search.hpp File Reference

Detailed Description

Middle-level search functions.

They all are controlled by Search flags

Functions
THREAD_SAFE bool	search_down (int sflag)
	Is the SEARCH_DOWN bit set?
idaman int ida_export	search (void *ud, place_t *start, const place_t *end, int *startx, const char *str, int sflag)
	Search for a text substring (low level function). More...
find_... functions
Parameters ea start ea sflag combination of Search flags [out] opnum filled with operand number whenever relevant Returns first ea at which the search criteria is met
idaman ea_t ida_export	find_error (ea_t ea, int sflag, int *opnum=nullptr)
	Find next error or problem.
idaman ea_t ida_export	find_notype (ea_t ea, int sflag, int *opnum=nullptr)
	Find next operand without any type info.
idaman ea_t ida_export	find_unknown (ea_t ea, int sflag)
	Find next unexplored address.
idaman ea_t ida_export	find_defined (ea_t ea, int sflag)
	Find next ea that is the start of an instruction or data.
idaman ea_t ida_export	find_suspop (ea_t ea, int sflag, int *opnum=nullptr)
	Find next suspicious operand.
idaman ea_t ida_export	find_data (ea_t ea, int sflag)
	Find next data address.
idaman ea_t ida_export	find_code (ea_t ea, int sflag)
	Find next code address.
idaman ea_t ida_export	find_not_func (ea_t ea, int sflag)
	Find next code address that does not belong to a function.
idaman ea_t ida_export	find_imm (ea_t ea, int sflag, uval_t search_value, int *opnum=nullptr)
	Find next immediate operand with the given value.
idaman ea_t ida_export	find_text (ea_t start_ea, int y, int x, const char *ustr, int sflag)
	See search()
idaman ea_t ida_export	find_reg_access (struct reg_access_t *out, ea_t start_ea, ea_t end_ea, const char *regname, int sflag)
	Find access to a register. More...

Macros
#define	SEARCH_UP   0x000
	search towards lower addresses
#define	SEARCH_DOWN   0x001
	search towards higher addresses
#define	SEARCH_NEXT   0x002
	skip the starting address when searching. More...
#define	SEARCH_CASE   0x004
	case-sensitive search (case-insensitive otherwise)
#define	SEARCH_REGEX   0x008
	regular expressions in search string (supported only for the text search)
#define	SEARCH_NOBRK   0x010
	do not test if the user clicked cancel to interrupt the search
#define	SEARCH_NOSHOW   0x020
	do not display the search progress/refresh screen
#define	SEARCH_IDENT   0x080
	search for an identifier (text search). More...
#define	SEARCH_BRK   0x100
	return BADADDR if the search was cancelled.
#define	SEARCH_USE   0x200
	find_reg_access: search for a use (read access)
#define	SEARCH_DEF   0x400
	find_reg_access: search for a definition (write access)
#define	SEARCH_USESEL   0x800
	query the UI for a possible current selection to limit the search to

Function Documentation

find_reg_access()

idaman ea_t ida_export find_reg_access	(	struct reg_access_t *	out,
		ea_t	start_ea,
		ea_t	end_ea,
		const char *	regname,
		int	sflag
	)

Find access to a register.

Parameters

out	pointer to the output buffer. must be non-null. upon success contains info about the found register. upon failed search for a read access out->range contains the info about the non-redefined parts of the register.
start_ea	starting address
end_ea	ending address. BADADDR means that the end limit is missing. otherwise, if the search direction is SEARCH_UP, END_EA must be lower than START_EA.
regname	the register to search for.
sflag	combination of Search flags bits.

Note

This function does not care about the control flow and probes all instructions in the specified range, starting from START_EA. Only direct references to registers are detected. Function calls and system traps are ignored.

Returns

the found address. BADADDR if not found or error.

search()

idaman int ida_export search	(	void *	ud,
		place_t *	start,
		const place_t *	end,
		int *	startx,
		const char *	str,
		int	sflag
	)

Search for a text substring (low level function).

Parameters

	ud	line array parameter
[in,out]	start	pointer to starting place: start->ea: starting address start->lnnum: starting Y coordinate
	end	pointer to ending place: end->ea: ending address end->lnnum: ending Y coordinate
[in,out]	startx	pointer to starting X coordinate
	str	substring to search for.
	sflag	Search flags

Return values

0	substring not found
1	substring found. The matching position is returned in: start->ea: address start->lnnum: Y coordinate *startx: X coordinate
2	search was cancelled by ctrl-break. The farthest searched address is returned in the same manner as in the successful return (1).
3	the input regular expression is bad. The error message was displayed.