Searching for a specifc given hex string in multiple images on Linux

Question

I am doing some research on image processing and I wanted to know if its possible to search for a specific hex string/byte array in various images. It would be great if it gives me a list of images that has that specific string. Basically what grep -r "" does. For some reason grep doesn't do the job. I am not familiar with strings. I did had a look at "man strings" but it didn't help much. Anyways, I would like to look for a specific hex string say "0002131230443" (or even specific byte array i.e. base64 string) in several images in the same folder. Any help would be highly appreciated.

I found this code which exactly does what I want using xxd and grep. Please find the command below: xxd -p /your/file | tr -d '\n' | grep -c '22081b00081f091d2733170d123f3114'

FYI: It'll return 1 if the content matches, 0 else.

xxd -p converts the file to plain hex dump, tr -d '\n' removes the newlines added by xxd, and grep -c counts the number of lines matched.

Does anyone know how to run the code above in a specific directory using bash script. I have around 400 images and I want it to return only 400 (i.e. a string matching count) if all the 400 images have that particular string. I found this script code below but it runs the same code over and over for 400 times returning either 0 or 1 each time:

#!/bin/bash

FILES=/FILEPATH/*
for f in $FILES
do
   echo "PROCESSING $f FILES"
   echo "-------------------"
   XXD -u $f | grep ABCD
   echo "-------------------"
done

Thanks guys.

Plasma33

Yes you are right. I meant bash script. I corrected it now. Sorry unfortunately I am a frequent windows user. — plasma33, May 07 '16 at 19:52

Cyrus · Accepted Answer · 2016-05-07T20:27:46.390

2

With GNU grep:

#!/bin/bash

files=/FILEPATH/*
for f in $files
do
  grep -m 1 -P '\x22\x08\x1b\x00' < "$f"
done | wc -l

edited May 07 '16 at 20:27

answered May 07 '16 at 10:14

Cyrus

84,225
14
89
153

Perfect!! It worked exactly like I wanted. Great effort. Thanks heaps!! I didn't had to interchange the byte order. For instance: To grep for 22081b00 I simple did consecutively '\x22\x08\x1b\x00'. It didn't work when I interchanged the byte string as you demonstrated. Thanks again. – plasma33 May 07 '16 at 19:51
Okay, the problem on my side was different output of `hexdump file` and `hexdump -C file`. I've updated my answer. – Cyrus May 07 '16 at 20:30

Searching for a specifc given hex string in multiple images on Linux

1 Answers1