1

I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,"Bob") to see if the string "Bob" for example is located. However, I'm trying to see if either "Bob" or "Alice" are in the disassembly. I could just loop from the beginning to the end twice using idc.FindText but that takes too much time. Is there a way I can loop through the disassembly only once and check if either of the strings are used? Thanks for any help.

  • Are you trying to find a string in the binary, or some special value that IDA generates? – tmr232 Jul 12 '16 at 6:16
1

You could use regular expression:

idc.FindText(ea, idc.SEARCH_REGEX | idc.SEARCH_DOWN, y, x, "Bob|Alice")
#                ^^^^^^^^^^^^^^^^                              ^

IDA Pro uses POSIX ERE syntax as described in https://www.hex-rays.com/products/ida/support/idadoc/578.shtml.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.