ida_search Namespace Reference

Detailed Description

Middle-level search functions.

They all are controlled by Search flags

Functions
"bool"	search_down (*args)
	search_down(sflag) -> bool Is the SEARCH_DOWN bit set?
"int *"	find_error (*args)
	find_error(ea, sflag) -> ea_t Find next error or problem.
"int *"	find_notype (*args)
	find_notype(ea, sflag) -> ea_t Find next operand without any type info.
"ea_t"	find_unknown (*args)
	find_unknown(ea, sflag) -> ea_t Find next unexplored address.
"ea_t"	find_defined (*args)
	find_defined(ea, sflag) -> ea_t Find next ea that is the start of an instruction or data.
"int *"	find_suspop (*args)
	find_suspop(ea, sflag) -> ea_t Find next suspicious operand.
"ea_t"	find_data (*args)
	find_data(ea, sflag) -> ea_t Find next data address.
"ea_t"	find_code (*args)
	find_code(ea, sflag) -> ea_t Find next code address.
"ea_t"	find_not_func (*args)
	find_not_func(ea, sflag) -> ea_t Find next code address that does not belong to a function.
"int *"	find_imm (*args)
	find_imm(ea, sflag, search_value) -> ea_t Find next immediate operand with the given value.
"ea_t"	find_text (*args)
	find_text(start_ea, y, x, ustr, sflag) -> ea_t See search()
"ea_t"	find_reg_access (*args)
	find_reg_access(out, start_ea, end_ea, regname, sflag) -> ea_t Find access to a register.
"ea_t"	find_binary (*args)
	find_binary(arg1, arg2, arg3, arg4, arg5) -> ea_t Deprecated.

Variables
int	SEARCH_UNICODE = 0x40
	SEARCH_UP = _ida_search.SEARCH_UP
	SEARCH_DOWN = _ida_search.SEARCH_DOWN
	SEARCH_NEXT = _ida_search.SEARCH_NEXT
	SEARCH_CASE = _ida_search.SEARCH_CASE
	SEARCH_REGEX = _ida_search.SEARCH_REGEX
	SEARCH_NOBRK = _ida_search.SEARCH_NOBRK
	SEARCH_NOSHOW = _ida_search.SEARCH_NOSHOW
	SEARCH_IDENT = _ida_search.SEARCH_IDENT
	SEARCH_BRK = _ida_search.SEARCH_BRK
	SEARCH_USE = _ida_search.SEARCH_USE
	SEARCH_DEF = _ida_search.SEARCH_DEF
	SEARCH_USESEL = _ida_search.SEARCH_USESEL

Function Documentation

find_binary()

"ea_t" find_binary

(

*

args

)

Please use ida_bytes.bin_search() instead.

Parameters

arg1	ea_t
arg2	ea_t
arg3	char const *
arg4	int
arg5	int

find_code()

"ea_t" find_code

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)

find_data()

"ea_t" find_data

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)

find_defined()

"ea_t" find_defined

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)

find_error()

"int *" find_error

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)

find_imm()

"int *" find_imm

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)
search_value	(C++: uval_t)

find_not_func()

"ea_t" find_not_func

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)

find_notype()

"int *" find_notype

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)

find_reg_access()

"ea_t" find_reg_access

(

*

args

)

Parameters

out	(C++: struct reg_access_t *) pointer to the output buffer. must be non-null. upon success contains info about the found register. upon failed search for a read access out->range contains the info about the non-redefined parts of the register.
start_ea	(C++: ea_t) starting address
end_ea	(C++: ea_t) ending address. BADADDR means that the end limit is missing. otherwise, if the search direction is SEARCH_UP, END_EA must be lower than START_EA.
regname	(C++: const char *) the register to search for.
sflag	(C++: int) combination of Search flags bits.

Note

: This function does not care about the control flow and probes all instructions in the specified range, starting from START_EA. Only direct references to registers are detected. Function calls and system traps are ignored.

Returns

: the found address. BADADDR if not found or error.

find_suspop()

"int *" find_suspop

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)

find_text()

"ea_t" find_text

(

*

args

)

Parameters

start_ea	(C++: ea_t)
y	(C++: int)
x	(C++: int)
ustr	(C++: const char *) char const *
sflag	(C++: int)

find_unknown()

"ea_t" find_unknown

(

*

args

)

Parameters

ea	(C++: ea_t)
sflag	(C++: int)

search_down()

"bool" search_down

(

*

args

)

Parameters

sflag

(C++: int)

Variable Documentation

SEARCH_BRK

SEARCH_BRK = _ida_search.SEARCH_BRK

SEARCH_CASE

SEARCH_CASE = _ida_search.SEARCH_CASE

SEARCH_DEF

SEARCH_DEF = _ida_search.SEARCH_DEF

SEARCH_DOWN

SEARCH_DOWN = _ida_search.SEARCH_DOWN

SEARCH_IDENT

SEARCH_IDENT = _ida_search.SEARCH_IDENT

SEARCH_NEXT

SEARCH_NEXT = _ida_search.SEARCH_NEXT

SEARCH_NOBRK

SEARCH_NOBRK = _ida_search.SEARCH_NOBRK

SEARCH_NOSHOW

SEARCH_NOSHOW = _ida_search.SEARCH_NOSHOW

SEARCH_REGEX

SEARCH_REGEX = _ida_search.SEARCH_REGEX

SEARCH_UNICODE

int SEARCH_UNICODE = 0x40

SEARCH_UP

SEARCH_UP = _ida_search.SEARCH_UP

SEARCH_USE

SEARCH_USE = _ida_search.SEARCH_USE

SEARCH_USESEL

SEARCH_USESEL = _ida_search.SEARCH_USESEL