ikegami: I could redo them, but so can the OP, and he has the benefit of having representative data.

I did a short test on a Linux 2.6.18 in a VM within a XP (Athlon/64 3400+)
(I just searched some hex codes within the kernel image.)

use strict;
use warnings;
use Benchmark qw( cmpthese );

my $fn = '/boot/vmlinux-2.6.18.8-96-default.gz';
open my $fh, '<', $fn or die $!;
read $fh, my $buffer, 2_000_000 or die $!;
print length $buffer, " in\n";
close $fh;

my $subs = {
    by_index => sub {
       my ($p0, @offs)=(-1, ());
       push @offs, $p0 while +($p0=index $buffer, "\xaa", $p0+1) != -1
+;
       push @offs, $p0 while +($p0=index $buffer, "\xbb", $p0+1) != -1
+;
       push @offs, $p0 while +($p0=index $buffer, "\xcc", $p0+1) != -1
+;
       return 0 + @offs
    },
    by_regex => sub {
       my @offs=();
       push @offs, pos($buffer) while $buffer =~ /\xaa/g;
       push @offs, pos($buffer) while $buffer =~ /\xbb/g;
       push @offs, pos($buffer) while $buffer =~ /\xcc/g;
       return 0 + @offs
    }
};
cmpthese( -3, $subs );
[download]

Which ended up somehow interesting (corrected, machine w/no load):

1769416 in
           Rate by_regex by_index
by_regex 51.0/s       --      -5%
by_index 53.4/s       5%       --
[download]

Very new to me. Thanks to all involved ;-)

Regards
mwa