This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=11008

Shokoniraya, posted Fri Mar 08, 2019 6:32 pm (45594)

---

i dont know its a problem or not, but i will tell you anyway, aluigi

Code:

print "TEST1"
findloc OBJE binary "\x4F\x42\x4A\x45"
print "%OBJE%"
print "TEST2"

you can see a file with name inw and a bat file to do it, but if i remove OBJE in offset 22 in inw file with hex, then rest of script can be start to print other part! (its happen just if binary cant find with findloc)

test.zip

atom0s, posted Fri Mar 08, 2019 7:40 pm (45596)

---

Not sure what your issue is, looks to work fine for me.
Prints:

TEST1
22
TEST2

If I remove the pattern, it prints:
TEST1

Looks to work fine.

aluigi, posted Fri Mar 08, 2019 11:19 pm (45603)

---

Just to stay safe I think that it's ever better to use variable names that don't match the constant value, even if it's a binary value.

@Shokoniraya
Try calling the OBJE variable as TEST and check if you still have the problem.

Shokoniraya, posted Sat Mar 09, 2019 12:11 am (45611)

---

nothing changed and still has problem

aluigi, posted Sat Mar 09, 2019 12:26 am (45612)

---

I don't see any problem, everything works perfectly.
Remember that findloc terminates quickbms by default if the pattern is not found.
Are you sure you don't need to use the following?

findloc OBJE binary "\x4F\x42\x4A\x45" 0 "NOT FOUND"

Shokoniraya, posted Mon Mar 18, 2019 4:37 pm (45871)

---

And I want to ask something
is there any way to find a binary with a unknow byte?
Like this: "\xFF\xFF\XFF\x??\xFE"
because \x?? has a different value in every files and how can i solve that?

aluigi, posted Mon Mar 18, 2019 7:23 pm (45874)

---

Unfortunately doesn't exist a jolly character for findloc

Shokoniraya, posted Wed Mar 20, 2019 2:36 pm (45910)

---

solved with findloc OBJE binary "" 0 ""
looks like quickbms has problem with string NAME p in -s option and that is why my script not working

aluigi, posted Tue Mar 26, 2019 2:45 pm (46032)

---

There is not "string NAME p" in your posts.
Are you sure you used it correctly?

Shokoniraya, posted Sun Mar 31, 2019 9:29 am (46234)

---

aluigi wrote:

There is not "string NAME p" in your posts.
Are you sure you used it correctly?

No, findloc problem solved with "" 0 ""
so, string NAME p has problem in -s option, that's a new problem

aluigi, posted Sun Mar 31, 2019 12:58 pm (46250)

---

Show me how you used the -s option, full command.

Shokoniraya, posted Tue Apr 02, 2019 9:09 am (46373)

---

aluigi wrote:

Show me how you used the -s option, full command.

Code:

quickbms.exe -s "get SIZE asize ; get NAMER basename ; string NAME p \"%s%s\" \"FILE_\" NAMER ; log NAME 0 SIZE" "" MY_FILE.7z
pause

file name will turning to s
but string NAME YOUR_STRING will works fine
so i can use same as above line and just check it and you will see (tested on quickbms 9.2.0)
and can you test -s option on huge scripts? (long scripts, a script with a lot on line (huge), sorry more my limited grammer)

i think there is another problem with huge scripts, can you test it? or its because string NAME p?

aluigi, posted Tue Apr 02, 2019 3:39 pm (46384)

---

Here it works correctly.
I used it on file2.bin and it tried to dump the file FILE_file2

Shokoniraya, posted Sat Apr 06, 2019 9:53 am (46520)

---

file name will dump as s
Windows: 8.1
QuickBMS version: 9.2.0
i replaced (") to (\") and i replace enter to ( ; )

i posted my .bat file and do on Test.7z

Code:

quickbms.exe -s "get SIZE asize ; get NAMER basename ; string NAME p \"%s%s\" \"FILE_\" NAMER ; log NAME 0 SIZE" "" Test.7z

File_Name.zip

aluigi, posted Sat Apr 06, 2019 11:03 am (46523)

---

The reason is that in .bat files the % char is interpreted.
You need to escape it by replacing %s with %%s

Shokoniraya, posted Sun Apr 07, 2019 11:10 am (46543)

---

aluigi wrote:

The reason is that in .bat files the % char is interpreted.
You need to escape it by replacing %s with %%s

works fine!
can you tell me other replacing words more than this?
["]To[\"]
[enter-Char] To[ ; ]
[%]To[%%]
is there any other thing to replace?

aluigi, posted Sun Apr 07, 2019 12:28 pm (46547)

---

I think they are almost all the escapes.

Both command-line and .bat use |, <, > and & as special separators and redirectors, in that case they require to be "quoted" if part of the argument.

On Linux the situation is a bit more complex, with at least ^ and $.