2

I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,"Bob") to see if the string "Bob" for example is located. However, I'm trying to see if either "Bob" or "Alice" are in the disassembly. I could just loop from the beginning to the end twice using idc.FindText but that takes too much time. Is there a way I can loop through the disassembly only once and check if either of the strings are used? Thanks for any help.

1
  • Are you trying to find a string in the binary, or some special value that IDA generates?
    – tmr232
    Jul 12, 2016 at 6:16

1 Answer 1

3

You could use regular expression:

idc.FindText(ea, idc.SEARCH_REGEX | idc.SEARCH_DOWN, y, x, "Bob|Alice")
#                ^^^^^^^^^^^^^^^^                              ^

IDA Pro uses POSIX ERE syntax as described in https://www.hex-rays.com/products/ida/support/idadoc/578.shtml.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.