MCPcopy Create free account
hub / github.com/Vector35/binaryninja-api / search

Method search

python/binaryview.py:9232–9315  ·  view source on GitHub ↗

r""" Searches for matches of the specified `pattern` within this BinaryView with an optionally provided address range specified by `start` and `end`. The search pattern can be interpreted in various ways: - specified as a string of hexadecimal digits where whitespace is ignored, and the '?'

(self, pattern: str, start: int = None, end: int = None, raw: bool = False, ignore_case: bool = False, overlap: bool = False, align: int = 1,
		limit: int = None, progress_callback: Optional[ProgressFuncType] = None, match_callback: Optional[DataMatchCallbackType] = None)

Source from the content-addressed store, hash-verified

9230 return self.QueueGenerator(t, results)
9231
9232 def search(self, pattern: str, start: int = None, end: int = None, raw: bool = False, ignore_case: bool = False, overlap: bool = False, align: int = 1,
9233 limit: int = None, progress_callback: Optional[ProgressFuncType] = None, match_callback: Optional[DataMatchCallbackType] = None) -> QueueGenerator:
9234 r"""
9235 Searches for matches of the specified `pattern` within this BinaryView with an optionally provided address range specified by `start` and `end`.
9236 The search pattern can be interpreted in various ways:
9237
9238 - specified as a string of hexadecimal digits where whitespace is ignored, and the '?' character acts as a wildcard
9239 - a regular expression suitable for working with bytes
9240 - or if the `raw` option is enabled, the pattern is interpreted as a raw string, and any special characters are escaped and interpreted literally
9241
9242 :param pattern: The pattern to search for.
9243 :type pattern: :py:class:`str`
9244 :param start: The address to start the search from. (default: None)
9245 :type start: :py:class:`int`
9246 :param end: The address to end the search (inclusive). (default: None)
9247 :type end: :py:class:`int`
9248 :param bool raw: Whether to interpret the pattern as a raw string (default: False).
9249 :param bool ignore_case: Whether to perform case-insensitive matching (default: False).
9250 :param bool overlap: Whether to allow matches to overlap (default: False).
9251 :param int align: The alignment of matches, must be a power of 2 (default: 1).
9252 :param int limit: The maximum number of matches to return (default: None).
9253 :param callback progress_callback: An optional function to be called with the current progress and total count. \
9254 This function should return a boolean value that decides whether the search should continue or stop.
9255 :param callback match_callback: A function that gets called when a match is found. The callback takes two parameters: \
9256 the address of the match, and the actual DataBuffer that satisfies the search. This function can return a boolean value \
9257 that decides whether the search should continue or stop.
9258
9259 :return: A generator object that yields the offset and matched DataBuffer for each match found.
9260 :rtype: QueueGenerator
9261 :Example:
9262 >>> from binaryninja import load
9263 >>> bv = load('/bin/ls')
9264 >>> print(bv)
9265 <BinaryView: '/bin/ls', start 0x100000000, len 0x182f8>
9266 >>> bytes(list(bv.search("50 ?4"))[0][1]).hex()
9267 '5004'
9268 >>> bytes(list(bv.search("[\x20-\x25][\x60-\x67]"))[0][1]).hex()
9269 '2062'
9270 """
9271 if start is None:
9272 start = self.start
9273 if end is None:
9274 end = self.end
9275 if end != 0xffffffffffffffff:
9276 end = end - 1
9277 if start > end:
9278 raise ValueError("The start address must be less than or equal to end address!")
9279 query = {
9280 "pattern": pattern,
9281 "start": start,
9282 "end": end,
9283 "raw": raw,
9284 "ignoreCase": ignore_case,
9285 "overlap": overlap,
9286 "align": align
9287 }
9288
9289 if progress_callback:

Callers 6

getVarWidthMethod · 0.80
genEncodingBlockFunction · 0.80
gather_samplesFunction · 0.80
test_gen.pyFile · 0.80
normalizeFunction · 0.80
generate_stubs.pyFile · 0.80

Calls

no outgoing calls

Tested by 2

gather_samplesFunction · 0.64
normalizeFunction · 0.64