial=-1, int64 crcInitValue=-1 )
int ChecksumAlgBytes( int algorithm, uchar result[], int64 start=0, int64 size=0, char ignore[]="", int64 crcPolynomial=-1, int64 crcInitValue=-1 )

//查找比较
TCompareResults Compare( int type, int fileNumA, int fileNumB, int64 startA=0, int64 sizeA=0, int64 startB=0, int64 sizeB=0, int matchcase=true, int64 maxlookahead=10000, int64 minmatchlength=8, int64 quickmatch=512 )
	int i, f1, f2;
	FileOpen( "C:\\temp\\test1" );
	f1 = GetFileNum();
	FileOpen( "C:\\temp\\test2" );
	f2 = GetFileNum();
	TCompareResults r = Compare( COMPARE_SYNCHRONIZE, f1, f2 );
	for( i = 0; i < r.count; i++ )
	{
	Printf( "%d %Ld %Ld %Ld %Ld\n",
	r.record[i].type,
	r.record[i].startA,
	r.record[i].sizeA,
	r.record[i].startB,
	r.record[i].sizeB );
	}
TFindResults FindAll( <datatype> data, int matchcase=true, int wholeword=false, int method=0, double tolerance=0.0, int dir=1, int64 start=0, int64 size=0, int wildcardMatchLength=24 )
	int i;
	TFindResults r = FindAll( "Test" );
	Printf( "%d\n", r.count );
	for( i = 0; i < r.count; i++ )
	Printf( "%Ld %Ld\n", r.start[i], r.size[i] );
int64 FindFirst( <datatype> data, int matchcase=true, int wholeword=false, int method=0, double tolerance=0.0, int dir=1, int64 start=0, int64 size=0, int wildcardMatchLength=24 )
TFindInFilesResults FindInFiles( <datatype> data, char dir[], char mask[], int subdirs=true, int openfiles=false, int matchcase=true, int wholeword=false, int method=0, double tolerance=0.0, int wildcardMatchLength=24 )
	int i, j;
	TFindInFilesResults r = FindInFiles( "PK",
	"C:\\temp", "*.zip" );
	Printf( "%d\n", r.count );
	for( i = 0; i < r.count; i++ )
	{
	Printf( " %s\n", r.file[i].filename );
	Printf( " %d\n", r.file[i].count );
	for( j = 0; j < r.file[i].count; j++ )
	Printf( " %Ld %Ld\n",
	r.file[i].start[j],
	r.file[i].size[j] );
	}
int64 FindNext( int dir=1 )
TFindStringsResults FindStrings( int minStringLength, int type, int matchingCharTypes, wstring customChars="", int64 start=0, int64 size=0, int requireNull=false )
	TFindStringsResults r = FindStrings( 5, FINDSTRING_ASCII,
	FINDSTRING_LETTERS | FINDSTRING_CUSTOM, "$&" );
	Printf( "%d\n", r.count );
	for( i = 0; i < r.count; i++ )
	Printf( "%Ld %Ld %d\n", r.start[i], r.size[i], r.type[i] );
	
//类型转换
char ConvertASCIIToEBCDIC( char ascii )
void ConvertASCIIToUNICODE( int len, const char ascii[], ubyte unicode[], int bigendian=false )
void ConvertASCIIToUNICODEW( int len, const char ascii[], ushort unicode[] ) 
char ConvertEBCDICToASCII( char ebcdic )
void ConvertUNICODEToASCII( int len, const ubyte unicode[], char ascii[], int bigendian=false )
void ConvertUNICODEToASCIIW( int len, const ushort unicode[], char ascii[] )

int ExportFile( int type, char filename[], int64 start=0, int64 size=0, int64 startaddress=0,int bytesperrow=16, int wordaddresses=0 )
int ImportFile( int type, char filename[], int wordaddresses=false, int defaultByteValue=-1 )
int GetSectorSize()	
int HexOperation( int operation, int64 start, int64 size, operand, step=0, int64 skip=0 )
int64 Histogram( int64 start, int64 size, int64 result[256] )
int IsDrive()
int IsLogicalDrive()
int IsPhysicalDrive()
int IsProcess()
int OpenLogicalDrive( char driveletter )
int OpenPhysicalDrive( int physicalID )
int OpenProcessById( int processID, int openwriteable=true )
int OpenProcessByName( char processname[], int openwriteable=true )
int ReplaceAll( <datatype> finddata, <datatype> replacedata, int matchcase=true, int wholeword=false, int method=0, double tolerance=0.0, int dir=1, int64 start=0, int64 size=0, int padwithzeros=false, int wildcardMatchLength=24 )

←

C++逆向分析技巧

Android逆向分析笔记

→