Hi all,

I'm trying to use the findall (or better yet, findallmem) command in x64dbg to find all the address matching a pattern.

The command is documented here: https://help.x64dbg.com/en/latest/commands/searching/findall.html

I see that $result now contains the number of occurences, so the pattern was found (multiple times).

Now, this might sound like a silly question (sorry if it is), but how can I actually get the relevant addresses where the pattern was found? 😅

if i use the find command, the relevant address is stored in $result. Where are the addresses stored in the case of findall?

 

Thanks a lot,

Luca

I think the only way is to get them from the ref view.

https://github.com/x64dbg/x64dbg/issues/3008

Hello,

first of all I'd like to thank @agentjones for his reply (and he is technically correct!).

The correct way to retrieve the addresses is to use ref.addr(X) where X is the index.

For example:

ref.addr(0) -> get the first address of the searched pattern

ref.addr(1) -> get the second address of the searched pattern

and so on...

 

Edited April 6, 20232 yr by Luca91