This transformer is processing binary data before sending it to next transformer or to final recipient. Binary filter allows or blocks text data based on include or exclude filters.
It is highly recommended to add Binary data blocks splitter before this one.
Binary filter transformer properties:
- Enabled (boolean). If enabled, transformer will be used for data processing.
- Read only (boolean). If set as read only, the transformer will not send any data to next recipient.
- Include filter (hex string): If not empty, allow data which contains specific bytes. Specify Filters Separator to define multiple filters.
- Exclude filter (hex string): If not empty, block/exclude data which contains specific bytes. Specify Filters Separator to define multiple filters.
- Filters separator (string): If not empty, Include and Exclude filters can define multiple filters. These multiple filters act as logical "OR" condition.
Hex strings can be defined in any of the following formats:
- 0x11 0xaa 0xbb
- 11 aa bb
- 11 AA bB
- 11aabb
Filter can define one condition or multiple 'logical AND' conditions. To define multiple conditions, you should specify attribute block for every condition.
Filter can contain placeholder values (??) which means "any byte" Example:
- aa??cc: matches data with size=3, starting with 0xaa and ending with 0xcc, second byte can have any value
- ??????: matches any 3 bytes
- fe fe ?? ?? ?? ?? ?? ff: matches data with size=8 starting with 0xfe 0xfe and ending with 0xff
All condition attributes should be placed inside [] block. Here are some examples:
- offset_abs: specify absolute offset for bytes sequence in the filter string. Default value is 'any', which means that offset does not really matter.
- [offset_abs=0]aabbcc or [offset_abs=start]aabbcc: data at absolute offset 0 should start with 0xaa, 0xbb, 0xcc bytes
- [offset_abs=end]aabbcc or [offset_abs=-1]aabbcc: data should end with 0xaa, 0xbb, 0xcc bytes
- [offset_abs=10]aabbcc or [offset_abs=0xa]aabbcc: data at absolute offset 10 (decimal) should start with 0xaa, 0xbb, 0xcc bytes
- [offset_abs=any]aabbcc or []aabbcc or aabbcc: data at any offset should start with 0xaa, 0xbb, 0xcc bytes
You can define multiple conditions in one filter. The filter will succeed only if all conditions are met.
- [offset_abs=start]aabbcc [offset_abs=0xa]0xff: data should start with 0xaa, 0xbb, 0xcc bytes AND data at absolute offset 0xa should start with 0xff
- [offset_abs=any]aabbcc [offset_abs=0xa]0xff: data at any offset should start with 0xaa, 0xbb, 0xcc bytes AND data at absolute offset 0xa should start with 0xff
- []aabbcc []0xff: data should contain 0xaa, 0xbb, 0xcc AND should contain 0xff
- [offset_abs=start]aabbcc [offset_abs=end]0xff: data should start with 0xaa, 0xbb, 0xcc and end with 0xff
You can define multiple filters with multiple conditions. When defining multiple filters, transformer will succeed if ANY of the filters succeeds. Below are examples of multiple filters with multiple conditions (Filters separator=;):
- 000000;111111: Filter succeeds if data bytes sequence contains 00 00 00 or 11 11 11
- [offset_abs=any]000000 [offset_abs=any]000001;111111: Filter succeeds if data bytes sequence contains ("00 00 00" AND "00 00 01") OR (11 11 11)
- [offset_abs=start]0xfe 0xfe [offset_abs=0xa]0xff;[offset_abs=0]0xfe 0xfe [offset_abs=0xa]0xaaaa: Filter succeeds if data bytes sequence starts with '0xfe 0xfe' and data bytes sequence at position 0xa (10 decimal) is (0xff) or (0xaa 0x aa).
- See also:
-
