find_string

summary: using “ida_bytes.find_string”

description:

IDAPython’s ida_bytes.find_string can be used to implement a simple replacement for the ‘Search > Sequence of bytes…’ dialog, that lets users search for sequences of bytes that compose string literals in the binary file (either in the default 1-byte-per-char encoding, or as UTF-16.)

level: intermediate

Attributes

ACTION_NAME
ACTION_SHORTCUT

Classes

search_strlit_form_t
search_strlit_ah_t

Module Contents

class find_string.search_strlit_form_t

Bases: ida_kernwin.Form

class find_string.search_strlit_ah_t

Bases: ida_kernwin.action_handler_t

activate(ctx)

Activate an action. This function implements the core behavior of an action. It is called when the action is triggered, from a menu, from a popup menu, from the toolbar, or programmatically.

Returns:

non-zero: all IDA windows will be refreshed

update(ctx)

Update an action. This is called when the context of the UI changed, and we need to let the action update some of its properties if needed (label, icon, …) In addition, this lets IDA know whether the action is enabled, and when it should be queried for availability again. Note: This callback is not meant to change anything in the application’s state, except by calling one (or many) of the “update_action_*()” functions on this very action.

find_string.ACTION_NAME = 'find_string:search'

find_string.ACTION_SHORTCUT = 'Ctrl+Shift+S'