Search for the given pattern within the process memory. @type pattern: str, compat.unicode or L{Pattern} @param pattern: Pattern to search for. It may be a byte string, a Unicode string, or an instance of L{Pattern}. The following L{Pat
(self, pattern, minAddr=None, maxAddr=None)
| 1327 | # ------------------------------------------------------------------------------ |
| 1328 | |
| 1329 | def search(self, pattern, minAddr=None, maxAddr=None): |
| 1330 | """ |
| 1331 | Search for the given pattern within the process memory. |
| 1332 | |
| 1333 | @type pattern: str, compat.unicode or L{Pattern} |
| 1334 | @param pattern: Pattern to search for. |
| 1335 | It may be a byte string, a Unicode string, or an instance of |
| 1336 | L{Pattern}. |
| 1337 | |
| 1338 | The following L{Pattern} subclasses are provided by WinAppDbg: |
| 1339 | - L{BytePattern} |
| 1340 | - L{TextPattern} |
| 1341 | - L{RegExpPattern} |
| 1342 | - L{HexPattern} |
| 1343 | |
| 1344 | You can also write your own subclass of L{Pattern} for customized |
| 1345 | searches. |
| 1346 | |
| 1347 | @type minAddr: int |
| 1348 | @param minAddr: (Optional) Start the search at this memory address. |
| 1349 | |
| 1350 | @type maxAddr: int |
| 1351 | @param maxAddr: (Optional) Stop the search at this memory address. |
| 1352 | |
| 1353 | @rtype: iterator of tuple( int, int, str ) |
| 1354 | @return: An iterator of tuples. Each tuple contains the following: |
| 1355 | - The memory address where the pattern was found. |
| 1356 | - The size of the data that matches the pattern. |
| 1357 | - The data that matches the pattern. |
| 1358 | |
| 1359 | @raise WindowsError: An error occurred when querying or reading the |
| 1360 | process memory. |
| 1361 | """ |
| 1362 | if isinstance(pattern, str): |
| 1363 | return self.search_bytes(pattern, minAddr, maxAddr) |
| 1364 | if isinstance(pattern, compat.unicode): |
| 1365 | return self.search_bytes(pattern.encode("utf-16le"), minAddr, maxAddr) |
| 1366 | if isinstance(pattern, Pattern): |
| 1367 | return Search.search_process(self, pattern, minAddr, maxAddr) |
| 1368 | raise TypeError("Unknown pattern type: %r" % type(pattern)) |
| 1369 | |
| 1370 | def search_bytes(self, bytes, minAddr=None, maxAddr=None): |
| 1371 | """ |