Creating the Find Tool
In text or hex view, pressing Ctrl-F will invoke a Find dialog for entering search text. In a normal search, the exact, case-insensitive characters are used as the search pattern. If the Hexadecimal characters box is checked, the hex bytes are converted to ASCII characters, and FileSnoop performs a case-sensitive search. The search has to be case sensitive here, because you don't want a byte-search for 6D (lowercase m) to find 4D (capital M). To perform a Unicode search, FileSnoop looks at every other byte. That works because Unicode characters are 16 bits wide (two bytes), and for the English language, the second byte is always 0. Once the search pattern is found, FileSnoop highlights the search text and positions the file so the search text is visible.

The search itself uses the Boyer-Moore search algorithm, created in 1975 by R.S. Boyer and J.S. Moore. Briefly, the Boyer-Moore algorithm avoids looking for the string at every possible character position. If a given character appears nowhere in the string, then there's no need to look at any position for which the string would overlap this character. If a given character only appears in one place in the string, there's no need to look at any position for which the string would overlap with a different character. This lets the search procedure skip rapidly through the text rather than checking each position. The longer the string, the farther it can skip and the faster the search can be performed. An example is shown on Moore's site at