Pattern Matching rewritten

Author: echo-devim

src/core/patternmatching.cpp

@@ -16,24 +16,58 @@ PatternMatching::PatternMatching(string path)
     }
 }
 
-vector<Match*> PatternMatching::hasMatches(wstring str) {
+vector<Match*> PatternMatching::hasMatches(vector<uint8_t> &content) {
     vector<Match*> res;
+    vector<vector<uint8_t>> patterns;
+    vector<string> colors;
+    vector<string> messages;
     for (auto& e : this->jconfig["PatternMatching"]) {
-        wstring tmp = str;
-        unsigned long pos = 0;
-        try {
-            string sregex = e["regex"].get<string>();
-            wstring wsregex = std::wstring_convert<std::codecvt_utf8<wchar_t>>().from_bytes(sregex);
-            std::wregex re(wsregex);
-            std::wsmatch match;
-            while (regex_search(tmp, match, re)) {
-                unsigned long len = match.str(0).size();
-                res.push_back(new Match(e["color"].get<string>(), e["message"].get<string>(), match.position(0) + pos, len));
-                tmp = match.suffix();
-                pos += match.position(0) + len;
+        if (e.contains("string")) {
+            vector<uint8_t> bytes;
+            string str = e["string"].get<string>();
+            for(uint8_t byte : str) {
+                bytes.push_back(byte);
+            }
+            patterns.push_back(bytes);
+            colors.push_back(e["color"].get<string>());
+            messages.push_back(e["message"].get<string>());
+        } else if (e.contains("bytes")) {
+            string strbytes = e["bytes"].get<string>();
+            stringstream converter;
+            vector<uint8_t> bytes;
+            for(size_t i = 0; i < strbytes.length(); i+=2) {
+                converter << std::hex << strbytes.substr(i,2);
+                short byte;
+                converter >> byte;
+                bytes.push_back(byte & 0xFF);
+                converter.str(string());
+                converter.clear();
+            }
+            patterns.push_back(bytes);
+            colors.push_back(e["color"].get<string>());
+            messages.push_back(e["message"].get<string>());
+        }
+    }
+
+    //Search patterns in content
+    unsigned long pos = 0;
+    uint8_t *content_ptr = content.data(); //Use pointers to be faster
+    for (pos = 0; pos < content.size(); pos++) {
+        for (size_t p = 0; p < patterns.size(); p++) {
+            uint8_t *pattern_ptr = patterns[p].data();
+            size_t size = patterns[p].size();
+            if (content.size() - pos < size)
+                continue;
+            size_t i;
+            for (i = 0; i < size; i++) {
+                if (content_ptr[pos+i] != pattern_ptr[i])
+                    break;
+            }
+            bool found = (i == size);
+            if ((found) && (res.size() < MAX_PATTERN_RESULTS)) {
+                res.push_back(new Match(colors[p], messages[p], pos, size));
+                pos+=size;
             }
-        } catch (std::regex_error& e) {
-            cerr << "Regex syntax error:" << endl << e.what() << endl;
         }
     }
     return res;

src/core/patternmatching.h

@@ -8,6 +8,8 @@
 #include <codecvt>
 #include "json.h"
 
+#define MAX_PATTERN_RESULTS 100
+
 using json = nlohmann::json;
 using namespace std;
 
@@ -36,7 +38,7 @@ class PatternMatching
 {
 public:
     PatternMatching(string path);
-    vector<Match *> hasMatches(wstring pattern);
+    vector<Match *> hasMatches(vector<uint8_t> &content);
 private:
     json jconfig;
 };

src/fhex.cpp

@@ -327,20 +327,32 @@ void Fhex::on_menu_find_patterns_click() {
 
 void Fhex::findPatterns() {
     clearFloatingLabels();
+    this->listOffsets->clear();
     this->statusBar.setText("Searching patterns..");
     this->statusBar.repaint();
-    long patterns = 0;
+    unsigned long patterns = 0;
     vector<Match *> matches = this->hexEditor->findPatterns();
+    size_t size = matches.size();
     for (Match *m : matches) {
+        if (patterns > MAX_PATTERN_RESULTS) {
+            break;
+        }
         // render highlight area
         QString style("QLabel { color: #fbfbfb; padding: 2px; background-color: ");
         style += m->color.c_str();
         style += " };";
-        addFloatingLabel(m->index, m->length, m->message.c_str(), style, true);
+        //Show comments only if the windows is maximized, otherwise probably we don't have enough space
+        addFloatingLabel(m->index, m->length, m->message.c_str(), style, this->windowState().testFlag(Qt::WindowMaximized));
+        this->listOffsets->addItem("0x" + QString::number(m->index, 16));
         delete m;
         patterns++;
     }
-    this->statusBar.setText("Found " + QString::number(patterns) + " patterns");
+    if (size > MAX_PATTERN_RESULTS) {
+        this->statusBar.setText("Found " + QString::number(size) + " patterns. Limit exceeded, showing labels only for first " + QString::number(MAX_PATTERN_RESULTS));
+    } else {
+        this->statusBar.setText("Found " + QString::number(patterns) + " patterns");
+    }
+    this->listOffsets->setVisible(true);
 }
 
 void Fhex::on_menu_find_click() {
@@ -755,8 +767,8 @@ void Fhex::addFloatingLabel(qint64 offset, int len, QString text, QString style,
             style = "QLabel { background-color: rgb(150, 150, 150, 50); color: #ffffff; }";
         commentLabel->setStyleSheet(style);
         commentLabel->setText(text);
-        commentLabel->move(p.x() + (this->width() / 2), p.y());
-        commentLabel->adjustSize();
+        commentLabel->move(p.x() + (this->width() / 2.5), p.y());
+        commentLabel->resize(this->qhex->getPxCharWidth() * text.size(), this->qhex->getPxCharHeight());
         commentLabel->show();
         this->floatingLabels.push_back(commentLabel);
     }