Package ghidra.app.util.navigation

Class SymbolSearcher

java.lang.Object
ghidra.app.util.navigation.SymbolSearcher
public class SymbolSearcher extends Object
Class for searching for symbols that match a given query string.

The query string may include full or partial (absolute or relative) namespace path information. The standard namespace delimiter ("::") is used to separate the query into it separate pieces, with each piece used to either match a namespace or a symbol name, with the symbol name piece always being the last piece (or the only piece).

Both the namespace pieces and the symbol name piece may contain wildcards ("*" or "?") and those wildcards only apply to a single element. For example, if a symbol's full path was "a::b::c::d" and the query was "a::*::d", it would not match as the "*" can only match one element.

By default all queries are considered relative. In other words, the first namespace element does not need to be at the root global level. For example, in the "a::b::c::d" example, the "d" symbol could be found by "d", "c::d", "b::c::d". To avoid this behavior, the query may begin with a "::" delimiter which means the path is absolute and the first element must be at the root level. So, in the previous example, "::a::b::c::d" would match but, "::c::d" would not.

There are also two parameters in the QueryData object that affect how the search algorithm is conducted. One is "Case Sensitive" and the other is "Include Dynamic Labels". If the search is case insensitive or there are wild cards in the symbol name, the only option is to do a full search of all defined symbols, looking for matches. If that is not the case, the search can do a direct look up of matching symbols using the program database's symbol index.

If the "Include Dynamic Labels" options is on, then a brute force of the defined references is also performed, looking at all addresses that a reference points to, getting the dynamic (not stored) symbol at that address and checking if it matches.

One last behavior to note is that the search takes a list of programs to search. However, it only returns results from the FIRST program to have any results. If the need to search all programs completely is ever needed, a second "find" method could easily be added.