findasm/asmfind

Find assembled instruction.

arguments

arg1 Instruction to look for (make sure to use quoted "mov eax, ebx" to ensure you actually search for that instruction). You can use String Formatting here.

[arg2] Address of/inside a memory page to look in. When not specified CIP will be used.

[arg3] The size of the data to search in. Default is the size of the memory region.

result

The $result variable is set to the number of references found.

remarks

The contents of the reference view can be iterated in a script with the ref.addr expression function:

i = 0
loop:
  addr = ref.addr(i)
  log "reference {d:i} = {p:addr}"
  i++
  cmp i, ref.count()
  jne loop