pub struct Scanner<P> { /* private fields */ }Expand description
Pattern scanner.
For more information see the module-level documentation.
Implementations§
Source§impl<'a, P: Pe<'a>> Scanner<P>
impl<'a, P: Pe<'a>> Scanner<P>
Sourcepub fn finds(&self, pat: &[Atom], range: Range<Rva>, save: &mut [Rva]) -> bool
pub fn finds(&self, pat: &[Atom], range: Range<Rva>, save: &mut [Rva]) -> bool
Finds the unique match for the pattern in the given range.
The pattern may contain instructions to capture interesting addresses, these are stored in the save array. Out of bounds stores are simply ignored, ensure the save array is large enough for the given pattern.
In case of mismatch, ie. returns false, the save array is still overwritten with temporary data and should be considered trashed. Keep a copy, invoke with a fresh save array or reexecute the pattern at the saved cursor to get around this.
Returns false if no match is found or multiple matches are found to prevent subtle bugs where a pattern goes stale by not being unique any more.
Use matches(pat, range).next(save) if just the first match is desired.
Sourcepub fn finds_code(&self, pat: &[Atom], save: &mut [Rva]) -> bool
pub fn finds_code(&self, pat: &[Atom], save: &mut [Rva]) -> bool
Finds the unique code match for the pattern.
Restricts the range to the code section. See finds for more information.
Sourcepub fn matches<'pat>(
&self,
pat: &'pat [Atom],
range: Range<Rva>,
) -> Matches<'pat, P>
pub fn matches<'pat>( &self, pat: &'pat [Atom], range: Range<Rva>, ) -> Matches<'pat, P>
Returns an iterator over the matches of a pattern within the given range.
Sourcepub fn matches_code<'pat>(&self, pat: &'pat [Atom]) -> Matches<'pat, P>
pub fn matches_code<'pat>(&self, pat: &'pat [Atom]) -> Matches<'pat, P>
Returns an iterator over the code matches of a pattern.
Restricts the range to the code section. See matches for more information.
Sourcepub fn exec(&self, cursor: Rva, pat: &[Atom], save: &mut [Rva]) -> bool
pub fn exec(&self, cursor: Rva, pat: &[Atom], save: &mut [Rva]) -> bool
Pattern interpreter, returns if the pattern matches the binary image at the given rva.
The pattern may contain instructions to capture interesting addresses, these are stored in the save array. Out of bounds stores are simply ignored, ensure the save array is large enough for the given pattern.
In case of mismatch, ie. returns false, the save array is still overwritten with temporary data and should be considered trashed. Keep a copy, invoke with a fresh save array or reexecute the pattern at the saved cursor to get around this.