As you're being good enough to help in such detail, I'll give more detail that may help.
I'm honoured
Alas, you haven't revealed too much details. As a matter of fact you told one additional detail (that of the LUP not being allowed to match as prefix on the second run)
But, it did indeed made things a bit more interesting to work with ...
....To do this, I have to pass over the data in its entirity 3 seperate times.
Are you absolutely positively 100 percent sure about that ?
I ask, because proper data analysis and interpretation of the data before-hand (doing it right) usually reveals a few things that allow you to take/choose a different route. Not saying that you are doing it wrongly but afaict there would be a lot going on in those data-files you are scanning. Alas, i do not have the full specs of your data in front of me so can only take a uneducated guess here. see also (1)
That is why the second for loop reads
k := 7 to 15 do
because it's reading ahead 8 bytes from the first 8 bytes.
Yups, i fully understand that it needs the 8..15 for the index to the Buffer, but not for MyArray. Hence my remark.
MyArray (at least in the examples shown sofar) is an array indexed from zero to 7, not from 8 to 15 (assuming you made a typo there with 7).
E.g. MyArray[0..7] <> MyArray[k] (which runs from 8 to 15)
But perhaps i am wrong and in your code MyArray[] is actually indexed from 0..15 ?
So the second pass is just to look for the ID (so searching for the byte sequence held in MyArray) that was found in the first pass in any other places in the file where it is not prefixed by FE8000....Thats why, for a moment, I took the stance of using the offsets of where the InterfaceIDs were found, but that won't work because we know that the offsets found from Pass1 relate to where THEY ARE prefixed by FE80, not where they are NOT prefixed by it.
Yups, i fully understand. But, at first sight that was not clear to/for me (if it had been clear i would not have suggested it). See also (1)
So, ultimately, I need the InterfaceID Byte array in my list and I need to search for where it is and only pull out the instances where it isn't prefixed by FE80... 00
Yups, and it is not that different from my shown example
Then, once those offsets are found, another pass is needed but that's another story! At some stage, I expect the values from all 3 passes to be stored in in6_addr records
Well, it shouldn't be _that_ hard to do
The example as shown already implements pass one (ScanA) and needs some accommodation for pass two (ProcessData). Point is, the basics are the same.
So hopefully you see now why I need that byte array, and I need to be able to store their existance detected in PassA for use by PassB and PassC
Well, not exactly
You have the ID's stored inside the int64list. This list is populated until eof() on the first pass (see also the example i posted)
The second pass, should basically do the same scan as the first, except that you _don't want to have the LUP in the prefixbuffer. Ergo every prefix buffer that matches LUP means skip. In case not matching LUP, you walk through the int64list to see if any of them listed matches the bytes inside your ID buffer.
So, i do not really see why you would have the need to pass along MyArray directly to the second pass, unless (and of course) i have interpreted something wrongly from your descriptions.
(1)
What are you actually trying to do ? analyzing raw wireshark dumps or something ?
That is what i meant to say earlier with proper analyzing the data first. Are you aware that in case you are scanning data-packets that they occur in a particular order (depending on the protocol) ? That data-packets have a particular header and length, etc. ? In which case, the more information you can extract before-hand the quicker you are able to scan through the data. Even if that means you do not need or are interested in all that data/information.
I have indeed considered that, yes, and, as you say, it would be easier, but it just feels wrong. I'd rather battle my way through the hardships to get an efficient result than accept an inefficient result just for simplicity.
As a matter of fact, in practice it seems much easier doing so without using strings (even though i started out to suggest using a generic string list based on the initial description).
As long as you are able to 'abuse' any-which-type that is able to 'store' your data and is the smallest (= most efficient) in size (and easiest to work with) has preferences over storing things inside strings. I am aware that this is not true for some other languages out there but, we are currently not dealing with those. We use Pascal here
So, if you have 8 bytes, the first possible candidate to 'abuse' is qword and/or int64. It doesn't even require records or any of that. Together with the absolute keyword you can manipulate things your way as that can do exactly those things that you seem to want (e.g. treating an array of 8 bytes as int64 and, the other way around of course).
The positive thing about using strings is that their size/length isn't set in stone (so can easily be adapted using 16 byte arrays, or even larger) and that there already a lot of routines available for manipulating strings. But a few move's and copy's here and there will do the job just as good
BTW: the most efficient way is that of actually having working code