[Win32] Regexing a pattern from a binary file?

[Fred the man]

Hi,

I'm a PHP newbie, and am stuck as to why I can't find a pattern in a
Win32 binary file.

I'm actually trying to extract the FileVersion information myself
since PHP under Unix doesn't seem to offer support for the PE file
format:

-------------
<?php
$file = "C:\\temp\\test .exe";
$fp = fopen($file, "rb");
$contents = fread($fp, filesize($file) );
fclose($fp);

//Unicode?
//If (eregi('F.i.l.e .V.e.r.s.i.o.n' , $contents)) {
//if (eregi('FileVer sion', $contents)) {

if (eregi("This program cannot be run in DOS mode",
$contents)) {
print "OK!";
} else {
print "Outta luck...";
}
exit;

?>
-------------

Any idea?

Thank you for any tip
Fred.

[Chung Leong]

Re: [Win32] Regexing a pattern from a binary file?


"Fred the man" <fred@acme.co m> wrote in message
news:le84d01to1 hpk8p9iuo36e1en 65r9ub87l@4ax.c om...[color=blue]
> Hi,
>
> I'm a PHP newbie, and am stuck as to why I can't find a pattern in a
> Win32 binary file.
>
> I'm actually trying to extract the FileVersion information myself
> since PHP under Unix doesn't seem to offer support for the PE file
> format:
>
> -------------
> <?php
> $file = "C:\\temp\\test .exe";
> $fp = fopen($file, "rb");
> $contents = fread($fp, filesize($file) );
> fclose($fp);
>
> //Unicode?
> //If (eregi('F.i.l.e .V.e.r.s.i.o.n' , $contents)) {
> //if (eregi('FileVer sion', $contents)) {
>
> if (eregi("This program cannot be run in DOS mode",
> $contents)) {
> print "OK!";
> } else {
> print "Outta luck...";
> }
> exit;[/color]

Hmmm, maybe the Posix RegExp library isn't binary safe? Use the Perl 5 set
of functions instead:

$fv = 'F\0i\0l\0e\0V\ 0e\0r\0s\0i\0o\ 0n\0';
$tz = '\0\0\0\0';

if(preg_match("/$fv$tz(.*?)$tz/", $contents, $matches)) {
echo str_replace("\0 ", "", $matches[1]);
}

[Fred]

Re: [Win32] Regexing a pattern from a binary file?

On Thu, 17 Jun 2004 19:44:31 -0400, "Chung Leong"
<chernyshevsky@ hotmail.com> wrote:[color=blue]
>Hmmm, maybe the Posix RegExp library isn't binary safe? Use the Perl 5 set
>of functions instead:[/color]

Thx Chung :-) Indeed, it seems erg() doesn't like non-printable
characters.

For those interested in searching a pattern that may contain ASCII
0's, here's the code:

-----------------
$file = "c:\\temp\\test .exe";
$fp = fopen($file, "rb");
$contents = fread($fp, filesize($file) );
fclose($fp);

$fv = 'F\0i\0l\0e\0V\ 0e\0r\0s\0i\0o\ 0n\0\0\0\0\0';
$tz = "\0\0";
if(preg_match("/$fv(.*?)$tz/", $contents, $matches)) {
//Looking for eg. 1.000 with 0's in between
if (preg_match("/(\\d)\\0\.\\0(\ \d+)\\0(\\d+)\\ 0
(\\d+)\\0/",$matches[1],$version)) {
print "Version1=$vers ion[1]<p>";
print "Version2=$vers ion[2]<p>";
print "Version3=$vers ion[3]<p>";
print "Version4=$vers ion[4]<p>";
} else {
print "Sorry";
} else {
print "BAD";
}
---------------------

If you wish to replace ASCII 0's with eg. #, here's the code:
---------------
//\x = by default, means \x0, ie. match any ASCII 0 :-)
$output=preg_re place('/\x00/','#',$matches[1]);
---------------

I haven't found how to replace a character with a TAB (\t, or \\t, or
\\\\t don't work.)

Thx again
Fred.