Package ghidra.util.bytesearch

Class MemoryBytePatternSearcher

java.lang.Object

ghidra.util.bytesearch.MemoryBytePatternSearcher

public class MemoryBytePatternSearcher
extends Object

Multi pattern/mask/action memory searcher Patterns must be supplied/added, or a pre-initialized searchState supplied Preload search patterns and actions, then call search method.

Constructor Summary

Constructors

Constructor	Description
MemoryBytePatternSearcher(String searchName)	Create with no patternList, must add patterns before searching
MemoryBytePatternSearcher(String searchName, SequenceSearchState root)	Create with an initialized SequenceSearchState
MemoryBytePatternSearcher(String searchName, ArrayList<Pattern> patternList)	Create with pre-created patternList

Method Summary

Modifier and Type	Method	Description
void	addPattern(Pattern pattern)	Add a search pattern
void	postMatchApply(MatchAction[] matchactions, Address addr)	Called after any match rules are applied Can use for cross post rule matching state application and cleanup.
void	preMatchApply(MatchAction[] matchactions, Address addr)	Called before any match rules are applied
void	search(Program program, AddressSetView searchSet, TaskMonitor monitor)	Search initialized memory blocks for all patterns(bytes/mask/action).
void	setSearchExecutableOnly(boolean doExecutableBlocksOnly)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

MemoryBytePatternSearcher

public MemoryBytePatternSearcher(String searchName,
 ArrayList<Pattern> patternList)

Create with pre-created patternList

Parameters:

searchName - name of search

patternList - - list of patterns(bytes/mask/action)

MemoryBytePatternSearcher

public MemoryBytePatternSearcher(String searchName,
 SequenceSearchState root)

Create with an initialized SequenceSearchState

Parameters:

searchName - name of search

root - search state pre-initialized

MemoryBytePatternSearcher

public MemoryBytePatternSearcher(String searchName)

Create with no patternList, must add patterns before searching

Parameters:

searchName - name of search

Method Details

addPattern

public void addPattern(Pattern pattern)

Add a search pattern

Parameters:

pattern - - pattern(bytes/mask/action)

setSearchExecutableOnly

public void setSearchExecutableOnly(boolean doExecutableBlocksOnly)

search

public void search(Program program,
 AddressSetView searchSet,
 TaskMonitor monitor)
            throws CancelledException

Search initialized memory blocks for all patterns(bytes/mask/action). Call associated action for each pattern matched.

Parameters:

program - to be searched

searchSet - set of bytes to restrict search, if null or empty then search all memory blocks

monitor - allow canceling and reporting of progress

Throws:

CancelledException - if canceled

preMatchApply

public void preMatchApply(MatchAction[] matchactions,
 Address addr)

Called before any match rules are applied

Parameters:

matchactions - actions that matched

addr - address of match

postMatchApply

public void postMatchApply(MatchAction[] matchactions,
 Address addr)

Called after any match rules are applied Can use for cross post rule matching state application and cleanup.

Parameters:

matchactions - actions that matched

addr - adress of match