You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Searches for matches of the specified ``pattern`` within this BinaryView with an optionally provided address range specified by ``start`` and ``end``.
10093
-
This is the API used by the advanced binary search UI option. The search pattern can be interpreted in various ways:
10093
+
This is the API used by the advanced binary search UI option. The pattern is interpreted as one of:
10094
10094
10095
-
- specified as a string of hexadecimal digits where whitespace is ignored, and the '?' character acts as a wildcard
10096
-
- a regular expression suitable for working with bytes
10097
-
- or if the ``raw`` option is enabled, the pattern is interpreted as a raw string, and any special characters are escaped and interpreted literally
10095
+
- ``"FlexHex"``: a sequence of byte tokens drawn from ``[0-9a-fA-F?]``, where ``??`` (or a whitespace-separated lone ``?``) is a full-byte wildcard and ``?X`` / ``X?`` matches a single nibble. Whitespace between byte tokens is optional, but a lone ``?`` must be whitespace-separated (so ``c3 ? 55`` is valid; ``c3?55`` is not).
10096
+
- ``"Regex"``: a byte-level regular expression.
10097
+
- ``"Raw String"``: a literal string match. Used when ``raw=True``, or as a fallback when the pattern is neither valid FlexHex nor a valid regex.
10098
+
10099
+
Use :py:meth:`detect_search_mode` to check which mode would be selected for a given pattern.
Detects the search mode that would be used by :py:meth:`search` for the given pattern.
10178
10182
10183
+
The mode is one of:
10184
+
10185
+
- ``"FlexHex"``: a sequence of byte tokens drawn from ``[0-9a-fA-F?]``, where ``??`` (or a whitespace-separated lone ``?``) is a full-byte wildcard and ``?X`` / ``X?`` matches a single nibble. Whitespace between byte tokens is optional, but a lone ``?`` must be whitespace-separated (so ``c3 ? 55`` is valid; ``c3?55`` is not).
10186
+
- ``"Regex"``: a byte-level regular expression.
10187
+
- ``"Raw String"``: a literal string match. Returned when ``raw=True``, or as a fallback when the pattern is neither valid FlexHex nor a valid regex.
10188
+
10179
10189
:param str pattern: The search pattern to analyze.
10180
10190
:param bool raw: Whether to interpret the pattern as a raw string (default: False).
10181
10191
:return: The detected search mode: ``"FlexHex"``, ``"Regex"``, or ``"Raw String"``.
0 commit comments