Module `ida_search`

Middle-level search functions.

They all are controlled by Search flags

Global variables

var SEARCH_BRK: return BADADDR if the search was cancelled.
var SEARCH_CASE: case-sensitive search (case-insensitive otherwise)
var SEARCH_DEF: SEARCH_DEF = 1024
var SEARCH_DOWN: search towards higher addresses
var SEARCH_IDENT: search for an identifier (text search). it means that the characters before and after the match cannot be is_visible_char().
var SEARCH_NEXT: skip the starting address when searching. this bit is useful only for search(), bin_search2(), find_reg_access(). find_.. functions skip the starting address automatically.
var SEARCH_NOBRK: do not test if the user clicked cancel to interrupt the search
var SEARCH_NOSHOW: do not display the search progress/refresh screen
var SEARCH_REGEX: regular expressions in search string (supported only for the text search)
var SEARCH_UNICODE: SEARCH_UNICODE = 64
var SEARCH_UP: search towards lower addresses
var SEARCH_USE: SEARCH_USE = 512
var SEARCH_USESEL: query the UI for a possible current selection to limit the search to

Functions

def find_binary(*args) ‑> ea_t: find_binary(arg1, arg2, arg3, arg4, arg5) -> ea_t
Deprecated. Please use ida_bytes.bin_search() instead.

arg1: ea_t

arg2: ea_t

arg3: char const *

arg4: int

arg5: int
def find_code(*args) ‑> ea_t: find_code(ea, sflag) -> ea_t
Find next code address.

ea: (C++: ea_t)

sflag: (C++: int)
def find_data(*args) ‑> ea_t: find_data(ea, sflag) -> ea_t
Find next data address.

ea: (C++: ea_t)

sflag: (C++: int)
def find_defined(*args) ‑> ea_t: find_defined(ea, sflag) -> ea_t
Find next ea that is the start of an instruction or data.

ea: (C++: ea_t)

sflag: (C++: int)
def find_error(*args) ‑> int *: find_error(ea, sflag) -> ea_t
Find next error or problem.

ea: (C++: ea_t)

sflag: (C++: int)
def find_imm(*args) ‑> int *: find_imm(ea, sflag, search_value) -> ea_t
Find next immediate operand with the given value.

ea: (C++: ea_t)

sflag: (C++: int)

search_value: (C++: uval_t)
def find_not_func(*args) ‑> ea_t: find_not_func(ea, sflag) -> ea_t
Find next code address that does not belong to a function.

ea: (C++: ea_t)

sflag: (C++: int)
def find_notype(*args) ‑> int *: find_notype(ea, sflag) -> ea_t
Find next operand without any type info.

ea: (C++: ea_t)

sflag: (C++: int)
def find_reg_access(*args) ‑> ea_t: find_reg_access(out, start_ea, end_ea, regname, sflag) -> ea_t
Find access to a register.

out: (C++: struct reg_access_t *) pointer to the output buffer. must be non-null. upon success
contains info about the found register. upon failed search for a read access out->range contains the info about the non-redefined parts of the register.

start_ea: (C++: ea_t) starting address

end_ea: (C++: ea_t) ending address. BADADDR means that the end limit is missing.
otherwise, if the search direction is SEARCH_UP, END_EA must be lower than START_EA.

regname: (C++: const char *) the register to search for.

sflag: (C++: int) combination of Search flags bits.

note: This function does not care about the control flow and probes all
instructions in the specified range, starting from START_EA. Only direct references to registers are detected. Function calls and system traps are ignored.

return: the found address. BADADDR if not found or error.
def find_suspop(*args) ‑> int *: find_suspop(ea, sflag) -> ea_t
Find next suspicious operand.

ea: (C++: ea_t)

sflag: (C++: int)
def find_text(*args) ‑> ea_t: find_text(start_ea, y, x, ustr, sflag) -> ea_t
See search()

start_ea: (C++: ea_t)

y: (C++: int)

x: (C++: int)

ustr: (C++: const char *) char const *

sflag: (C++: int)
def find_unknown(*args) ‑> ea_t: find_unknown(ea, sflag) -> ea_t
Find next unexplored address.

ea: (C++: ea_t)

sflag: (C++: int)
def search_down(*args) ‑> bool: search_down(sflag) -> bool
Is the SEARCH_DOWN bit set?

sflag: (C++: int)