Signature search in engine

Hello hello!

Which plugins do you guys use at IDA / Ollydbg to search a signature in the engine?

Thanks!

The standard search works good in ida

also to find a pattern? and to know which pointers are variable and which are static? cuz i know where the function is i want

I'm not sure but if you put a "?" instead of a byte it would mean that this byte could have any value

Ye, so all the bytes which are 00 in the engine or well in my partern can be writen as an ? i assume?

Like if i got \x66\x8B\xED\x83\x00\x00\x00\x3D
it is like xxxx???x

Quote:

Originally Posted by TheRealPower Ye, so all the bytes which are 00 in the engine or well in my partern can be writen as an ? i assume? Like if i got \x66\x8B\xED\x83\x00\x00\x00\x3D it is like xxxx???x

a dword are 4 bytes

I would make you a screenshot but I don't have access to my computer. If your function starts with for example 55 87 14 25 69 74 and last 4 bytes are relative address then you would write 55 87 ? ? ? ? To find this. I hope it's understandable what I say xd

Yea i understand, but my question actually was how do i know if '14' in your example is a relative address or not? throught IDA

mb bec there stand a adress Call ????????????????????????????? [0x24244242] ???

Almost every time an instruction use memory address it should be replaced with '?'