Ian D wrote: > Ok I got it. > > pchars = re.compile(b'\x00\x00\x00[\0-\xff]') > > preceeding b and [0-\xff] Also possible: re.compile(b"\0\0\0.", re.DOTALL) . by default means "any byte except \n", the re.DOTALL flag changes that to "any byte". or re.compile(b"\0{3}.", re.DOTALL) {3} means "repeat 3 times".