Package ghidra.util.bytesearch

Class ProgramMemorySearcher<T extends BytePattern>

java.lang.Object

ghidra.util.bytesearch.ProgramMemorySearcher<T>

Type Parameters:

T - The specific pattern class type

public class ProgramMemorySearcher<T extends BytePattern>
extends Object

Class for efficiently searching for one or more patterns in memory. Patterns used by this class can be any class that implements BytePattern, so clients are free to create their own custom pattern classes.

Note: this searcher searches each memory block individually. It intentionally does not find patterns that span memory blocks (even if the memory blocks are adjacent). If you want patterns to span memory blocks, you can use the MemorySearcher class, which is not block oriented.

Constructor Summary

Constructors

Change	Constructor	Description
	ProgramMemorySearcher(String name, Program program, BulkPatternSearcher<T> patternSearcher)	Constructor
	ProgramMemorySearcher(String name, Program program, List<T> patterns)	Constructor

Method Summary

Change	Modifier and Type	Method	Description
	void	search(AddressSetView addresses, Consumer<AddressMatch<T>> consumer, TaskMonitor monitor)	Searches the given address set within initialized memory for the patterns given to this searcher.
	void	searchAll(Consumer<AddressMatch<T>> consumer, TaskMonitor monitor)	Searches all initialized memory in the program for the patterns given to this searcher.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ProgramMemorySearcher

public ProgramMemorySearcher NEW(String name,
 Program program,
 List<T> patterns)

Constructor

Parameters:

name - the name of the searcher. (Used by the task monitor messages)

program - The program whose memory is to be searched

patterns - the list of pattern objects to search for

ProgramMemorySearcher

public ProgramMemorySearcher(String name,
 Program program,
 BulkPatternSearcher<T> patternSearcher)

Constructor

Parameters:

name - the name of the searcher. (Used by the task monitor messages)

program - The program whose memory is to be searched

patternSearcher - the pre-constructed pattern searcher which is state-less and be reused, saving the time of building the state machine for the patterns.

Method Details

searchAll

public void searchAll(Consumer<AddressMatch<T>> consumer,
 TaskMonitor monitor)
               throws CancelledException

Searches all initialized memory in the program for the patterns given to this searcher.

Parameters:

consumer - the consumer to be called back when a match is found

monitor - the task monitor for reporting progress and allowing for cancellation

Throws:

CancelledException - thrown if the search is cancelled via the task monitor

search

public void search(AddressSetView addresses,
 Consumer<AddressMatch<T>> consumer,
 TaskMonitor monitor)
            throws CancelledException

Searches the given address set within initialized memory for the patterns given to this searcher.

Parameters:

addresses - The address within the program to search. This address set will be further restricted to initialized program memory

consumer - the consumer to be called back when a match is found

monitor - the task monitor for reporting progress and allowing for cancellation

Throws:

CancelledException - thrown if the search is cancelled via the task monitor