Package ghidra.features.base.memsearch.format

Class SearchFormat

java.lang.Object
ghidra.features.base.memsearch.format.SearchFormat
public abstract class SearchFormat extends Object
SearchFormats are responsible for parsing user input data into a ByteMatcher that can be used for searching memory. It also can convert search matches back into string data and can convert string data from other formats into string data for this format.

  • Field Details

  • Constructor Details

    • SearchFormat

      protected SearchFormat(String name)

  • Method Details

    • parse

      public abstract ByteMatcher parse(String input, SearchSettings settings)
      Parse the given input and settings into a ByteMatcher
      Parameters:
      input - the user input string
      settings - the current search/parse settings
      Returns:
      a ByteMatcher that can be used for searching bytes (or an error version of a matcher)

    • getToolTip

      public abstract String getToolTip()
      Returns a tool tip describing this search format
      Returns:
      a tool tip describing this search format

    • getName

      public String getName()
      Returns the name of the search format.
      Returns:
      the name of the search format

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • getValueString

      public String getValueString(byte[] bytes, SearchSettings settings)
      Reverse parses the bytes back into input value strings. Note that this is only used by numerical and string type formats. Byte oriented formats just return an empty string.
      Parameters:
      bytes - the to convert back into input value strings
      settings - The search settings used to parse the input into bytes
      Returns:
      the string of the reversed parsed byte values

    • convertText

      public abstract String convertText(String text, SearchSettings oldSettings, SearchSettings newSettings)
      Returns a new search input string, doing its best to convert an input string that was parsed by a previous SearchFormat. When it makes sense to do so, it will re-interpret the parsed bytes from the old format and reconstruct the input from those bytes. This allows the user to do conversions, for example, from numbers to hex or binary and vise-versa. If the byte conversion doesn't make sense based on the old and new formats, it will use the original input if that input can be parsed by the new input. Finally, if all else fails, the new input will be the empty string.
      Parameters:
      text - the old input that is parsable by the old format
      oldSettings - the search settings used to parse the old text
      newSettings - the search settings to used for the new text
      Returns:
      the "best" text to change the user search input to

    • getFormatType

      public abstract SearchFormat.SearchFormatType getFormatType()
      Returns the SearchFormat.SearchFormatType for this format. This is used to help with the convertText(String, SearchSettings, SearchSettings) method.
      Returns:
      the type for this format

    • compareValues

      public int compareValues(byte[] bytes1, byte[] bytes2, SearchSettings settings)
      Compares bytes from search results based on how this format interprets the bytes. By default, formats just compare the bytes one by one as if they were unsigned values. SearchFormats whose bytes represent numerical values will override this method and compare the bytes after interpreting them as numerical values.
      Parameters:
      bytes1 - the first array of bytes to compare
      bytes2 - the second array of bytes to compare
      settings - the search settings used to generate the bytes.
      Returns:
      a negative integer, zero, or a positive integer as the first byte array is less than, equal to, or greater than the second byte array

    • reverse

      protected void reverse(byte[] bytes)

    • isValidText

      protected boolean isValidText(String text, SearchSettings settings)