Feature Request: StringSearchStrategy - Search by String

[Dentrax]

Well, When I want to do a string search, I'm looking for one-by-one in the classes with using CTRL+F. However, there is no search-by-string in the search section. Here;

I did a little digging, but it's difficult. :) So, I think we need create a function called "StringSearchStrategy : AbstractSearchStrategy" in SearchStrategies.cs.

sealed class StringSearchStrategy : AbstractSearchStrategy
	{
		public StringSearchStrategy(params string[] terms)
			: base(terms)
		{
		}

		protected override bool IsMatch(FieldDefinition field, Language language)
		{
			var str = System.Text.Encoding.Default.GetString(field.InitialValue);
			return searchTerm.Any(s => s.Contains(str)) && MatchName(field, language);
		}

		protected override bool IsMatch(PropertyDefinition property, Language language)
		{
			return /*??? && */ MatchName(property, language);
		}

		protected override bool IsMatch(EventDefinition ev, Language language)
		{
			return /*??? && */ MatchName(ev, language);
		}

		protected override bool IsMatch(MethodDefinition m, Language language)
		{
			return /*??? && */ MatchName(m, language);
		}
	}

Also I've just added this to GetSearchStrategy()

case SearchMode.String:
     return new StringSearchStrategy(terms);

added this to Constructor()

searchModeComboBox.Items.Add(new { Image = Images.Test, Name = "String" });

I guess it's not that easy, but it's not working for field's InitialValue. Is the path I followed right? :)

[siegfriedpammer]

Sorry for taking so long to get back to you!

Your approach is definitely in the right direction. To answer your questions, I would need to properly understand what the feature your are trying to implement is supposed to do exactly. Are you interested in constants used in .data sections in IL?

[Dentrax]

The only thing I want to do is search for "Strings." Should be scan all string expressions that have been made hardcoded. For example:

Example string in Attribute = [TestAttribute("Test Me 123")]
Example string in Const = public const string Test = "Test Me 345";
Example string in Format = string.Format("Test Me {0}", the345Data);

When I search value "Test Me" as String, search engine should list these three values. From all loaded assembly files. :) I think that's cool feature. I didn't see this feature. Only if we do CTRL+F in the showing source file.

[siegfriedpammer]

Thanks for the clarification. The last thing is already implemented (LiteralSearchStrategy). However searching in .data sections (field init values) or attribute blobs is not implemented, but I think it should be added to the existing LiteralSearchStrategy.

You can start by adding:

	protected override bool IsMatch(FieldDefinition field, Language language)
	{
		return IsLiteralMatch(field.Constant) /* add || IsLiteralMatch(ParseBytes(field.InitialValue)) */;
	}

            // TODO: implement object ParseBytes(byte[])

For information on how to parse these bytes, take a look at the ECMA 335 specification, look for .data sections.

For the attributes you can add:

             bool IsAttributeMatch(ICustomAttributeProvider provider) { } // similar to IsLiteralMatch

It should be added for everything that allows attributes: type defs, methods, properties, fields, events, getters/setters/adders/removers, parameters, return types, etc.

there you can iterate over all attributes and check all the arguments...

hope this helps...

I am looking forward to your pull request! ;-) Thank you!

[Dentrax]

Thank you so much! I'll try to do something for learning purpose. Also, you could add this feature. :)

[SylwesterZarebski]

It is most crucial feature (especially search within attribute value) which makes me using DotPeek instead of ILSpy. Please implement it.

[siegfriedpammer]

Can you link to feature description, so I could take a look at it? Thanks!

[SylwesterZarebski]

I mean ability to search within:
string in Attribute = [TestAttribute("Test Me 123")]
string in Const = public const string Test = "Test Me 345";

[CarePackage17]

I also just stumbled upon this and it'd be nice to have this covered.

I'm interested in searching the winmds produced by https://github.com/microsoft/win32metadata for APIs that exist from a specific Windows version. In the win32 winmd those are decorated with [SupportedOSPlatform("<some windows version")], but search doesn't work here.

[jamestiotio]

I also had a use case of attempting to search through COM GUID identifier string attributes when I stumbled upon this issue. This feature would be very helpful for both software developers and reverse engineers alike when searching for a particular CLSID in DLL or/and WinMD files.

If I have some extra time, I can take a look at implementing this.