search

FelixBer / FindFunc

FindFunc is an IDA Pro plugin to find code functions that contain a certain assembly or byte pattern, reference a certain name or string, or conform to various other constraints.
308 stars 28 forks source link

FindFunc does not detect some code. #7

Open karpiyon opened 1 day ago

karpiyon commented 1 day ago

Hi, What am I doing wrong... Why can't it detect: imul rax, 4

which i defiantly have in my code: image and this e.g. is my rule:

image

What am I doing wrong? BTW 4 or 0x4 in this sense show some result

Thanks,

karpiyon commented 1 day ago

I tried using Byte Pattern instead and the result was that IDA hanged when I pressed "Cancel" since the process took a very long time.

My search pattern was this:

image

karpiyon commented 1 day ago

I notices that when i press Find Func for the above search I see these errors: image

I could not copy them because IDA hangs

FelixBer commented 1 day ago

It looks like you are using IDA 9, which is supported in master, but not in the latest git release. Could you download master and try with that? I'll make a proper 9.0 release in the next days. If that doesnt work, please share the binary file and the exported findfunc rule(s) (right click).