diff --git a/_quarto.yml b/_quarto.yml index f412dbe6..5eb5cce8 100644 --- a/_quarto.yml +++ b/_quarto.yml @@ -66,14 +66,14 @@ book: - part: "Searching" chapters: - - src/search_bytes/intro.md - - src/search_bytes/basic_searches.md - - src/search_bytes/configurating_the_search.md - - src/search_bytes/pattern_search.md - - src/search_bytes/automation.md - - src/search_bytes/backward_search.md - - src/search_bytes/search_in_assembly.md - - src/search_bytes/searching_aes_keys.md + - src/search/intro.md + - src/search/basic_searches.md + - src/search/configurating_the_search.md + - src/search/pattern_search.md + - src/search/automation.md + - src/search/backward_search.md + - src/search/search_in_assembly.md + - src/search/searching_aes_keys.md - part: "Disassembling" chapters: diff --git a/src/analysis/syscalls.md b/src/analysis/syscalls.md index 9c8ad12d..dd597a34 100644 --- a/src/analysis/syscalls.md +++ b/src/analysis/syscalls.md @@ -35,7 +35,7 @@ the addresses where particular syscalls were found and list them. 0x00018a0e sd_ble_gap_sec_info_reply ... ``` -To reduce searching time it is possible to [restrict the searching](../search_bytes/configurating_the_search.md) +To reduce searching time it is possible to [restrict the searching](../search/configurating_the_search.md) range for only executable segments or sections with `/as @e:search.in=io.maps.x` Using the [ESIL emulation](emulation.md) Rizin can print syscall arguments diff --git a/src/search_bytes/automation.md b/src/search/automation.md similarity index 100% rename from src/search_bytes/automation.md rename to src/search/automation.md diff --git a/src/search_bytes/basic_searches.md b/src/search/basic_searches.md similarity index 100% rename from src/search_bytes/basic_searches.md rename to src/search/basic_searches.md diff --git a/src/search_bytes/configurating_the_search.md b/src/search/configurating_the_search.md similarity index 100% rename from src/search_bytes/configurating_the_search.md rename to src/search/configurating_the_search.md diff --git a/src/search/intro.md b/src/search/intro.md new file mode 100644 index 00000000..5e792961 --- /dev/null +++ b/src/search/intro.md @@ -0,0 +1,54 @@ +# Searching + +The Rizin search engine allows you to search for strings, bytes, in files, graphs and fro cryptographic material. +For each search hit it creates a flag for further referencing. +The search behavior can be modified as well. + +Search commands are under the `/` group. +``` +[0x00000000]> /? +Usage: / # Search for bytes, regexps, patterns, .. +| /+[jqt] # Construct the string with chunks. +| /a[?] # Assemble the instruction and search its bytes. +| /c # Cryptographic material search. +| /d[jqt] <101112> # Search for a deltified sequence of bytes. +| /F[jqt] [ []] # Search contents of file with offset and size. +| /o[jqt] [] # Show offset of n instructions backward. +| /O[jqt] [] # Same as /o, but with a different fallback if analysis cannot be used. +| /p[jqt] # Search for pattern of given size. +| /P[jqt] # Search similar blocks. +| /s[jqt] # Search sections by grouping blocks with similar entropy. +| /g[jqtg] # Search for all graph paths A to B (/gg follow jumps, see search.count and + analysis.depth). +| /h[jqt] # Search for blocks that have the same hash (see also command `ph`). +| /m[jb] # Magic constants search. +| /E[j] # offset matching given esil expressions $$ = here. +| /r[acrwx] # Reference search. +| /R[jqt/kg] # Search, List, Query for ROP Gadgets +| /v<1248> # Value search. +| /V<1248> # Value search. +| /x[jqtr] # Raw hexadecimal search. +| /z[jqt] # String search. + +``` + +Search settings are under `e search.` +``` +[0x00000000]> el search. + search.align: Address alignment (searches only if 'address % search.align == 0'). +search.case_sensitive: Set grep(~) as case smart/sensitive/insensitive + search.from: Search start address (inclusive) + search.in: Specify search boundaries + search.max_threads: Maximum core number. '0' for all cores. '?' to show available. + search.maxhits: Maximum number of hits ('0' means no limit) + search.overlap: Look for overlapped search hits + search.prefix: Prefix name in search hits label +search.show_progress: Show the search process. +search.str.check_ascii_freq: If true, perform check on ASCII frequencies when looking for false positives during string search +search.str.max_length: Maximum string length (in number of characters). +search.str.max_region_size: Maximum allowable size for the string search interval between two memory regions. +search.str.min_length: Smallest string length (in number of characters). +search.str.raw_alignment: Memory sector alignment used for the raw string search (RzBin only. Use search.align for /z). + search.to: Search end address (exclusive) + ... +``` diff --git a/src/search_bytes/pattern_search.md b/src/search/pattern_search.md similarity index 100% rename from src/search_bytes/pattern_search.md rename to src/search/pattern_search.md diff --git a/src/search_bytes/search_in_assembly.md b/src/search/search_in_assembly.md similarity index 100% rename from src/search_bytes/search_in_assembly.md rename to src/search/search_in_assembly.md diff --git a/src/search_bytes/searching_aes_keys.md b/src/search/searching_aes_keys.md similarity index 100% rename from src/search_bytes/searching_aes_keys.md rename to src/search/searching_aes_keys.md diff --git a/src/search/strings.md b/src/search/strings.md new file mode 100644 index 00000000..e69de29b diff --git a/src/search_bytes/backward_search.md b/src/search_bytes/backward_search.md deleted file mode 100644 index f15cdce4..00000000 --- a/src/search_bytes/backward_search.md +++ /dev/null @@ -1,46 +0,0 @@ -## Searching Backwards - -Sometimes you want to find a keyword backwards. This is, before the current offset, to do this you can seek back -and search forward by adding some search.from/to restrictions, or use the `/b` command. - -``` -[0x100001200]> / nop -0x100004b15 hit0_0 .STUWabcdefghiklmnopqrstuvwxbin/ls. -0x100004f50 hit0_1 .STUWabcdefghiklmnopqrstuwx1] [file . -[0x100001200]> /b nop -[0x100001200]> s 0x100004f50p -[0x100004f50]> /b nop -0x100004b15 hit2_0 .STUWabcdefghiklmnopqrstuvwxbin/ls. -[0x100004f50]> -``` - -Note that `/b` is doing the same as `/`, but backward, so what if we want to use `/x` backward? We can use `/bx`, -and the same goes for other search subcommands: - -``` -[0x100001200]> /x 90 -0x100001a23 hit1_0 90 -0x10000248f hit1_1 90 -0x1000027b2 hit1_2 90 -0x100002b2e hit1_3 90 -0x1000032b8 hit1_4 90 -0x100003454 hit1_5 90 -0x100003468 hit1_6 90 -0x10000355b hit1_7 90 -0x100003647 hit1_8 90 -0x1000037ac hit1_9 90 -0x10000389c hit1_10 90 -0x100003c5c hit1_11 90 - -[0x100001200]> /bx 90 -[0x100001200]> s 0x10000355b -[0x10000355b]> /bx 90 -0x100003468 hit3_0 90 -0x100003454 hit3_1 90 -0x1000032b8 hit3_2 90 -0x100002b2e hit3_3 90 -0x1000027b2 hit3_4 90 -0x10000248f hit3_5 90 -0x100001a23 hit3_6 90 -[0x10000355b]> -``` diff --git a/src/search_bytes/intro.md b/src/search_bytes/intro.md deleted file mode 100644 index 2217ef24..00000000 --- a/src/search_bytes/intro.md +++ /dev/null @@ -1,51 +0,0 @@ -# Searching for Bytes - -The Rizin search engine is based on work done by esteve, plus multiple features implemented on top of it. It supports -multiple keyword searches, binary masks, and hexadecimal values. It automatically creates flags for search hit -locations ease future referencing. - -Search is initiated by `/` command. -``` -[0x00000000]> /? -Usage: /[!bf] [arg] Search stuff (see 'e??search' for options) -|Use io.va for searching in non virtual addressing spaces -| / foo\x00 search for string 'foo\0' -| /j foo\x00 search for string 'foo\0' (json output) -| /! ff search for first occurrence not matching, command modifier -| /!x 00 inverse hexa search (find first byte != 0x00) -| /+ /bin/sh construct the string with chunks -| // repeat last search -| /a[?][1aoditfmsltf] jmp eax assemble opcode and search its bytes -| /b search backwards, command modifier, followed by other command -| /c[?][adr] search for crypto materials -| /d 101112 search for a deltified sequence of bytes -| /e /E.F/i match regular expression -| /E esil-expr offset matching given esil expressions $$ = here -| /f search forwards, (command modifier) -| /F file [off] [sz] search contents of file with offset and size -| /g[g] [from] find all graph paths A to B (/gg follow jumps, see search.count and analysis.depth) -| /h[t] [hash] [len] find block matching this hash. See ph -| /i foo search for string 'foo' ignoring case -| /m[?][ebm] magicfile search for magic, filesystems or binary headers -| /o [n] show offset of n instructions backward -| /O [n] same as /o, but with a different fallback if analysis cannot be used -| /p patternsize search for pattern of given size -| /P patternsize search similar blocks -| /s[*] [threshold] find sections by grouping blocks with similar entropy -| /r[rwx][?] sym.printf analyze opcode reference an offset -| /R [grepopcode] search for matching ROP gadgets, semicolon-separated -| /v[1248] value look for an `cfg.bigendian` 32bit value -| /V[1248] min max look for an `cfg.bigendian` 32bit value in range -| /w foo search for wide string 'f\0o\0o\0' -| /wi foo search for wide string ignoring case 'f\0o\0o\0' -| /x ff..33 search for hex string ignoring some nibbles -| /x ff0033 search for hex string -| /x ff43:ffd0 search for hexpair with mask -| /z min max search for strings of given size -| /* [comment string] add multiline comment, end it with '*/' -``` - -Because everything is treated as a file in Rizin, it does not matter whether you search in a socket, a remote device, -in process memory, or a file. - -Note that `/*` starts multiline comment. It's not for searching. Type `*/` to end comment.