Groups and group conditions
Groups are classification systems that improve the performance of the structure detection algorithm. For example, if the binary data stream contains a header structure, which is always the same and contains a version information, and a set of 10 different structures, with the structure of the set occurring in 5 different versions, there are 50 different structures that must be checked to determine whether the header’s version information, which is stored in a variable, is consistent with the currently checked structure.
When you assign a set of structures to a group, the operator runs version checks less frequently, improving performance. In the previous example, version information is checked once for each set of structures, for a maximum of 5 times (once for each version).
The following example shows the initial declaration (for the header and two versions of one structure) with the version check for each condition:
<variable name="version" type="uint16" value="99"/>
<structure name="header">
<condition>
<cmp op="equal">
<field name="RECORD_TYPE"/>
<value>0</value> <!--header -->
</cmp>
</condition>
<action>
<store field="VERSION" as="version"/>
</action>
<field name="RECORD_TYPE" type="uint8"/>
<field name="VERSION" type="uint16"/>
</structure>
<structure name="record_0" >
<condition>
<logicOp op="and">
<cmp op="equal">
<variable name="version"/>
<value>0</value>
</cmp>
<cmp op="equal">
<field name="RECORD_TYPE"/>
<value>1</value>
</cmp>
</logicOp>
</condition>
<field name="RECORD_TYPE" type="uint8"/>
...
</structure>
<structure name="record_1" >
<condition>
<logicOp op="and">
<cmp op="equal">
<variable name="version"/>
<value>1</value>
</cmp>
<cmp op="equal">
<field name="RECORD_TYPE"/>
<value>1</value>
</cmp>
</logicOp>
</condition>
<field name="RECORD_TYPE" type="uint8"/>
...
</structure>
The following example shows the declaration with groups. The StructureParse operator generates code for the group, which contains more than one structure. This code is more efficient because when structures are assigned to a group, the operator runs version checks less frequently, improving performance.
<variable name="version" type="uint16" value="99"/>
<group name="v0">
<condition>
<cmp op="equal">
<variable name="version"/>
<value>0</value>
</cmp>
</condition>
</group>
<group name="v1">
<condition>
<cmp op="equal">
<variable name="version"/>
<value>1</value>
</cmp>
</condition>
</group>
<structure name="header">
<condition>
<cmp op="equal">
<field name="RECORD_TYPE"/>
<value>0</value> <!--header -->
</cmp>
</condition>
<action>
<store field="VERSION" as="version"/>
</action>
<field name="RECORD_TYPE" type="uint8"/>
<field name="VERSION" type="uint16"/>
</structure>
<structure name="record_0" group="v0" >
<condition>
<cmp op="equal">
<field name="RECORD_TYPE"/>
<value>1</value>
</cmp>
</condition>
<field name="RECORD_TYPE" type="uint8"/>
...
</structure>
<structure name="record_1" group="v1" >
<condition>
<cmp op="equal">
<field name="RECORD_TYPE"/>
<value>1</value>
</cmp>
</condition>
<field name="RECORD_TYPE" type="uint8"/>
...
</structure>