BinaryNinja::StringDetector Class Reference

A compiled string detector using the same detection logic as the core strings analysis. More...

Detailed Description

A compiled string detector using the same detection logic as the core strings analysis.

The detector is immutable once constructed, so a single instance may be shared across threads.

Public Member Functions
	StringDetector (const StringDetectionParameters &params)
	~StringDetector ()
	StringDetector (const StringDetector &)=delete
StringDetector &	operator= (const StringDetector &)=delete
	StringDetector (StringDetector &&other) noexcept
StringDetector &	operator= (StringDetector &&other) noexcept
std::vector< BNStringReference >	DetectStrings (const void *data, size_t dataLen, size_t blockLen, uint64_t baseAddress, BNStringReference *lastFoundString=nullptr) const
	Detects strings in a raw data buffer.

Constructor & Destructor Documentation

StringDetector() [1/3]

StringDetector::StringDetector ( const StringDetectionParameters & params )

explicit

~StringDetector()

StringDetector::~StringDetector

(

)

StringDetector() [2/3]

BinaryNinja::StringDetector::StringDetector ( const StringDetector & )

delete

StringDetector() [3/3]

StringDetector::StringDetector ( StringDetector && other )

noexcept

Member Function Documentation

operator=() [1/2]

StringDetector & BinaryNinja::StringDetector::operator= ( const StringDetector & )

delete

operator=() [2/2]

StringDetector & StringDetector::operator= ( StringDetector && other )

noexcept

DetectStrings()

vector< BNStringReference > StringDetector::DetectStrings	(	const void *	data,
		size_t	dataLen,
		size_t	blockLen,
		uint64_t	baseAddress,
		BNStringReference *	lastFoundString = nullptr ) const

Detects strings in a raw data buffer.

Strings must start within the first blockLen bytes of data but may extend up to dataLen bytes, allowing large buffers to be scanned in chunks with a BN_MAX_STRING_LENGTH overlap tail. lastFoundString (optional, in/out, zero-initialized before the first call) carries overlap state across consecutive chunk calls so strings spanning a chunk boundary are not reported twice.

Parameters

data	Buffer to scan
dataLen	Total number of valid bytes in data
blockLen	Number of bytes within which strings may start
baseAddress	Address reported for offset 0 of data
lastFoundString	Optional cross-chunk overlap state

Returns

The strings found, with addresses relative to baseAddress