源字符串：
72,13:55:56.902,VCAN.exe(19480),COM1,IRP_MJ_WRITE,1046, 62 72 75 73 68 20 77 64 61 74 65 20 00 70 00 20 11 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 8D 02 00 79 04 02 00 00 00 00 00 D1 8F 02 00 39 90 02 00 4D 99 03 00 5B 99 03 00 69 99 03 00 77 99 03 00 85 99 03 00 93 99 03 00 A1 99 03 00 AF 99 03 00 BD 99 03 00 CB 99 03 00 D9 99 03 00 E7 99 03 00 F5 99 03 00 03 9A 03 00 11 9A 03 00 1F 9A 03 00 2D 9A 03 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 27 25 03 00 35 25 03 00 A9 20 03 00 B7 20 03 00 C5 20 03 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 F9 D5 02 00 07 D6 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 55 72 03 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 29 73 03 00 37 73 03 00 45 73 03 00 53 73 03 00 61 73 03 00 79 04 02 00 79 04 02 00 6F 73 03 00 7D 73 03 00 79 04 02 00 8B 73 03 00 79 04 02 00 79 04 02 00 79 04 02 00 99 73 03 00 A7 73 03 00 79 04 02 00 B5 73 03 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 FF FF FF FF 00 00 93 16 0D 0A 4F 4B 0D 0A , brush wdate \NULp\NUL \DC1\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL\NUL憤\STX\NULy\EOT\STX\NUL\NUL\NUL\NUL\NUL褟\STX\NUL9怽STX\NULM橽ETX\NUL[橽ETX\NULi橽ETX\NULw橽ETX\NUL厵\ETX\NUL摍\ETX\NUL\ETX\NUL瘷\ETX\NUL綑\ETX\NUL藱\ETX\NUL贆\ETX\NUL鐧\ETX\NUL鯔\ETX\NUL\ETX歕ETX\NUL\DC1歕ETX\NUL\US歕ETX\NUL-歕ETX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NUL’%\ETX\NUL5%\ETX\NUL?\ETX\NUL?\ETX\NUL?\ETX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NUL\STX\NUL\BEL謀STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULUr\ETX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NUL)s\ETX\NUL7s\ETX\NULEs\ETX\NULSs\ETX\NULas\ETX\NULy\EOT\STX\NULy\EOT\STX\NULos\ETX\NUL}s\ETX\NULy\EOT\STX\NUL媠\ETX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NUL檚\ETX\NUL\ETX\NULy\EOT\STX\NUL祍\ETX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NULy\EOT\STX\NUL\NUL\NUL揬SYN\CR\LFOK\CR\LF,
目标字符串：
62 72 75 73 68 20 77 64 61 74 65 20 00 70 00 20 11 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 8D 02 00 79 04 02 00 00 00 00 00 D1 8F 02 00 39 90 02 00 4D 99 03 00 5B 99 03 00 69 99 03 00 77 99 03 00 85 99 03 00 93 99 03 00 A1 99 03 00 AF 99 03 00 BD 99 03 00 CB 99 03 00 D9 99 03 00 E7 99 03 00 F5 99 03 00 03 9A 03 00 11 9A 03 00 1F 9A 03 00 2D 9A 03 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 27 25 03 00 35 25 03 00 A9 20 03 00 B7 20 03 00 C5 20 03 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 F9 D5 02 00 07 D6 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 55 72 03 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 29 73 03 00 37 73 03 00 45 73 03 00 53 73 03 00 61 73 03 00 79 04 02 00 79 04 02 00 6F 73 03 00 7D 73 03 00 79 04 02 00 8B 73 03 00 79 04 02 00 79 04 02 00 79 04 02 00 99 73 03 00 A7 73 03 00 79 04 02 00 B5 73 03 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 79 04 02 00 FF FF FF FF 00 00 93 16 0D 0A 4F 4B 0D 0A
第一次操作，去除每行的前部无效数据
.+IRP_MJ_WRITE,…
第二次操作，去除尾部的无效数据
, brush wdate.+
经过简单的处理，将实际要用的数据抽取出来，经过比较，很快就找到了问题。