[Tutor] Finding line number by offset value.

[Alan Gauld]

On 21/02/16 19:32, Cody West wrote:
> I'm using yara-python for some file scanning and I'm trying to take the
> offset in the 'strings' field and turn it into a line number.

I know nothing about yara except that its some kind of
pattern matching engine. However...

> (48L, '$execution', 'eval(base64_decode')
> 
> I'm trying to take 48L, which I believe is the character number, and get
> the line number from that.

I'm not totally clear what you mean but, if it is that 48L
is the character count from the start of the file and you
want to know the line number then you need to count the
number of \n characters between the first and 48th
characters.

But thats depending on your line-end system of course,
there may be two characters on each EOL... It depends
on your OS/version and possibly the character encoding
too. And if it's a binary file, who knows, as there
won't really be any line endings. And, as I understand
it, yara is targeted at reading byte patterns from
binary files?

Are you sure you really need the line number?


-- 
Alan G
Author of the Learn to Program web site
http://www.alan-g.me.uk/
http://www.amazon.com/author/alan_gauld
Follow my photo-blog on Flickr at:
http://www.flickr.com/photos/alangauldphotos