How to search a sequence of instructions in Ghidra?

Question

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern Search feature in Ghidra, inserting the first 4 movss of the sequence (selecting the instructions show in the VS Debugger, after enabling Show Code Bytes; i.e. in order f3 0f 10/f3 0f 11/f3 0f 10/f3 0f 11):

it doesn't return any hit.

So, is this a mismatch from VS Code disassembly and the Listing elaborated by Ghidra, or am I searching in a wrong way?

Answer 1

I'll post an answer here with the conclusions we came to in the chat, in case anyone finds it useful in the future.

There seems to be a limitation of the Instruction Pattern Search tool in that the patterns must contain a fixed amount of bytes. In the screenshot posted in the original post, the second and fourth pattern are looking for movss [addr], xmm instructions (operands encoded in 5 bytes, first operand is 00...101), while the instructions that need to be found are movss [reg+offs], xmm (operands encoded in 3 bytes, first operand is 01...100). To correct the patterns, one needs to find an appropriate instruction in code or insert the bytes manually into the tool and then unmask the operands (as far as Ghidra allows).

Alternatively, one can also use the memory search ('S' hotkey or Search -> Memory) and insert a pattern matching the instruction bytes. For this specific question, the pattern would be:

f3 0f 10 ?? ?? ?? ?? ?? f3 0f 11 ?? ?? ?? f3 0f 10 ?? ?? ?? ?? ?? f3 0f 11 ?? ?? ??

Ghidra also allows searching in a more dynamic manner via regular expressions. This would allow one to craft a regex pattern that matches against four consecutive movss instructions, regardless of their operands, but may make it more difficult to guard against false positives.