Class BpsPattern

java.lang.Object

ghidra.util.bytesearch.bytepatternsearch.BpsPattern

public final class BpsPattern
extends Object

This class represents a byte pattern in support of the BpsXmlParser of the Byte Pattern Search capability within Ghidra.

The design of the XML Parser and its supporting classes can be found in BpsXmlParser.

The design of the Byte pattern Searcher and its supporting sub-capabilities and classes can be found in the "Search For Byte Patterns" page in the help viewer.

This class represents a byte pattern object which is populated by BpsXmlParser. This object wraps a search byte array (inside a ByteBuffer), its parent BpsSearchItem, and its parsed XML tag name for use downstream.

Object Variables

• name

  Indicates how to handle a pattern's matching and result analysis. Supported Names:

  • <Bytes> – The default tag. Indicates a standard constant, function, or table search.
  • <Blacklist> – Unique to function-based searches. Enforces filtering rules.

  The pattern's search type is indicated in the parent BpsSearchItem: OrderedFunction-type and Table-type searches will enforce the order of the buffer as presented in the pattern. See BpsSearchType for a complete discussion on search types.

• buffer

  The byte array wrapped in a ByteBuffer. NOTE: all byte patterns must be in big Endian form.

• parentSearchItem

  Links to the owning <SearchItem> tag. This link is needed for result context preservation: when a match is found, the engine extracts metadata from the parent BpsSearchItem to populate the displayed results. Without this parental link, the results table will have empty gaps and lack critical context.

• transformation

  The transformation details of how this pattern was formed; see BpsTransformation for details.

Constructor Summary

Constructors

Constructor	Description
BpsPattern(String name, ByteBuffer rawBytes, BpsSearchItem parentSearchItem, BpsTransformation transformationRecord)	Constructor.

Method Summary

Modifier and Type	Method	Description
ByteBuffer	getBuffer()	Returns the buffer containing the byte pattern. Downstream consumers are prevented from corrupting the pattern.
String	getDescription()	Returns the description of the pattern.
String	getName()	Returns the name as parsed from the XML.
BpsSearchItem	getSearchItem()	Returns the parent search item containing this byte array.
BpsTransformation	getTransformation()	Returns the transformation record of byte manipulations performed on the pattern.
String	toString()

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Details

BpsPattern

public BpsPattern(String name,
 ByteBuffer rawBytes,
 BpsSearchItem parentSearchItem,
 BpsTransformation transformationRecord)

Constructor.

Parameters:

name - parsed XML tag containing this byte pattern array

rawBytes - parsed byte array wrapped in a ByteBuffer

parentSearchItem - parent search item containing this pattern for searching

transformationRecord - byte manipulation order

Method Details

getName

public String getName()

Returns the name as parsed from the XML.

Returns:

the name as parsed from the XML

getSearchItem

public BpsSearchItem getSearchItem()

Returns the parent search item containing this byte array.

Returns:

the parent search item containing this byte array

getBuffer

public ByteBuffer getBuffer()

Returns the buffer containing the byte pattern. Downstream consumers are prevented from corrupting the pattern.

Returns:

the buffer containing the byte pattern. Downstream consumers are prevented from corrupting the pattern

getTransformation

public BpsTransformation getTransformation()

Returns the transformation record of byte manipulations performed on the pattern.

Returns:

the transformation record of byte manipulations performed on the pattern

toString

public String toString()

Overrides:

toString in class Object

getDescription

public String getDescription()

Returns the description of the pattern.

Returns:

the description of the pattern