title: Find a hexadecimal string in a file knowing a memory offset and string length
body: <p>Good morning stackoverflow !</p>
  
  <p>I'm trying to extract from a binary file a hexadecimal string. I can't find this string directly, but I know that the string is 0x30 long and begins 0x10 after a known hex string.</p>
  
  <p>So here is my code</p>
  
  <pre><code> FILE *f = NULL;
      unsigned char *buffer = NULL;
      unsigned long fileLen;
  
      unsigned char known_string[] = {0x45, 0x45, 0x45, 0x45};
  
  
  printf("Opening file...\n");  
      f = fopen(argv[1], "rb");
  
      if (!f) {
          fprintf(stderr, "Unable to open %s\n", argv[1]);
          return -1;
      }
  
  // Get the length
      fseek(f, 0, SEEK_END);
      fileLen=ftell(f);
  
      fseek(f, 0, SEEK_SET);
  
  // Allocate memory
      buffer=malloc(fileLen);
  
      if (!buffer)
      {
          fprintf(stderr, "Memory error!\n");
          fclose(f);
          return -1;
      }
  
  // File to buffer
  
  fread(buffer, fileLen, 1, f);
      fclose(f);
  
  printf("Buffer starts: %p\n", &amp;buffer[0]);
  printf("Buffer ends: %p\n", &amp;buffer[fileLen]);
  
  // Determines offset of known_string
  
  char *p = memmem(buffer, fileLen, bytes, 4);
  if (!p) {
      return -1;
  } else {
  
    printf(" General offset: %x\n", p);    
  }
  
    free(buffer);
  </code></pre>
  
  <p>So I get the general offset of the known string but I need to get the one relative to the file. I'm a bit stuck at this step. I think I must do something like p - &amp;buffer[0], but p and &amp;buffer[0] are not of the same type, and p is not even the real offset (678987 instead of 10678987 e.g). Then in the case I got the relative offset, how could I find the unknown string ?</p>