Search Capabilities

Search and find code, data, and patterns in Ghidra

Search Overview

Ghidra provides powerful search capabilities to locate code patterns, data values, text strings, and program elements.

The SearchTextPlugin provides comprehensive search functionality for program text, while specialized plugins handle memory, instructions, and other search types.

Search Types

Program Text

Search displayed text in listing:

• Searches rendered fields
• Comments, labels, mnemonics
• Regular expression support
• Database search or display match

Memory

Search raw bytes:

• Hexadecimal patterns
• Byte sequences
• Masked searches
• Binary patterns

Instructions

Search for instruction patterns:

• Mnemonic sequences
• Operand patterns
• Combined criteria
• Flexible matching

Scalars

Find numeric values:

• Immediate values
• Constants in code
• Address values
• Data values

Program Text Search

Basic Text Search

1. Open Search Dialog

   Access text search:

   • Search > Program Text
   • Press Ctrl + Shift + E
   • Implemented by SearchTextPlugin
2. Enter Search String

   Configure search:

   • Type search text
   • Choose search fields
   • Set options (case sensitive, regex)
3. Execute Search

   Run the search:

   • Click Search All for all matches
   • Or Next/Previous for incremental
   • Results appear in table

Search Options

Search Fields

Select fields to search:

• Instruction Mnemonics: Assembly instructions
• Instruction Operands: Instruction arguments
• Data Mnemonics: Data type names
• Data Operands: Data values
• Comments: All comment types
• Labels: Symbol names
• Functions: Function names

Search Modes

Two search strategies:

Database Search:

• Fast, searches program database
• Limited to database content
• Implemented by ProgramDatabaseSearcher

Listing Display Match:

• Slower, renders each address
• Searches as displayed in listing
• Matches exact visual output
• May take time on large programs

Regular Expressions

Pattern matching:

• Enable regex option
• Full regex syntax support
• Example: mov.*eax finds MOV instructions with EAX
• Example: str_\w+ finds labels starting with “str_”

Case Sensitivity

Control case matching:

• Case-sensitive: exact match
• Case-insensitive: ignores case
• Depends on search needs

Search Scope

1. Set Search Range

   Define where to search:

   • All Blocks: Entire program
   • Selection: Current selection only
   • Current Block: Active memory block
   • Custom Range: Specify addresses
2. Memory Block Filter

   Choose blocks to search:

   • Filter by block name
   • Include/exclude specific regions
   • Focus on code vs data sections

Use selection-based search to narrow results when you know the approximate location of your target.

Search Results

1. View Results Table

   Results displayed in table:

   • Uses ProgramDatabaseSearchTableModel
   • Columns: Location, Preview, Type
   • Sortable and filterable
2. Navigate Results

   Use the results:

   • Double-click to jump to location
   • Select multiple for bulk operations
   • Export results to file
3. Highlight Matches

   Visual emphasis:

   • Option to highlight in listing
   • Search marker icons
   • Uses SEARCH_MARKER_ICON
   • Configurable highlight colors

Memory Search

Byte Pattern Search

1. Open Memory Search

   Access memory search:

   • Search > Memory
   • Direct byte-level searching
2. Enter Pattern

   Define byte pattern:

   • Hexadecimal bytes (e.g., 48 8B 45 F8)
   • Wildcards: ? for nibble, .. for byte
   • Example: 48 8B ?? ?? matches MOV with any operands
3. Search Memory

   Execute search:

   • Click Search All
   • Results show all matches
   • Navigate to findings

Advanced Memory Search

String Search

Find string values:

• Enter text string
• Specify encoding (ASCII, Unicode)
• Automatically converted to bytes
• Null terminator optional

Value Search

Search for numeric values:

• Decimal or hexadecimal
• Specify size (1, 2, 4, 8 bytes)
• Endianness settings
• Example: Find all 0xDEADBEEF values

Regex Memory Search

Pattern search in strings:

• Use SearchMemoryForStringsRegExScript.java
• Regular expressions on memory strings
• Find complex string patterns

Memory search is case-sensitive for byte patterns. Use appropriate byte values for ASCII text searches.

Instruction Search

Instruction Pattern Search

1. Open Instruction Search

   Access instruction search:

   • Implemented by InstructionSearchPlugin
   • Search > Instruction Patterns
   • Opens InstructionSearchDialog
2. Build Pattern

   Create instruction pattern:

   • Add instruction criteria
   • Specify mnemonics
   • Define operand constraints
   • Set sequence requirements
3. Execute Search

   Find matches:

   • SearchInstructionsTask runs search
   • Results in table
   • Preview shows context

Mnemonic Search Scripts

Script-based mnemonic searches:

Mnemonics Only

SearchMnemonicsNoOpsNoConstScript.java:

• Search instruction mnemonics only
• No operand matching
• Fast basic search

Mnemonics with Operands

SearchMnemonicsOpsNoConstScript.java:

• Match mnemonics and operands
• No constant value matching
• Structure-based search

Mnemonics with Constants

SearchMnemonicsOpsConstScript.java:

• Match mnemonics, operands, and constants
• Precise pattern matching
• Most specific search

YARA Integration

YARA rule-based searching:

• Use InstructionSearchApi_Yara.java
• Define YARA rules
• Apply to instruction patterns
• Advanced malware analysis

Scalar Search

Finding Scalar Values

1. Access Scalar Search

   Open scalar search:

   • Search > Scalars
   • Find immediate values and constants
2. Enter Value

   Specify search value:

   • Decimal or hexadecimal
   • Exact value match
   • Range searches supported
3. Review Results

   Examine matches:

   • Instructions with immediate values
   • Data containing values
   • Potential addresses or constants

Image Base Offsets

Search for relocated addresses:

• Use SearchForImageBaseOffsetsScript.java
• Finds values that are image base + offset
• Identifies potential addresses
• Helps with position-independent code

Label and Symbol Search

Finding Labels

1. Go To Dialog

   Quick symbol navigation:

   • Press G
   • Type label name
   • Supports wildcards
   • Jump to symbol
2. Symbol Table Search

   Advanced symbol search:

   • Open Symbol Table
   • Use filter bar
   • Regular expressions supported
   • Sort and organize results

Search by Address

1. Address Navigation

   Jump to specific address:

   • Press G
   • Enter hexadecimal address
   • Navigate to location
2. File Offset Search

   Find memory address from file offset:

   • Use LocateMemoryAddressesForFileOffset.java
   • Converts file position to memory address
   • Handles multiple mappings

Specialized Searches

Function Search

Function Window

Search all functions:

• Window > Functions
• Filter by name, size, location
• Sort by various criteria
• Export function lists

Function Selection

Select functions by criteria:

• Use SelectFunctionsScript.java
• Filter by properties
• Bulk operations on results

Data Type Search

1. Search Data Type Manager

   Find types:

   • Open Data Type Manager
   • Use search field
   • Filter by name or category
2. Find Applied Types

   Locate type usage:

   • Right-click type > Find References to
   • Shows all applications
   • Uses FindReferencesToDataTypeAction

Equate Search

Find equate usage:

• Use ShowEquatesInSelectionScript.java
• Displays all equates in range
• Helps understand constants

Search Performance

Optimizing Searches

Database vs Display

Choose appropriate mode:

• Database: Fast, limited fields
• Display: Slow, comprehensive
• Use database when possible

Narrow Scope

Reduce search range:

• Search selections instead of all
• Focus on specific memory blocks
• Exclude irrelevant regions

Progressive Search

Iterative refinement:

• Start with broad search
• Refine with additional criteria
• Use results to narrow scope

For large programs, use database search with selections to significantly improve search speed.

Search Integration

Combining Searches

1. Multiple Criteria

   Layer search results:

   • Perform first search
   • Create selection from results
   • Search within selection
   • Iteratively narrow results
2. Cross-Reference Search

   Use XREFs in search workflow:

   • Search for pattern
   • Find references to results
   • Build call or data flow graph

Search and Replace

Bulk modifications:

• ReplaceInComments.java script
• Text replacement in comments
• Batch symbol renaming
• Careful with irreversible changes

Search Results Management

Working with Results

1. Export Results

   Save search results:

   • Results table export
   • CSV or text format
   • Documentation purposes
2. Create Selection

   Convert to selection:

   • Select results in table
   • Create program selection
   • Apply operations to matches
3. Apply Actions

   Bulk operations:

   • Comment all matches
   • Apply data types
   • Create bookmarks
   • Set symbol properties

Search results are dynamic - program changes may invalidate results. Re-run searches after modifications.

Advanced Search Techniques

GUI Search Tools

Custom search interfaces:

• SearchGuiSingle.java: Single pattern GUI
• SearchGuiMulti.java: Multiple pattern search
• Custom search dialogs for specific needs

Quick Search

Rapid searching:

• Quick searcher in search text plugin
• Located in quicksearcher package
• Fast incremental search
• Real-time results

Create custom search scripts using the InstructionSearchApi for project-specific search patterns that you use frequently.