Findstr RegEx help

[miskox]

Hi all!

I again have a problem with memory leak (see viewtopic.php?p=33477#p33477).

Looks like this time it is not ESET Antivirus.

I have three suspicious pool tags: Proc, File, SePa - Proc might be the reason but I am not sure yet.

I would like to have a FINDSTR command to search thru *.sys files to find possible files. If I search for File (exact match) I get many hits because of API modules (for example FltCreateFileEx2 or KeStallExecutionProcessor).

I need a command to find 'XFile' or 'FileY' but only if the characters 'x' and 'y' are below 0x20. This might narrow the number of hits.

Thanks.
Saso

[trebor68]

In SYS files both specifications are possible:

Code: Select all

Test
hex: 54 65 73 74
or
hex: 54 00 65 00 73 00 74 00

And here a possible solution:

Code: Select all

findstr /i /r "test" file
or
findstr /i /r "t[^a-z0-9_]e[^a-z0-9_]s[^a-z0-9_]t[^a-z0-9_]" file

After each letter, no other letter, digit or underscore to follow. There remain other characters, but this should be sufficient.

FINDSTR also has limits. It is not possible more than 15 times to use a set of characters. Used in Example four times.

[miskox]

Thanks. I will try this. If evertyhing fails I can still check each file.

Saso