Question

I am writing a program that reads ‘.exe’ files and stores their hex values in an array of bytes for comparison with an array containing a series of values. (like a very simple virus scanner)

byte[] buffer = File.ReadAllBytes(currentDirectoryContents[j]);

I have then used BitConverter to create a single string of these values

string hex = BitConverter.ToString(buffer);

The next step is to search this string for a series of values(definitions) and return positive for a match. This is where I am running into problems. My definitions are hex values but created and saved in notepad as defintions.xyz

string[] definitions = File.ReadAllLines(@"C:\definitions.xyz");

I had been trying to read them into a string array and compare the definition elements of the array with string hex

bool[] test = new bool[currentDirectoryContents.Length];

test[j] = hex.Contains(definitions[i]);

This IS a section from a piece of homework, which is why I am not posting my entire code for the program. I had not used C# before last Friday so am most likely making silly mistakes at this point.

Any advice much appreciated 🙂

Answer 1

I expect you understand that this is a very inefficient way to do it. But except for that, you should just do something like this:

bool[] test = new bool[currentDirectoryContents.Length];
for(int i=0;i<test.Length;i++){
  byte[] buffer = File.ReadAllBytes(currentDirectoryContents[j]);
  string hex = BitConverter.ToString(buffer);
  test[i] = ContainsAny(hex, definitions);
}

bool ContainsAny(string s, string[] values){
  foreach(string value in values){
    if(s.Contains(value){
      return true;
    }
  }
  return false;
}

If you can use LINQ, you can do it like this:

var test = currentDirectoryContents.Select(
             file=>definitions.Any(
               definition => 
                 BitConverter.ToString(
                   File.ReadAllBytes(file)
                 ).Contains(definition)
             )
           ).ToArray();

Also, make sure that your definitions-file is formatted in a way that matches the output of BitConverter.ToString(): upper-case with dashes separating each encoded byte:

12-AB-F0-34
54-AC-FF-01-02