I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,"Bob") to see if the string "Bob" for example is located. However, I'm trying to see if either "Bob" or "Alice" are in the disassembly. I could just loop from the beginning to the end twice using idc.FindText but that takes too much time. Is there a way I can loop through the disassembly only once and check if either of the strings are used? Thanks for any help.
1 Answer
You could use regular expression:
idc.FindText(ea, idc.SEARCH_REGEX | idc.SEARCH_DOWN, y, x, "Bob|Alice")
# ^^^^^^^^^^^^^^^^ ^
IDA Pro uses POSIX ERE syntax as described in https://www.hex-rays.com/products/ida/support/idadoc/578.shtml.