Skip to main content

​
Search Overview

Ghidra provides powerful search capabilities to locate code patterns, data values, text strings, and program elements.
The SearchTextPlugin provides comprehensive search functionality for program text, while specialized plugins handle memory, instructions, and other search types.

​
Search Types

Search displayed text in listing:
  • Searches rendered fields
  • Comments, labels, mnemonics
  • Regular expression support
  • Database search or display match

​
Program Text Search

​
Basic Text Search

1

Open Search Dialog

Access text search:
  • Search > Program Text
  • Press Ctrl + Shift + E
  • Implemented by SearchTextPlugin
2

Enter Search String

Configure search:
  • Type search text
  • Choose search fields
  • Set options (case sensitive, regex)
3

Execute Search

Run the search:
  • Click Search All for all matches
  • Or Next/Previous for incremental
  • Results appear in table

​
Search Options

Select fields to search:
  • Instruction Mnemonics: Assembly instructions
  • Instruction Operands: Instruction arguments
  • Data Mnemonics: Data type names
  • Data Operands: Data values
  • Comments: All comment types
  • Labels: Symbol names
  • Functions: Function names

​
Search Scope

1

Set Search Range

Define where to search:
  • All Blocks: Entire program
  • Selection: Current selection only
  • Current Block: Active memory block
  • Custom Range: Specify addresses
2

Memory Block Filter

Choose blocks to search:
  • Filter by block name
  • Include/exclude specific regions
  • Focus on code vs data sections
Use selection-based search to narrow results when you know the approximate location of your target.

​
Search Results

1

View Results Table

Results displayed in table:
  • Uses ProgramDatabaseSearchTableModel
  • Columns: Location, Preview, Type
  • Sortable and filterable
2

Navigate Results

Use the results:
  • Double-click to jump to location
  • Select multiple for bulk operations
  • Export results to file
3

Highlight Matches

Visual emphasis:
  • Option to highlight in listing
  • Search marker icons
  • Uses SEARCH_MARKER_ICON
  • Configurable highlight colors
1

Open Memory Search

Access memory search:
  • Search > Memory
  • Direct byte-level searching
2

Enter Pattern

Define byte pattern:
  • Hexadecimal bytes (e.g., 48 8B 45 F8)
  • Wildcards: ? for nibble, .. for byte
  • Example: 48 8B ?? ?? matches MOV with any operands
3

Search Memory

Execute search:
  • Click Search All
  • Results show all matches
  • Navigate to findings
Memory search is case-sensitive for byte patterns. Use appropriate byte values for ASCII text searches.
1

Open Instruction Search

Access instruction search:
  • Implemented by InstructionSearchPlugin
  • Search > Instruction Patterns
  • Opens InstructionSearchDialog
2

Build Pattern

Create instruction pattern:
  • Add instruction criteria
  • Specify mnemonics
  • Define operand constraints
  • Set sequence requirements
3

Execute Search

Find matches:
  • SearchInstructionsTask runs search
  • Results in table
  • Preview shows context

​
Mnemonic Search Scripts

Script-based mnemonic searches:
SearchMnemonicsNoOpsNoConstScript.java:
  • Search instruction mnemonics only
  • No operand matching
  • Fast basic search

​
YARA Integration

YARA rule-based searching:
  • Use InstructionSearchApi_Yara.java
  • Define YARA rules
  • Apply to instruction patterns
  • Advanced malware analysis

​
Finding Scalar Values

1

Access Scalar Search

Open scalar search:
  • Search > Scalars
  • Find immediate values and constants
2

Enter Value

Specify search value:
  • Decimal or hexadecimal
  • Exact value match
  • Range searches supported
3

Review Results

Examine matches:
  • Instructions with immediate values
  • Data containing values
  • Potential addresses or constants

​
Image Base Offsets

Search for relocated addresses:
  • Use SearchForImageBaseOffsetsScript.java
  • Finds values that are image base + offset
  • Identifies potential addresses
  • Helps with position-independent code

​
Finding Labels

1

Go To Dialog

Quick symbol navigation:
  • Press G
  • Type label name
  • Supports wildcards
  • Jump to symbol
2

Symbol Table Search

Advanced symbol search:
  • Open Symbol Table
  • Use filter bar
  • Regular expressions supported
  • Sort and organize results

​
Search by Address

1

Address Navigation

Jump to specific address:
  • Press G
  • Enter hexadecimal address
  • Navigate to location
2

File Offset Search

Find memory address from file offset:
  • Use LocateMemoryAddressesForFileOffset.java
  • Converts file position to memory address
  • Handles multiple mappings

​
Specialized Searches

Search all functions:
  • Window > Functions
  • Filter by name, size, location
  • Sort by various criteria
  • Export function lists
1

Search Data Type Manager

Find types:
  • Open Data Type Manager
  • Use search field
  • Filter by name or category
2

Find Applied Types

Locate type usage:
  • Right-click type > Find References to
  • Shows all applications
  • Uses FindReferencesToDataTypeAction
Find equate usage:
  • Use ShowEquatesInSelectionScript.java
  • Displays all equates in range
  • Helps understand constants

​
Search Performance

​
Optimizing Searches

Choose appropriate mode:
  • Database: Fast, limited fields
  • Display: Slow, comprehensive
  • Use database when possible
For large programs, use database search with selections to significantly improve search speed.

​
Search Integration

​
Combining Searches

1

Multiple Criteria

Layer search results:
  • Perform first search
  • Create selection from results
  • Search within selection
  • Iteratively narrow results
2

Cross-Reference Search

Use XREFs in search workflow:
  • Search for pattern
  • Find references to results
  • Build call or data flow graph

​
Search and Replace

Bulk modifications:
  • ReplaceInComments.java script
  • Text replacement in comments
  • Batch symbol renaming
  • Careful with irreversible changes

​
Search Results Management

​
Working with Results

1

Export Results

Save search results:
  • Results table export
  • CSV or text format
  • Documentation purposes
2

Create Selection

Convert to selection:
  • Select results in table
  • Create program selection
  • Apply operations to matches
3

Apply Actions

Bulk operations:
  • Comment all matches
  • Apply data types
  • Create bookmarks
  • Set symbol properties
Search results are dynamic - program changes may invalidate results. Re-run searches after modifications.

​
Advanced Search Techniques

​
GUI Search Tools

Custom search interfaces:
  • SearchGuiSingle.java: Single pattern GUI
  • SearchGuiMulti.java: Multiple pattern search
  • Custom search dialogs for specific needs
Rapid searching:
  • Quick searcher in search text plugin
  • Located in quicksearcher package
  • Fast incremental search
  • Real-time results
Create custom search scripts using the InstructionSearchApi for project-specific search patterns that you use frequently.

Build docs developers (and LLMs) love

Get started for freeTalk to us