findallmem/findmemall¶
Find all occurrences of a pattern in the entire memory map.
arguments¶
arg1
The address to start searching from.
arg2
The byte pattern to search for. This byte pattern can contain wildcards (?) for example: EB0?90??8D
. You can use String Formatting here.
[arg3]
The size of the data to search in. Default is the entire memory map (-1
).
[arg4]
Set to user
/system
/module
to only include (user/system) modules in the search.
result¶
$result
is set to the number of occurrences.
remarks¶
The contents of the reference view can be iterated in a script with the ref.addr
expression function:
i = 0
loop:
addr = ref.addr(i)
log "reference {d:i} = {p:addr}"
i++
cmp i, ref.count()
jne loop