CurrentDataMatches

Description:

This method returns TRUE if the current data has the value of the "Value to match" parameter. This allows you to check the value of data at the pointer without explicitly decoding it with a FIELD statement. It requires two parameters: 1) the number of bits (1 to 64) to be extracted from the data for comparison and 2) the value to be matched against.

This method is particularly useful in two situations. The first is in a GROUP statement to check a field before decoding it. You might, for example, have a field that is defined as being a four-byte field if the first byte contains hex FF and a two-byte field otherwise. You can see examples in the SMB decoder.

The second case is where you want to decode a field only if it contains a certain value. Consider, for example, this pair of statements from the NCP decoder:

FIELD printer_off_line (Fixed 1) IF (CurrentDataMatches 8 0xff) (Constant "Halted") "Printer Status"

FIELD printer_on_line (Fixed 1) IF (CurrentDataMatches 8 0x00) (Constant "Not Halted") "Printer Status"

Here a one-byte field is deemed to exist and is decoded only when its value is zero or hex FF.

Parameters:

Example:

GROUP string_bindings REPEAT UNTIL (CurrentDataMatches 8 0x01)