Skip to content

Latest commit

 

History

History
20 lines (15 loc) · 751 Bytes

search_in_assembly.md

File metadata and controls

20 lines (15 loc) · 751 Bytes

Assembler Search

If you want to search for a certain assembler opcodes, you can either use /c or /a commands.

The command /c jmp [esp] searches for the specified asm mnemonic:

[0x00404888]> /c jmp qword [rdx]
f hit_0 @ 0x0040e50d   # 2: jmp qword [rdx]
f hit_1 @ 0x00418dbb   # 2: jmp qword [rdx]
f hit_2 @ 0x00418fcb   # 3: jmp qword [rdx]
f hit_3 @ 0x004196ab   # 6: jmp qword [rdx]
f hit_4 @ 0x00419bf3   # 3: jmp qword [rdx]
f hit_5 @ 0x00419c1b   # 3: jmp qword [rdx]
f hit_6 @ 0x00419c43   # 3: jmp qword [rdx]

The command /a jmp eax assembles a string to machine code, and then searches for the resulting bytes:

[0x00404888]> /a jmp eax
hits: 1
0x004048e7 hit3_0 ffe00f1f8000000000b8