Other than scripting a solution to this, can anyone recommend an interactive method to search for immediate integer values by mask in IDA?
Let me explain. Consider NTSTATUS
values used in Windows internally. Roughly speaking if you see a 32 bit value that starts with (hexadecimal) C
, followed by three 0
and then some arbitrary value in the lower 16 bit, chances are you are looking at an NTSTATUS
error code. There are also success and warning codes, but a solution to this question would equally apply there.
Now, if I hit Alt+i, I am able to search an immediate value and repeat that search later on with Ctrl+i. Alas, it only lets me search for exact values.
What I would want is something akin to the CIDR notation for IP addresses, where -- for example -- I could give 0xC0000000/16
as the immediate "search mask" and it would find all of the values that fall into that range (0xC0000000
.. 0xC000FFFF
). Another example would be 0xC0110000/16
which would find most of the status codes defined via enum MACRO_HIDP
in the range 0xC0110000
.. 0xC011FFFF
.
I realize that such a search could take a long time, but it would also be incredibly useful, especially if there was still the option to "Find all occurrences" where the "Instruction" column would be able to show me if I have already "treated" with m to turn into an enum.
Also, the IDC/IDAPython function find_imm()
appears to suffer from the same limitation. And the only "optimization" I have found is to use the search for binary to narrow it down to a candidate list (basically mimicking that bit mask) and then using find_imm()
and matching the EAs against each other. Guess I could have used Sark instead, but not sure it uses an optimization that compares.
As per a comment I tried using ?
as a wildcard, but that doesn't work and yields:
0xC0000????
?