Package ghidra.features.base.memsearch.searcher

Class MemorySearcher

java.lang.Object
ghidra.features.base.memsearch.searcher.MemorySearcher
public class MemorySearcher extends Object
Class for searching bytes from a byteSource (memory) using a ByteMatcher. It handles breaking the search down into a series of searches, handling gaps in the address set and breaking large address ranges down into manageable sizes.

It is created with a specific byte source, matcher, address set, and search limit. Clients can then either call the findAll(Accumulator, TaskMonitor) method or use it to incrementally search using findNext(Address, TaskMonitor), findPrevious(Address, TaskMonitor), or findOnce(Address, boolean, TaskMonitor).

  • Constructor Details

    • MemorySearcher

      public MemorySearcher(AddressableByteSource byteSource, ByteMatcher matcher, AddressSet addresses, int searchLimit)
      Constructor
      Parameters:
      byteSource - the source of the bytes to be searched
      matcher - the matcher that can find matches in a byte sequence
      addresses - the address in the byte source to search
      searchLimit - the max number of hits before stopping

    • MemorySearcher

      public MemorySearcher(AddressableByteSource byteSource, ByteMatcher matcher, AddressSet addresses, int searchLimit, int chunkSize)
      Constructor
      Parameters:
      byteSource - the source of the bytes to be searched
      matcher - the matcher that can find matches in a byte sequence
      addresses - the address in the byte source to search
      searchLimit - the max number of hits before stopping
      chunkSize - the maximum number of bytes to feed to the matcher at any one time.

  • Method Details

    • setMatchFilter

      public void setMatchFilter(Predicate<MemoryMatch> filter)
      Sets any match filters. The filter can be used to exclude matches that don't meet some criteria that is not captured in the byte matcher such as alignment and code unit type.
      Parameters:
      filter - the predicate to use to filter search results

    • findAll

      public boolean findAll(Accumulator<MemoryMatch> accumulator, TaskMonitor monitor)
      Searches all the addresses in this search's AddressSetView using the byte matcher to find matches. As each match is found (and passes any filters), the match is given to the accumulator. The search continues until either the entire address set has been search or the search limit has been reached.
      Parameters:
      accumulator - the accumulator for found matches
      monitor - the task monitor
      Returns:
      true if the search completed searching through the entire address set.

    • findOnce

      public MemoryMatch findOnce(Address start, boolean forward, TaskMonitor monitor)
      Searches forwards or backwards starting at the given address until a match is found or the start or end of the address set is reached. It does not currently wrap the search.
      Parameters:
      start - the address to start searching
      forward - if true, search forward, otherwise, search backwards.
      monitor - the task monitor
      Returns:
      the first match found or null if no match found.

    • findNext

      public MemoryMatch findNext(Address start, TaskMonitor monitor)
      Searches forwards starting at the given address until a match is found or the end of the address set is reached. It does not currently wrap the search.
      Parameters:
      start - the address to start searching
      monitor - the task monitor
      Returns:
      the first match found or null if no match found.

    • findPrevious

      public MemoryMatch findPrevious(Address start, TaskMonitor monitor)
      Searches backwards starting at the given address until a match is found or the beginning of the address set is reached. It does not currently wrap the search.
      Parameters:
      start - the address to start searching
      monitor - the task monitor
      Returns:
      the first match found or null if no match found.