Using regex fetch the first memory address of filename listings

I have the following text as a response of a script:

7d60f000-7d67b000 r-xp 00000000 fb:00 11         /bin/busybox.nosuid
7d68b000-7d68c000 r--p 0006c000 fb:00 11         /bin/busybox.nosuid
7d68c000-7d68d000 rw-p 0006d000 fb:00 11         /bin/busybox.nosuid
b3dfb000-b3ebe000 r-xp 00000000 fb:00 1636       /lib/libc-2.31.so
b3ebe000-b3ecd000 ---p 000c3000 fb:00 1636       /lib/libc-2.31.so
b3ecd000-b3ecf000 r--p 000c2000 fb:00 1636       /lib/libc-2.31.so
b3ecf000-b3ed1000 rw-p 000c4000 fb:00 1636       /lib/libc-2.31.so
b3ed1000-b3ed3000 rw-p 00000000 00:00 0
b3ed3000-b3f24000 r-xp 00000000 fb:00 1655       /lib/libm-2.31.so
b3f24000-b3f33000 ---p 00051000 fb:00 1655       /lib/libm-2.31.so
b3f33000-b3f34000 r--p 00050000 fb:00 1655       /lib/libm-2.31.so
b3f34000-b3f35000 rw-p 00051000 fb:00 1655       /lib/libm-2.31.so
b3f35000-b3f36000 r-xp 00000000 fb:00 4296       /usr/lib/libcrashlog.so.0.0.0
b3f36000-b3f45000 ---p 00001000 fb:00 4296       /usr/lib/libcrashlog.so.0.0.0
b3f45000-b3f46000 r--p 00000000 fb:00 4296       /usr/lib/libcrashlog.so.0.0.0
b3f46000-b3f47000 rw-p 00001000 fb:00 4296       /usr/lib/libcrashlog.so.0.0.0
b3f47000-b3f5d000 r-xp 00000000 fb:00 1628       /lib/ld-2.31.so
b3f6b000-b3f6d000 rw-p 00000000 00:00 0
b3f6d000-b3f6e000 r--p 00016000 fb:00 1628       /lib/ld-2.31.so
b3f6e000-b3f6f000 rw-p 00017000 fb:00 1628       /lib/ld-2.31.so

I'm trying to fetch the address for each file name, eg:

• for /bin/busybox.nosuid return 7d60f000-7d67b000
• for /lib/libc-2.31.so return b3dfb000-b3ebe000
• for /lib/libm-2.31.so return b3ed3000-b3f24000
• for /usr/lib/libcrashlog.so.0.0.0 return b3f35000-b3f36000
• for /lib/ld-2.31.so return b3f47000-b3f5d000

Can this be done with regex?

You can try with the following regex:

(^[a-f0-9]{8}\-[a-f0-9]{8})\s[rwxp\-]+\s[a-f0-9]{8}\s[a-f0-9]{2}:[a-f0-9]{2} \d+\s+(\/(?:bin|lib|usr\/lib\/)[^.]+(?:\.[^.\s]+)*)$

Your matches will be found in:

• Group 1: hexadecimal code
• Group 2: path

Regex Explanation:

• ^: start of string
• ([a-f0-9]{8}\-[a-f0-9]{8}): hexadecimal code
  • [a-f0-9]{8}: 8 hex characters
  • \-: dash
  • [a-f0-9]{8}: 8 hex characters
• \s: space
• [rwxp\-]{4}: linux file permission characters
• \s: space
• [a-f0-9]{8}\s[a-f0-9]{2}:[a-f0-9]{2}\d+: hexadecimal characters
• \s+: spaces
• (\/(?:bin|lib|usr\/lib\/)[^.]+(?:\.[^.\s]+)*): path
  • \/: slash
  • (?:bin|lib|usr\/lib\/): one of the linux main folders
  • [^.]+: any character except dot (can be substituted with filename possible characters)
  • (?:\.[^.\s]+)*: optional sequence of dot and non-dot characters
• $: end of string

Check the demo here.

For a single line, you can use the following pattern to capture the data.

^(?i)([a-f\d]{8}-[a-f\d]{8})

In Java, you can use the Pattern and Matcher objects to return captured values.

String string = "7d60f000-7d67b000 r-xp 00000000 fb:00 11         /bin/busybox.nosuid";
String address = null;
Pattern pattern = Pattern.compile("^(?i)([a-f\\d]{8}-[a-f\\d]{8})");
Matcher matcher = pattern.matcher(string);
if (matcher.find()) 
    address = matcher.group(1);

Output

7d60f000-7d67b000

Alternatively, if you require all values to be evaluated at once, you can use the following.

Map<String, String> map(String string) throws IOException {
    BufferedReader reader = new BufferedReader(new StringReader(string));
    Map<String, String> map = new LinkedHashMap<>();
    String[] strings;
    String line;
    while ((line = reader.readLine()) != null) {
        strings = line.split(" +", 6);
        if (strings.length > 5) {
            if (!map.containsKey(strings[5]))
                map.put(strings[5], strings[0]);
        }
    }
    return map;
}

Output, formatted

{/bin/busybox.nosuid=7d60f000-7d67b000, 
 /lib/libc-2.31.so=b3dfb000-b3ebe000, 
 /lib/libm-2.31.so=b3ed3000-b3f24000, 
 /usr/lib/libcrashlog.so.0.0.0=b3f35000-b3f36000, 
 /lib/ld-2.31.so=b3f47000-b3f5d000}