corrected sig offset

Author: prestonyford

parser.js

@@ -62,7 +62,7 @@ function parseFileSig(filePath, signatures) {
         const match = regex.exec(hexString);
         if (match) {
             console.log(match.index);
-            return parseFileBody(match, signature);
+            return parseFileBody(match, signature, match[1].length);
         }
     }
     return null;
@@ -71,11 +71,11 @@ function parseFileSig(filePath, signatures) {
 function sigToRegex(signature) {
     // Signatures are either at the very beginning of the file or after a CRLF following the header
     // Signatures are NOT GUARANTEED to be at the beginning of the file
-    return new RegExp(`(^|\r\n)${signature}`, 'g');
+    return new RegExp(`(^|0d0a)${signature}`, 'g');
 }
 
-function parseFileBody(match, signature) {
-    const body = signature + match.input.substring(match.index + signature.length);
+function parseFileBody(match, signature, offset) {
+    const body = signature + match.input.substring(match.index + signature.length + offset);
     const buffer = Buffer.from(body, 'hex');
     // console.log(buffer);
     // fs.writeFileSync("test.png", buffer);

public/index.html

@@ -14,7 +14,7 @@ <h1>HTTP Cache File Signature Search</h1>
         <h2>Configure</h2>
         <form>
             <label for="directoryPath">Enter directory path:</label><br>
-            <input class="mb" id="pathInput" type="text" name="directoryPath" placeholder="e.g. %LocalAppData%\Mozilla\Firefox\Profiles\toy7mtpb.default-release\cache2\entries" required><br>
+            <input class="mb" id="pathInput" type="text" name="directoryPath" placeholder="e.g. C:\Users\username\AppData\Local\Mozilla\Firefox\Profiles\toy7mtpb.default-release\cache2\entries" required><br>
 
             <label for="">Timeframe:</label><br>
             <div class="mb" id="timeframes-container">