String Search

String Searches allow you to find text and byte arrays in the target process. Strings in String Searches do not need to be NULL-terminated.

The following chart explains each option in the String Search dialog.

Option

Description
String to Find This is where you enter the actual string you want to find. If you have selected type Hex String, you must enter the string in hexadecimal form, with each hexadecimal number separated by a space. For example, 34 AA EF would be a valid hex string.
Type
Option

Description
ASCII The String to Find will be found as typed, after any escaped sequences are resolved.
Unicode The String to Find’s escape sequences will be resolved, then the string will be converted to Unicode, and that string will be found.
Hex String Indicates that String to Find is in hex format.
Wildcard Indicates that String to Find has wildcard characters ? and/or *. See Wildcards and Regular Expressions.
Regular Expression Indicates that String to Find is a regular-expression string. See Wildcards and Regular Expressions.
Hex Bytes Displays the actual hex bytes that will be found.
Match Case Indicates that the case should be matched. Does not apply to hex strings.
Match Whole Word Only Indicates that only whole words should be matched.
Aligned The scan starts on every 4th address rather than every address.
From Specifies the starting address from which to search.
To Specifies the ending address at which to stop searching (exclusive).

 

Additional Notes

The search itself always starts at the lower address and goes to the higher address, regardless of the order in which they are entered.

All search data entered into the dialog is saved if you click OK and perform a search, which allows you to repeat searches without having to fill out every box again.

Only if you perform a search will the previous results be lost.
Copyright © 2006 Shawn (L. Spiro) Wilcoxen