Search And Replace
The search and replace feature allows to users to search for specific text sequences in various Ghidra elements and replace that text sequence with a different text sequence. Using this feature, many different elements in Ghidra can be renamed including labels, functions, namespaces, parameters, datatypes, field elements, enum values, and others. This feature can also be used to change comments placed on items such as instructions or data, structure field element, or enum values.
By default, the search matches the text anywhere in an element ("contains"), but it has full regular expression support where users can easily perform a "starts with" or "ends with" search. Regular expression capture groups are also supported which allows for complex replacing of disjoint strings. See the examples section below for details.
To initiate a search and replace operation, select Search 
Search and Replace from the main tool menu.
Search and Replace Dialog
The Search and Replace Dialog provides controls and options for performing and search and replace operation.
Search and Replace Dialog
Find
This is a text field for entering the text to be searched for in the selected Ghidra elements. Elements are either the names of things such as labels, functions, datatypes, or a comment associated with some item such as an instruction comment or structure field comment.
Ghidra will find all the elements that contain the given text. To perform a "starts with" or "ends with" search, you must enter a regular expression here and select the regular expression option below.
There is also a drop down list of recent searches for this Ghidra session.
Replace
This is a text field for entering the replacement text. This text will be used to replace the text that matched the search text. For example, if a function was named "startCat" and the goal was to change it to "startDog", you would enter "Cat" in the Find field and "Dog" in this field.
This field also include a drop drow of the most recently enter replacement strings.
Options
Regular Expression
If selected, the search text will be interpreted as a regular expression. This allows for complex search and replace operations. See the general section on regular expressions for more information. If you want to anything other than a "contains" search, you must use a regular expression. See below for examples on how to do this.
Case Sensitive
If selected, the entered search text must match exactly. Otherwise, the entered search text can match regardless of the case of the search text or the target text.
Whole Word
If selected, the target text must be an entire word. In other words it must be surrounded by white space or must be the first or last word in a word sequence. So, when applied to renaming elements, the search text must match the entire name of the element since element names cannot contain whitespace. But for comments, the search text must entirely match one word withing the comment.
Search For
This section contains a group of checkboxes used to turn on or off the type of Ghidra elements to search. There are also buttons for selecting and deselecting all the element checkboxes. At least one checkbox must be selected to perform a search.
- Classes - Search the names of classes.
- Comments - Search instruction or data comments. This includes pre-comments, plate comments, end of line comments, post-comments, and repeatable comments.
- Datatype Categories - Search for the names of categories in the data types tree.
- Datatype Comments - Search comments associated with datatypes. This includes descriptions on enums and structures, datatype field comments, and enum value comments.
- Datatype Fields - Search the names of structure or union field elements.
- Datatypes - Search the names of any nameable datatype (i.e., does not search built-in datatypes such as byte, word, string, etc.)
- Enum Values - Search the names of enum values.
- Functions - Search the names of functions. (Note: This search does not include external function names.)
- Labels - Search the names of labels. (Note: This search does not include external labels.)
- Local Variables - Search the names of function local variables. (Note: This does not include local variables derived by the decompiler that haven't been committed to the database.)
- Memory Blocks - Search the names of Memory Blocks.
- Namespaces - Search the names of namespaces.
- Parameters - Search the names of function parameters.
- Program Trees - Search the names of modules and fragments defined in program trees.
Results Window
After initiating a search and replace action, a results window will appear containing a table showing each search match as an entry in the table. At this point, no changes have been made to the program. This provides an opportunity to review the pending changes before they are applied. The changes can now be applied all at once or individually.
There is also a popup toggle action
to turn on an option to auto delete applied entries from the table.