memcmp is not the way to do it.
Absolutely. The right way to do it is to use the memmem library call.
A much faster solution would be the same approach rsync takes with its "rolling checksum."
That's one way to improve performance, yes. (But it far predates rsync -- I think it might even predate Tridge.)
In many cases, a "look and skip" algorithm like KMP or BM will outperform a rolling checksum search; but of course if you've got 328MB of data on disk, nothing will make the search faster than the time it takes to read the data into RAM.