
Text/hexadecimal Editor
158
© 2002...2013 R-Tools Technology Inc.
Expressions
Expressions in the patterns are arithmetic expressions which syntax is similar to that of the C language, including
operation preceding.
The following operations are supported:
+ - * / & | > < <= >= != == || &&
Predefined variables
offset
An offset in bytes from the pattern beginning data is currently read at.
start_position
An absolute position of the pattern beginning. offset + start_position = absolute offset.
this
This variable exists only within the context of the ass-offset expression evaluation and is the current value
of the data field for which that expression is specified
3.3 Pattern Example I
Below is an example of a commented pattern parsing an AVI file.
<?xml version="1.0" encoding="utf-8"?>
<!-- A pattern section. The pattern name is AVI File. -->
<template name="AVI File">
<!-- A template signature section. Alignment is 1. -->
<signature align="1">
<!-- A 4-byte signature at offset 0x00. -->
<field offset="0x00">52 49 46 46</field> <!-- ANSI: RIFF -->
<!-- A 4-byte signature at offset 0x08. -->
<field offset="0x08">41 56 49 20</field> <!-- ANSI: LIST -->
</signature>
<!-- A data section. Its name is AVI File. This is the main data section. It is not shown in the parsing tree as
a section (its name is ignored). -->
<section name="AVI File">
<!-- The first 4 bytes are read and shown as an ANSI string. -->
<field type="char" size="4" name="Signature: RIFF" var="signature"/>
<!-- The current position is moved to the beginning of the file. -->
<goto offset="-4"/>
<!-- The first 4 bytes in the file are read and shown as an unsigned integer. The internal variable
signature gets the value of the field. -->
<field type="uint32" base="hex" name="Signature RIFF as unsigned integer in hex
format" var="signature"/>
<!-- A test against the condition (signature == RIFF) -->
Komentarze do niniejszej Instrukcji