Page 2 of 2 FirstFirst 12
Results 16 to 19 of 19

Thread: Efficient String searching

  1. #16
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Blog Entries
    Well this is pretty amazing, I started looking into the details of findstr, for those who might be interested there is a very detailed sequence of posts on the undocumented features of findstr here

    Towards the end of the discussion is a reported bug that findstr can't find a file if it has an en dash () or em dash () within the filename. These are supposedly punctuations slightly longer than a regular hyphen (-). There is no direct keyboard key for them, but I decided to try a regular hyphen in the output name and it seems to solve the recursion problem we've been discussing.

    Compare these two commands from the main Strings folder:

    >strings64.exe * | findstr /i "the" > out.txt (gives recursive output)

    >strings64.exe * | findstr /i "the" > -out.txt (gives correct search results without including the piped output file)

    As for the piped output question I asked, there is a complete table here for example showing the differences between >, >> and other syntax

  2. #17
    kayaker...if I'm getting your drift, the problem seems to be in sending the output to a file in the same directory. So, I pointed the output to a file in different directory, and it did one recursion only. Seems if you leave the output file in the same directory it keeps reading through the file and the output increases exponentially.

  3. #18
    Super Moderator
    Join Date
    Dec 2004
    Blog Entries
    strings.exe reads each file in sizes of 8192,16384,...65536 max
    over Fastio/IRP_MJ_READ read until ENDIFFILE.

    FINDSTR.exe KEEPS ON writing to the the file and keeps on altering EOF

    string keeps on reading and populates gigabyte upon gigabyte of crap

    if instead of > (open_always) or >> (append instead of open always)
    you use say wc -l It wont recurse and count correct lines instead

    run procmon filter FASTIOREAD,FASTIOWRITE,strings.exe,findstr.exe
    and look

    "strings.exe","FASTIO_READ","E:\SYSINT\STRTEST\the.txt","SUCCESS","Offset: 47,496,572, Length: 65,536",".\strings.exe  * ","n/a","844"
    "findstr.exe","FASTIO_WRITE","E:\SYSINT\STRTEST\the.txt","SUCCESS","Offset: 48,067,185, Length: 8,192","findstr  /i ""the""  ","n/a","5580"
    "findstr.exe","FASTIO_WRITE","E:\SYSINT\STRTEST\the.txt","SUCCESS","Offset: 48,075,377, Length: 8,192","findstr  /i ""the""  ","n/a","5580"
    "findstr.exe","FASTIO_WRITE","E:\SYSINT\STRTEST\the.txt","SUCCESS","Offset: 48,083,569, Length: 8,192","findstr  /i ""the""  ","n/a","5580"
    "findstr.exe","FASTIO_WRITE","E:\SYSINT\STRTEST\the.txt","SUCCESS","Offset: 48,091,761, Length: 8,192","findstr  /i ""the""  ","n/a","5580"
    "findstr.exe","FASTIO_WRITE","E:\SYSINT\STRTEST\the.txt","SUCCESS","Offset: 48,099,953, Length: 8,192","findstr  /i ""the""  ","n/a","5580"
    "findstr.exe","FASTIO_WRITE","E:\SYSINT\STRTEST\the.txt","SUCCESS","Offset: 48,108,145, Length: 8,192","findstr  /i ""the""  ","n/a","5580"
    Last edited by blabberer; January 21st, 2020 at 00:09. Reason: edited fa tfinger errors

  4. #19
    Quote Originally Posted by blabberer View Post
    run procmon file fastioread fastiowrite,strings.exe,findstr.exe and take a look
    I believe you, I cut off a txt file at 50 megs. with a ^C.

Similar Threads

  1. Replies: 5
    Last Post: January 30th, 2016, 01:16
  2. searching for something like the CUSTOMISER
    By Ivan in forum The Newbie Forum
    Replies: 2
    Last Post: May 26th, 2007, 12:59
  3. Ollydbg revers searching
    By Stevo in forum OllyDbg Support Forums
    Replies: 2
    Last Post: November 25th, 2006, 07:12
  4. Amazing new searching tool!
    By TBone in forum Off Topic
    Replies: 2
    Last Post: April 2nd, 2005, 06:56
  5. tool for searching strings
    By figugegl in forum Tools of Our Trade (TOT) Messageboard
    Replies: 10
    Last Post: January 24th, 2005, 15:27


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts