Package ghidra.program.util.string

Class AbstractStringSearcher

java.lang.Object

ghidra.program.util.string.AbstractStringSearcher

Direct Known Subclasses:

PascalStringSearcher, StringSearcher

public abstract class AbstractStringSearcher
extends Object

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractStringSearcher(Program program, CharSetRecognizer charSet, int minimumStringSize, int alignment, boolean includeUTF8, boolean includeUTF16, boolean includeUTF32)

Method Summary

Modifier and Type	Method	Description
int	getAlignment()
protected FoundString	getFoundString(MemBuffer buf, Sequence sequence, DataType stringDataType)
protected abstract void	processSequence(FoundStringCallback callback, Sequence sequence, MemBuffer buf)
AddressSetView	search(AddressSetView addressSet, FoundStringCallback callback, boolean searchLoadedMemoryBlocksOnly, TaskMonitor monitor)	Searches the given addressSet for strings.
AddressSetView	updateAddressesToSearch(AddressSetView addressSet, boolean useLoadedBlocksOnly)	Returns a new address set that is the intersection of the given set with the desired memory block addresses (loaded or unloaded).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AbstractStringSearcher

protected AbstractStringSearcher(Program program,
 CharSetRecognizer charSet,
 int minimumStringSize,
 int alignment,
 boolean includeUTF8,
 boolean includeUTF16,
 boolean includeUTF32)

Method Details

search

public AddressSetView search(AddressSetView addressSet,
 FoundStringCallback callback,
 boolean searchLoadedMemoryBlocksOnly,
 TaskMonitor monitor)

Searches the given addressSet for strings.

Note: The address set searched will be modified before searching in the following ways:

• if the given set is null, it will be re-initialized to encompass all of program memory
• the set will be further culled to only include loaded memory blocks, if specified

Parameters:

addressSet - the address set to search over; if null, will initialized to all memory

callback - the callback invoked when a string is found

searchLoadedMemoryBlocksOnly - if true, will exclude unloaded memory blocks from the search

monitor - the user monitor

Returns:

the updated address set used for the search

updateAddressesToSearch

public AddressSetView updateAddressesToSearch(AddressSetView addressSet,
 boolean useLoadedBlocksOnly)

Returns a new address set that is the intersection of the given set with the desired memory block addresses (loaded or unloaded).

Note: This desired set of memory blocks is known by inspecting the StringTableOptions.useLoadedBlocksOnly() attribute set by the user.

Parameters:

addressSet - the address set to update

useLoadedBlocksOnly - if true, only return addresses in loaded memory blocks

Returns:

new the new address set

processSequence

protected abstract void processSequence(FoundStringCallback callback,
 Sequence sequence,
 MemBuffer buf)

getFoundString

protected FoundString getFoundString(MemBuffer buf,
 Sequence sequence,
 DataType stringDataType)

getAlignment

public int getAlignment()