Feature Request: Built-in Search Command for Pattern Matching in Binary Data

[araray]

✨ Feature Request: Built-in Search Command for Pattern Matching in Binary Data

Feature Request Document

1. Overview

This request proposes a search subcommand for binfiddle to enable flexible, chunk-aware pattern matching across input formats (hex, dec, bin, ascii, regex, etc.). The goal is to make binfiddle a more complete binary inspection and manipulation toolkit without needing external tools like grep or xxd.

---

2. Motivation

Currently, users must rely on external tools to search within binary data. Native support would:

• 🔎 Allow direct pattern matching within binary files or piped streams
• 🧠 Leverage existing chunk-size and format awareness
• 🧰 Enable workflows like firmware inspection, protocol dissection, and binary patching

---

3. Proposed Capabilities

✅ Core Matching Modes

Feature	Description	Example
Exact Byte Search	Match raw bytes in hex, bin, ascii, etc.	binfiddle search "A1 B2" --format hex
Regex Matching	Use regex for byte-wise pattern search	binfiddle search "\x00.{4}" --input-format regex
Decimal/Octal	Match values in numeric formats	binfiddle search "1234" --input-format dec
Bitmask/Wildcard	Allow masked values like F? to match F0–FF	binfiddle search "F?" --input-format mask

📏 Chunk & Format Awareness

• Respects --chunk-size (e.g., only match aligned 32-bit chunks)
• Outputs matches in chosen --format (hex, bin, dec, ascii, etc.)

🎛 Input & Output Options

Input Source	Supported?	Notes
Files	✅	Default file-based input (--input file.bin)
Stdin	✅	Fully streamable (`cat file
Memory	❌ (Future)	Could extend BinarySource::MemoryAddress support

---

4. CLI Design

binfiddle search <PATTERN> \
  [--input-format <hex|dec|bin|oct|ascii|regex|mask>] \
  [--format <hex|dec|bin|oct|ascii>] \
  [--chunk-size <BITS>] \
  [--all] \          # Return all matches
  [--color] \        # Highlight matches in output
  [--input <FILE>]   # Optional (defaults to stdin)

---

5. Implementation Plan

🔧 New Module: commands::search

• Use memchr, regex::bytes, or aho-corasick depending on pattern type
• Handle overlapping matches and stream buffering for large files

📦 Additions to utils::parsing

• Parse flexible input formats into bytes
• Support wildcard and regex parsing

🎨 Match Output

• Leverage display_bytes() for consistent formatting
• Show byte offsets optionally (--show-offsets future?)

---

6. Example Workflows

# Hex search in a file
binfiddle search "DE AD BE EF" --input file.bin --format hex

# Bit pattern from stdin
cat blob.bin | binfiddle search "11001100" --input-format bin --format bin

# Regex for null padding
binfiddle search "\x00{4}." --input-format regex --format hex

---

7. Future Enhancements

• --context N to show N bytes before/after each match
• --pattern-name <name> for common structures (e.g., IP headers)
• Parallel search for large files (rayon)

---

✅ Acceptance Criteria

• Works with both files and piped input
• Supports multiple input formats (hex, bin, ascii, dec, regex)
• Honors --chunk-size and --format
• Provides clear, human-readable output
• Gracefully handles invalid patterns and edge cases