Search memory for little-endian value

Open
#3,372 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp
Domain
reverse-engineering, search

Research direction

Start with the Find dialog's hex-string parsing and search entry point. Compare the requested little-endian byteswap behavior, including space-separated groups, and define completion by allowing a value such as 12345 to find its little-endian byte sequence for pointer and integer searches.

Written by the indexing model from the issue text.

Description

Component: Core Component: UI Effort: Low Impact: Low

What is the feature you'd like to have?
In the Find dialog, when searching for a hex string, I'd like some kind of option to byteswap the value.

For example, suppose there's data or code at address 0x12345, and I think there might be a pointer to it in a data segment somewhere which hasn't been analyzed (and thus doesn't show up in the xrefs list). To find this, as far as I know, I would need to open the Find dialog and type 452301 (maybe with some zeroes following it to avoid false positives). But byteswapping in my head is annoying, so I'd like to be able to type 12345 and have Binary Ninja byteswap it for me.

Are any alternative solutions acceptable?
In the case of pointers, some kind of "search for pointers to this address" command would be even easier; beyond that, auto-identifying pointers based on heuristics (#1189) or relocations (#3371) would make manual searches less necessary.

But pointers aren't the only use case; this would also be useful when searching for integer constants.

Additional Information:
In IDA, if I recall correctly, sequences of hex digits not separated by spaces are automatically byteswapped when analyzing little-endian images. For example, 1234 5678 would be equivalent to 34 12 78 56. Binary Ninja seems to not treat spaces as meaningful.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.