On 9/15/18 11:43 AM, 21na...@gmail.com wrote:
Thank you for your messages.
It is possible I did not understand correctly your messages, because
grep finds hex sequences with the “-Pa” options at least.
grep -P introduces a completely different regex engine, with its own
quirks. As such, it does introduce different rules on backslash
sequences accepted.
Examples—“input.txt” contains, from the file system, for example
“\xFF\xFE\x0D\x00\x0A\x00\x74\x00\x65\x00\x73\x00\x74\x00\x0D\x00\x0A\x00\x74\x00\x65\x00\x73\x00\x74\x00\x5F\x00\x74\x00\x77\x00\x6F\x00\x0D\x00\x0A\x00”:
grep -Pa '\x00' input.txt
→ found
grep -Pza '\x0A' input.txt
→ found
grep -Pa '\x0A\x00' input.txt
This will never match - when you are not using -z, there are no \x0A in
the input stream (they have all been consumed by grep parsing one line
at a time, ending at \x0A). Instead, you'll want to search for '^\x00'
or '\x00$' for a pattern anchored to a line transition, to find patterns
where newline was next to NUL.
grep -Pza '\x0A\x00' input.txt
→ not found for the both
Similarly, when you are using -z, there are no \x00 in the input stream
(they have all been consumed by grep parsing one NUL-terminated record
at a time, ending at \x00). Instead, you'll want to search for '^\x0a'
or '\x0a$' for a pattern anchored to a record transition, to find
patterns where newline was next to NUL.
But is it at least possible to find “\x0A\x00” with grep?
If you bend the rules by throwing -P into the mix, yes :)
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
