Log in

View Full Version : Advanced search in Softice?


haex
November 7th, 2002, 02:05
Hi all!

I'm wondering if there is any way to search the memory with regular expressions?
Like:
s 0 L ffffffff 'Start,*,'End'
were * could be any bytes. It would find : StartANYTHINGEnd

or
s 0 L ffffffff 'Start?End'
where ? is a single arbitrary byte.
Would find: StartXEnd

Maybe a plugin, patch or something?
It sure could be useful for serial-fishing!

I have looked in TFM, and searched the board and internet, but I couldn't find anything. Maybe my searching skills isn't enough.

/haex

Snatch
November 7th, 2002, 12:42
Wow that is a great idea actually. Dont think Softice supports it but with some imagination you could probably write a plugin to do it. Though regular expressions can be a pain often. There are a lot of prewritten classes for handling them. Then interfacing with memory and not crashing the system would be a tough one too . Havent heard anything to do this though. Generally just search for a peice of the string you are looking for and then see if things match out when you get there.

Snatch

haex
November 7th, 2002, 19:21
Ok!

Well it almost would be to easy to be able to search for the good serial if you only knew how it looked like.If it has teh pattern 1234-ABCD-1234 you could search for ????-????-???? where ? is any character. Cause just searching on '-' gives way to many results.

Writing a plugin myself is beyond my knowledge,so I'll encourage the pros to make one.

/haex (let me know if you do)