And although Hex Editor Neo does not (yet) support macros, we were able to offer him a simple yet powerful solution.
Below is a sample structure definition file among with accompaning script file.
First, we create a structure.h file:
- Code: Select all
structure.h:
#include "stddefs.h"
#pragma script("script.js") // connect our script file here
struct StructureToBindAtSignatureLocation // this is a structure to be bound on each occurrence of a signature
{
char str[2];
};
public struct BindMeToStartOfTheFile
{
[noindex] struct
{
var GapSize = LocateSignature(current_offset);
if (GapSize == -1)
$break_array(false); // no more occurrences in a document, exit
hidden:
char Reserved[GapSize]; // skip GapSize bytes
visible:
StructureToBindAtSignatureLocation stb;
} array[*];
};
And a script file:
- Code: Select all
script.js:
function LocateSignature(starting_offset)
{
// Create an empty sequence object
var sequence = document.CreateSequence();
sequence.AddData(0,0x0d,0x0a); // specify your signature here
// Create an empty selection object
var selection = document.CreateEmptySelection();
selection.AddRange(0, document.FileSize);
var signature_offset;
try
{
signature_offset = document.ToNumber(document.FindS(sequence, selection, starting_offset, false, false));
} catch (e)
{
return -1;
}
return signature_offset - starting_offset;
}
Now, if you bind a BindMeToStartOfTheFile structure to the beginning of the document, you will get an array of bound StructureToBindAtSignatureLocation structures at correct locations!
The magic here lies in the LocateSignature script function, which is called by the Structure Viewer. The purpose of this function is to find the next occurrence of a pattern and return a size of a "gap" between the previous occurrence of a pattern (or the beginning of the file) and the next one.
This gap size is then used as an array argument to "skip" the gap, and then the StructureToBindAtSignatureLocation structure is instantiated.
Extending a structure definitions with a user created functions is a very powerful technique, as a scripting function has a full access to the underlying document as well as a Structure Viewer module itself. For example, it may call Structure Viewer to evaluate expressions, add late bound structures, print debug messages and so on.
Several usage examples are provided in the sample structure definition files, installed with Hex Editor Neo.