Class Search

Search for the given pattern within the process memory.

Parameters:

• process (Process) - Process to search.
• pattern (Pattern) - Pattern to search for. It must be an instance of a subclass of Pattern.

  The following Pattern subclasses are provided by WinAppDbg:

  • BytePattern
  • TextPattern
  • RegExpPattern
  • HexPattern

  You can also write your own subclass of Pattern for customized searches.

• minAddr (int) - (Optional) Start the search at this memory address.
• maxAddr (int) - (Optional) Stop the search at this memory address.
• bufferPages (int) - (Optional) Number of memory pages to buffer when performing the search. Valid values are:
  • 0 or None: Automatically determine the required buffer size. May not give complete results for regular expressions that match variable sized strings.
  • > 0: Set the buffer size, in memory pages.
  • < 0: Disable buffering entirely. This may give you a little speed gain at the cost of an increased memory usage. If the target process has very large contiguous memory regions it may actually be slower or even fail. It's also the only way to guarantee complete results for regular expressions that match variable sized strings.
• overlapping (bool) - True to allow overlapping results, False otherwise.

  Overlapping results yield the maximum possible number of results.

  For example, if searching for "AAAA" within "AAAAAAAA" at address 0x10000, when overlapping is turned off the following matches are yielded:

     (0x10000, 4, "AAAA")
     (0x10004, 4, "AAAA")
  

  If overlapping is turned on, the following matches are yielded:

     (0x10000, 4, "AAAA")
     (0x10001, 4, "AAAA")
     (0x10002, 4, "AAAA")
     (0x10003, 4, "AAAA")
     (0x10004, 4, "AAAA")
  

  As you can see, the middle results are overlapping the last two.

Returns: iterator of tuple( int, int, str )

An iterator of tuples. Each tuple contains the following:

• The memory address where the pattern was found.
• The size of the data that matches the pattern.
• The data that matches the pattern.

Raises:

• WindowsError - An error occurred when querying or reading the process memory.

Extract ASCII strings from the process memory.

Parameters:

• process (Process) - Process to search.
• minSize (int) - (Optional) Minimum size of the strings to search for.
• maxSize (int) - (Optional) Maximum size of the strings to search for.

Returns: iterator of tuple(int, int, str)

Iterator of strings extracted from the process memory. Each tuple contains the following:

• The memory address where the string was found.
• The size of the string.
• The string.