How can I search for a sequence of instructions in IDA Pro?
I did manage to search for a single instruction using text search string li.*r4.*-1 (for instruction li r4, -1), but I failed to match multiple instructions or newline character.
It seems to be possible to this by using the binary search, but this requires converting the assembly to the corresponding binary opcodes.
If you have a fixed set of instructions you are search for eg:
li r4,0
li r5,16
li r6,32
Assuming you already have one location found, you can look in the binary hex view, and find the byte pattern you want and use that in a binary search, just make sure you write each byte with a space between them like 01 02 03 04 so IDA treats them as a sequence of bytes, not as a word/int type search.
If you have a regex like soft match like
slwi r0,r3,2
add r4,r4,r0
but you don't know r4 will be the register used, but know it will be this pattern of slwi and add then I'd write a script (IDC or python) that searches using a text search for outer clause, and then checks for the next instruction to match the expected test, or move to next outer clause.
So the following idc file/code does the outer loop (I was using it to find address offsets that where not set to references), but it might be a good starting base to work from
#include <idc.idc>
static fixAllOffsets( strtext)
{
auto ea, offset;
auto last;
Message("Start\n");
ea = FindText(0x100000, SEARCH_DOWN | SEARCH_REGEX, 0, 0, strtext);
last = 0;
while( ea != BADADDR && ea != last)
{
Message("%a\n", ea);
// INSERT you next line checks here
last = ea;
ea = FindText(ea+6, SEARCH_DOWN | SEARCH_REGEX, 0, 0, strtext);
}
Message("End\n");
}
static main()
{
fixAllOffsets( "0x9[EF][0-9A-F][0-9A-F][0-9A-F][0-9A-F][0-9A-F][0-9A-F]" );
}
