3.7.1 Flag intersections

The '/' command for searching registers some flags for the hit results. You can use them to draw intersection vectors between these hits and be able to determine block sizes from a header and a footer search keywords.

Here's an example:

[0x00000000]> !cat txt
_head
jklsdfjlksaf
_foot
_body
jeje peeee
_foot
_body
food is lavle
_foot

Let's define the header and the footer keywords:

[0x00000000]> /k0 _body
[0x00000000]> /k1 _foot
[0x00000000]> /k
00 _body
01 _foot

Do the ranged search using keywords 0 and 1:

[0x00000000]> /r 0,1
001  0x00000000  hit0_0 _bodyjklsdfjlksaf
002  0x00000015  hit1_1 _foot_bodyjeje p
003  0x0000001c  hit0_2 _bodyjeje peeee-
004  0x0000002f  hit1_3 _foot_bodyfood is
005  0x00000036  hit0_4 _bodyfood is lavle
006  0x0000004b  hit1_5 _foot

Perform intersection between hits!

[0x00000000]> fi hit0 hit1
hit0_0 (0x00000000) -> hit1_1 (0x00000015)   ; size = 21
hit0_2 (0x0000001c) -> hit1_3 (0x0000002f)   ; size = 19
hit0_4 (0x00000036) -> hit1_5 (0x0000004b)   ; size = 21