从字节数组中获取具有不同字节的所有字节模式？

Question

How can I match a byte array to a larger byte array and get the unique data and the location in the byte array that the pattern ends?

---

FF FF FF FF XX XX XX XX FF FF FF FF (any length of any bytes goes here) 2E XX XX XX 00

---

I have the above pattern (where XX is any byte) and i need to get bolded parts plus the location in the array of the last byte, How can I do this? (note: I need to get all occurrences of this pattern)

I cannot convert it to a string as it has null bytes (0x00) and they are often part of the first four XX XX XX XX bytes.

I've been trying to figure this out for a while now and would appreciate it if you guys could help me out! Thanks.

Edit: the above bytes are in hex

Answer 1

Who says you can't convert it to a string?

byte[] bytes = new byte[]
{
    0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x31, 0x32, 0x33, 0x34, 0xff, 0x2a, 0x00
};
var s = Encoding.Default.GetString(bytes);
Console.WriteLine(bytes.Length);
Console.WriteLine(s.Length);
foreach (var c in s)
{
    Console.Write("0x{0:X2}, ", (int)c);
}
Console.WriteLine();

Both the array and the string are shown with a length of 13. And the bytes output from the string are the same as the bytes in the array.

You can convert it to a string. Then you can use regular expressions to find what you're looking for.

Note that Encoding.Default might not be what you're looking for. You want an 8-byte encoding that doesn't modify any of the characters.

But if you want an algorithmic way to do it, there are a couple of ways that spring to mind. First way (and probably easiest) is to scan forward looking for 2E followed by three bytes, and then a 00 . Then start at the beginning again and see if you find FF FF FF FF XX XX XX XX FF FF FF FF . That's not the fastest way to do things, but it's pretty easy.

Note that if you search backwards from the 2E , you could end up "finding" a shorter string. That is, if your input was:

FF FF FF FF XX XX XX XX FF FF FF FF 01 02 FF FF FF FF XX XX XX XX FF FF FF FF 0A 0B 2E XX XX XX 00

There are two occurrences of the starting pattern. If you searched backwards from the 2E , you'd match the second one, which probably isn't what you want.

The other way is to build yourself a little state machine that searches forward. That'll be faster, but a bit more difficult.