Is there an interactive way to search for immediate integer values using a mask in IDA?

Question

Other than scripting a solution to this, can anyone recommend an interactive method to search for immediate integer values by mask in IDA?

Let me explain. Consider NTSTATUS values used in Windows internally. Roughly speaking if you see a 32 bit value that starts with (hexadecimal) C, followed by three 0 and then some arbitrary value in the lower 16 bit, chances are you are looking at an NTSTATUS error code. There are also success and warning codes, but a solution to this question would equally apply there.

Now, if I hit Alt+i, I am able to search an immediate value and repeat that search later on with Ctrl+i. Alas, it only lets me search for exact values.

What I would want is something akin to the CIDR notation for IP addresses, where -- for example -- I could give 0xC0000000/16 as the immediate "search mask" and it would find all of the values that fall into that range (0xC0000000 .. 0xC000FFFF). Another example would be 0xC0110000/16 which would find most of the status codes defined via enum MACRO_HIDP in the range 0xC0110000 .. 0xC011FFFF.

I realize that such a search could take a long time, but it would also be incredibly useful, especially if there was still the option to "Find all occurrences" where the "Instruction" column would be able to show me if I have already "treated" with m to turn into an enum.

---

Also, the IDC/IDAPython function find_imm() appears to suffer from the same limitation. And the only "optimization" I have found is to use the search for binary to narrow it down to a candidate list (basically mimicking that bit mask) and then using find_imm() and matching the EAs against each other. Guess I could have used Sark instead, but not sure it uses an optimization that compares.

---

As per a comment I tried using ? as a wildcard, but that doesn't work and yields:

Answer 1

This isn't a valid answer since it's scripting, but find_imm uses find_byte (or find_byter) to seek for each octet of your immediate value while using the flags (get_flags) to exclude results via FF_CODE (and FF_DATA). For FF_CODE (with the mask MS_CLS) you'd be excluding results that don't have the FF_IMMD bit set (mask is MS_CODE). Once your candidates are found, then a proper check can be done.

That's why it needs exact values, anyways, since it's being used as a key to find the whole value. You can probably get away performance-wise in Py with doing something similar (but only including the bytes you care about).