本帖最后由 冥界3大法王 于 2019-8-31 20:27 编辑
要匹配到的
[Asm] 纯文本查看 复制代码
调用堆栈: 主线程
地址 堆栈 函数过程 / 参数 调用来自 结构
0019D3BC 753DEC70 win32u.NtUserGetMessage user32.753DEC6A 0019D3F4
0019D3F8 0059B95D user32.GetMessageW GSP5.0059B957 0019D3F4
0019D3FC 00B0FB10 pMsg = 00B0FB10
0019D400 00000000 hWnd = NULL
0019D404 00000000 MsgFilterMin = 0x0
0019D408 00000000 MsgFilterMax = 0x0
0019D414 004F416F GSP5.0059BB2E GSP5.004F416A
0019D41C 00580768 GSP5.0059B989 GSP5.00580763
0019D440 004FE07E GSP5.0058069E GSP5.004FE079
0019E18C 0053781A ? GSP5.004FDF00 GSP5.00537815
0019E284 00430BD5 GSP5.005377D0 GSP5.00430BD0 0019FE54
0019FE58 00430DC5 GSP5.004308D0 GSP5.00430DC0 0019FE54
0019FE64 00451AA7 包含GSP5.00430DC5 GSP5.00451AA5 0019FEA8
0019FE74 004F3AAC GSP5.00451A90 GSP5.004F3AA7 0019FEA8
0019FEAC 0059B5A1 可能 GSP5.004F3A10 GSP5.0059B59E 0019FEA8
[Delphi] 纯文本查看 复制代码 unit Unit1;
interface
uses
PerlRegEx, Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;
type
TForm1 = class(TForm)
Memo1: TMemo;
Memo2: TMemo;
Button1: TButton;
Button2: TButton;
procedure Button1Click(Sender: TObject);
procedure Button2Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
procedure TForm1.Button1Click(Sender: TObject);
var
I: Integer;
reg: TPerlRegEx;
begin
reg := TPerlRegEx.Create(nil);
reg.RegEx := '0[0-9A-F]{7,15}';
reg.Options := [preMultiLine];
for I := 0 to Memo1.Lines.Count - 1 do
begin
reg.Subject := Memo1.Lines[I];
if reg.Match then
begin
Memo2.SelLength := 0;
Memo2.SelText := reg.MatchedExpression + #13#10;
end;
end;
FreeAndNil(reg);
//deletefile(ExtractFileDir(Application.Exename) + '.\临时待提取汇编地址2.txt');
//Memo12.Lines.SaveToFile(ExtractFileDir(Application.Exename) + '.\临时待提取汇编地址2.txt');
end;
procedure TForm1.Button2Click(Sender: TObject);
var
I: Integer;
reg: TPerlRegEx;
begin
reg := TPerlRegEx.Create(nil);
reg.RegEx := '(?<=\.)0[0-9A-F]{7,8}';
for I := 0 to Memo1.Lines.Count - 1 do
begin
reg.Subject := Memo1.Lines[I];
if reg.Match then
begin
while reg.MatchAgain do //MatchAgain 是下一个
begin
// ShowMessage(reg.MatchedExpression);
Memo2.SelLength := 0;
Memo2.SelText := reg.MatchedExpression + #13#10;
end;
end;
end;
FreeAndNil(reg);
end;
end.
执行结果,
少了一个 0059B957 |