Check if a content of a binary file is in a part/whole binary file (C lang)

Question

I have two files:

    FILE* fileToScan = fopen("c:/fileToScan.png", "rb");
    FILE* contentFile = fopen("c:/virusFile.jpg", "rb");

I want to check if the content of contentFile is in (/part of) fileToScan. Any help?

Answer 1

"Simple" solution:

1. read the whole file to scan in memory. You can use variable char *haystack; with size size_t haystack_len;
2. read the whole content file in memory. You can use variable char *needle; with size size_t needle_len;
3. run a memchr() on haystack using the first character of needle
4. if you find the first character try a memcmp() from that point
5. if the memcmp() fails you can update the haystack pointer to one past the memchr() result and go back to step 3

This is using no optimization at all! You can find definitely find better implementations like the glibc one.

If the file doesn't fit in memory, things are going to be harder. You basically need to work in chunks.