Match Analyzers

Posted | Modified
Author

Match analyzers in HexLasso look for matching byte sequences in block of data and return the byte coverage of the found matches.

It is possible that no match found in the block, and it is also possible that all the bytes are matches.

HexLasso implements three type of matching algorithms and the difference between them is the width of the matches.

If the block contains QWord matches, it consequently contains DWord matches, and it consequently contains Word matches.

For example, by following the links you can see Word, DWord and QWord matches of a given block.

The presence of the matches in the block indicates some sort of redundancy. However, the match analyzers are given lower priorities than many other analyzers because they cannot be specific on what the redundancies are.

There are many other analyzers that can be more specific on what the redundancies are though. For example, the Byte00 analyzer returns the byte coverage of 00 bytes in the block. Therefore, the Byte00 analyzer is given a higher priority than the match analyzers. As a consequence, if the Byte00 analyzer and the match analyzers return with the same byte coverage on a given block then Byte00 analyzer will be reported.

So match analyzers are used as a fall-back mechanism when specifics on the redundancies are not well known.