FindFunc icon indicating copy to clipboard operation
FindFunc copied to clipboard
verified publisher icon FelixBer

FindFunc does not detect some code.

Open karpiyon opened this issue 1 year ago • 3 comments

Hi, What am I doing wrong... Why can't it detect: imul rax, 4

which i defiantly have in my code: image and this e.g. is my rule:

image

What am I doing wrong? BTW 4 or 0x4 in this sense show some result

Thanks,

karpiyon avatar Nov 27 '24 19:11 karpiyon

I tried using Byte Pattern instead and the result was that IDA hanged when I pressed "Cancel" since the process took a very long time.

My search pattern was this:

image

karpiyon avatar Nov 27 '24 20:11 karpiyon

I notices that when i press Find Func for the above search I see these errors: image

I could not copy them because IDA hangs

karpiyon avatar Nov 27 '24 20:11 karpiyon

It looks like you are using IDA 9, which is supported in master, but not in the latest git release. Could you download master and try with that? I'll make a proper 9.0 release in the next days. If that doesnt work, please share the binary file and the exported findfunc rule(s) (right click).

FelixBer avatar Nov 27 '24 21:11 FelixBer

IDA 9.x support has been in master for a while and is now released as v1.5

FelixBer avatar Nov 17 '25 21:11 FelixBer