0

I'm working with some binary data which have similar matches throughout the code. For example "a6636f6f726473" is one of those matches. Now I want to do a reverse search for first match, the letter a and the number I don't know yet, and return the position of all the found matches in the file.

Example: In string a7a36d617815a7536b697070657284a6636f6f72647383 I want it to find a7536b697070657284a6636f6f72647383 and return the position 12. The only unique string is a6636f6f72647383 and want to do a reverse search for the first char a it finds which gives me a7536b697070657284a6636f6f72647383 and then I want to figure out the position of a7.

Hopefully this makes any sense and someone can push me to get into the right direction on how to parse this in Python.

-J

MrJ
  • 11
  • 2
  • [`str.rindex`](https://docs.python.org/3/library/stdtypes.html#str.rindex) ? – ssp Dec 26 '20 at 20:36
  • 1
    `re.finditer()` might be able to help find all occurrences, if you want multiple: https://stackoverflow.com/questions/3519565/find-the-indexes-of-all-regex-matches – Green Cloak Guy Dec 26 '20 at 20:41
  • str.find could also help! – grumpyp Dec 26 '20 at 20:46
  • @GreenCloakGuy That might work but I'm not strong in my regex. `(?<=a[0-9])(.*?)(?=a6636f6f726473)` I only need to find the first `a` it encounters in a reverse match of `a6636f6f726473`. Because between the `a` and `a6636f6f726473` it's a random hex value. – MrJ Dec 26 '20 at 21:31

1 Answers1

1

Thanks to Green Cloak Guy pushing me in the right direction. I've solved my problem and I'll share my findings and share it with the community if anyone stumbles with the same problem.

The normal python re does not support the reverse flag. I've found a python module which is up to date called regex. You can find it at https://pypi.org/project/regex/

a = [m.start(0) for m in regex.finditer(r'(?r)(?:a).*?(?=a6636f6f726473)', "a7a36d617815a7536b697070657284a6636f6f72647383")]

print(a)

Now returns position 12

MrJ
  • 11
  • 2