internal ExtractedString(string value, long offset, ExtractedStringType type, string source) { Value = value; Offset = offset; Type = type; Source = source; }
private static IEnumerable <ExtractedString> Extract(Stream data, long base_offset, int minimum_length, ExtractedStringType type, string source) { if (data is null) { throw new ArgumentNullException(nameof(data)); } if (minimum_length <= 0) { throw new ArgumentException("Must specify a minimum length of at least 1."); } StringBuilder ascii = new StringBuilder(); StringBuilder unicode = new StringBuilder(); StringBuilder unicode_unaligned = new StringBuilder(); bool parse_ascii = type.HasFlagSet(ExtractedStringType.Ascii); bool parse_unicode = type.HasFlagSet(ExtractedStringType.Unicode); byte[] unicode_char = new byte[2]; int b = data.ReadByte(); long i = 0; while (b >= 0) { if (parse_ascii) { char c = (char)b; if (IsPrintable(c)) { ascii.Append(c); } else { if (ascii.Length >= minimum_length) { yield return(ascii.CreateResult(base_offset, i, ExtractedStringType.Ascii, source)); } ascii.Clear(); } } if (parse_unicode) { unicode_char[0] = unicode_char[1]; unicode_char[1] = (byte)b; char c = BitConverter.ToChar(unicode_char, 0); if ((i & 1) == 1) { if (IsPrintable(c)) { unicode.Append(c); } else { if (unicode.Length >= minimum_length) { yield return(unicode.CreateResult(base_offset, i, ExtractedStringType.Unicode, source)); } unicode.Clear(); } } else if (i > 1) { if (IsPrintable(c)) { unicode_unaligned.Append(c); } else { if (unicode_unaligned.Length >= minimum_length) { yield return(unicode_unaligned.CreateResult(base_offset, i, ExtractedStringType.Unicode, source)); } unicode_unaligned.Clear(); } } } i++; b = data.ReadByte(); } if (ascii.Length >= minimum_length) { yield return(ascii.CreateResult(base_offset, i, ExtractedStringType.Ascii, source)); } if (unicode.Length >= minimum_length) { yield return(unicode.CreateResult(base_offset, i, ExtractedStringType.Unicode, source)); } if (unicode_unaligned.Length >= minimum_length) { yield return(unicode_unaligned.CreateResult(base_offset, i, ExtractedStringType.Unicode, source)); } }
private static ExtractedString CreateResult(this StringBuilder builder, long base_offset, long i, ExtractedStringType type, string source) { int str_length = type.HasFlagSet(ExtractedStringType.Unicode) ? (builder.Length * 2 + 1) : builder.Length; return(new ExtractedString(builder.ToString(), base_offset + i - str_length, type, source)); }
/// <summary> /// Extracts strings from a safe buffer. /// </summary> /// <param name="buffer">Safe buffer to extract the value from.</param> /// <param name="minimum_length">The minimum string length.</param> /// <param name="type">The type of strings to search for.</param> /// <param name="count">The length of the data to search.</param> /// <param name="offset">The offset into the data to search.</param> /// <returns>The list of extracted strings.</returns> public static IEnumerable <ExtractedString> Extract(SafeBuffer buffer, int offset, int count, int minimum_length, ExtractedStringType type) { return(Extract(new UnmanagedMemoryStream(buffer, offset, count), buffer.DangerousGetHandle().ToInt64() + offset, minimum_length, type, string.Empty)); }
/// <summary> /// Extracts strings from a safe buffer. /// </summary> /// <param name="buffer">Safe buffer to extract the value from.</param> /// <param name="minimum_length">The minimum string length.</param> /// <param name="type">The type of strings to search for.</param> /// <returns>The list of extracted strings.</returns> public static IEnumerable <ExtractedString> Extract(SafeBuffer buffer, int minimum_length, ExtractedStringType type) { return(Extract(buffer, 0, buffer.GetLength(), minimum_length, type)); }
/// <summary> /// Extracts strings from a file. /// </summary> /// <param name="path">The file to search.</param> /// <param name="minimum_length">The minimum string length.</param> /// <param name="type">The type of strings to search for.</param> /// <returns>The list of extracted strings.</returns> public static IEnumerable <ExtractedString> Extract(string path, int minimum_length, ExtractedStringType type) { using (var stm = File.OpenRead(path)) { foreach (var res in Extract(stm, 0, minimum_length, type, stm.Name)) { yield return(res); } } }
/// <summary> /// Extracts strings from a stream. /// </summary> /// <param name="stm">The stream to extract strings from.</param> /// <param name="minimum_length">The minimum string length.</param> /// <param name="type">The type of strings to search for.</param> /// <returns>The list of extracted strings.</returns> public static IEnumerable <ExtractedString> Extract(Stream stm, int minimum_length, ExtractedStringType type) { return(Extract(stm, 0, minimum_length, type, string.Empty)); }
/// <summary> /// Extracts strings from a binary buffer. /// </summary> /// <param name="data">The data to search.</param> /// <param name="minimum_length">The minimum string length.</param> /// <param name="type">The type of strings to search for.</param> /// <returns>The list of extracted strings.</returns> public static IEnumerable <ExtractedString> Extract(byte[] data, int minimum_length, ExtractedStringType type) { return(Extract(data, 0, data.Length, minimum_length, type)); }
/// <summary> /// Extracts strings from a binary buffer. /// </summary> /// <param name="data">The data to search.</param> /// <param name="count">The length of the data to search.</param> /// <param name="minimum_length">The minimum string length.</param> /// <param name="offset">The offset into the data to search.</param> /// <param name="type">The type of strings to search for.</param> /// <returns>The list of extracted strings.</returns> public static IEnumerable <ExtractedString> Extract(byte[] data, int offset, int count, int minimum_length, ExtractedStringType type) { return(Extract(new MemoryStream(data, offset, count), offset, minimum_length, type, string.Empty)); }