Support double question marks '?' as wildcard

Hex Editing
1

Can you add option to allow double question marks ‘??’ as a wildcard? In the manual it says the ‘?’ wildcard match exactly one byte, but I’m too used to have ‘??’ in my pattern like “2D E9 F0 4F ?? F5 ?? 7D ?? ?? 88 46 ?? ?? 81 46 ?? 44”. It’s a pain to replace with ‘?’ manually in order to search with 010 editor. ‘??’ is universal across other tools and sources, while only 010 editor only supported ‘?’

2

Yes, we’ve had a few requests for supporting ?? for wildcards and we will be adding this in, hopefully in our next version.

Graeme
SweetScape Software

1 Like
3

today v14.0.1 release but still not have ?? for wildcards mostly needed.Any progress ?

4

We are hoping to have that feature in v15.0. The minor releases like v14.0.1 we mostly keep to bug fixes and new features are in major releases. v15 is coming along well and hopefully only a few months away. Cheers!

Graeme
SweetScape Software

5

Using ‘??’ for hex wildcards is now supported in 010 Editor v15 beta:

http://www.sweetscape.com/010editor/beta/

Cheers!

Graeme
SweetScape Software

6

Thank you so much for standardizing the use of Wildcard!
Now, in 010 Editor, you can check hex patterns from Frida and AutoIt without first “preparing” them

But there is a caveat.

Me and many other users have been using 010 Editor for a long time, and the hex templates for finding patterns are adapted for older versions, meaning that the wildcard symbol in the templates is 1 “?” character.

Is there a function in 010 Editor v15 to switch between modes when the Wildcard character is 1 character “?” and when it is 2 characters.
If there is no such function, please add it (so that you don’t have to fix previous old hex patterns)

7

You are correct that in changing from ‘?’ to ‘??’ for hex wildcards could break some older scripts. In v15 we made it so that if a single ? is surrounded by spaces, it is still considered a valid wildcard byte. For example, “5A ? ? FF” will be accepted as 2 wildcard bytes in both v15 and earlier versions. You should be using this format instead of “5A??FF” which won’t work in both versions. If your scripts are already using spaces then it will automatically work in the new version, otherwise you could change it to use this formatting. Let us know if you want us to take a look at an older script to see if it will work. We could add a method of switching between the wildcard formats in the future, but hopefully switching to including spaces will be doable. Cheers!

Graeme
SweetScape Software

1 Like