PsSearchLinearMemory

Searches for a pattern in linear memory.

Syntax

PULSE_STATUS PsSearchLinearMemory(
 [in] PPS_ENGINE pEngine,
 [in] uint64_t PageTableAddress,
 [in] uint64_t StartAddress,
 [in] uint64_t EndAddress,
 [in] void* pPattern,
 [in] uint32_t PatternSize,
 [in] uint32_t SearchStep,
 [in] uint8_t IgnoreGaps,
 [out, optional] uint64_t* pResult
);

Parameters

PPS_ENGINE pEngine

An opaque handle to an engine created by the EngCreateEngine function.

uint64_t PageTableAddress

The target page table root address. This page table is used to perform a page walk for the specified address. The currently loaded page-table address is stored in the CR3 register.

uint64_t StartAddress

The segment offset at which the search begins.

uint64_t EndAddress

The segment offset at which the search ends.

void* pPattern

The buffer containing the pattern to search for.

uint32_t PatternSize

Specifies the size of the pattern.

uint32_t SearchStep

Specifies the search step size. For example, a search step of 0x1000 checks for the pattern at start, start + 0x1000, start + 2 * 0x1000, and so on.

uint8_t IgnoreGaps

Specifies whether gaps in memory should be ignored. A value of 0 means that the search stops when it encounters an unmapped memory region. A value of 1 means that the search skips unmapped memory regions and continues until EndAddress is reached.

uint64_t* pResult

Receives the address at which the first instance of the search pattern is found.

Return value

If the function succeeds, the return value is PULSE_STATUS_SUCCESS.

If it fails, it returns one of the PULSE_STATUS values. Possible return codes include, but are not limited to, the following:

PULSE_STATUS_INSUFFICIENT_RESOURCES
0xC0000002		 One of the memory allocations failed during initialization.
PULSE_STATUS_TIMEOUT
0xC0000007		 Might happen if
  • Transport I/O timed out.
  • No response was received from the debuggee within the request timeout period.
PULSE_STATUS_NOT_FOUND
0xC0000009		 The pattern was not found.
PULSE_STATUS_INVALID_PARAMETER
0xC0000010		 Might happen if
  • The pEngine parameter is NULL.
  • The pPattern parameter is NULL.
  • SearchStep is 0 while SearchDistance is not.
  • PatternSize is greater than the maximum allowed value (see remarks).
PULSE_STATUS_INVALID_PACKET
0xC0000031		 An invalid or unexpected packet was received in response.
PULSE_STATUS_INVALID_TRANSLATION
0xC0000021		 Linear to physical address translation failed. Might happen if there is no valid page in the translation or if a memory gap is encountered while the IgnoreGaps parameter is set to 0.
PULSE_STATUS_DEVICE_CONNECTION_LOST
0xC0000308		 The connection to the transport was lost. Try restarting the engine or the transport.

Remarks

The maximum pattern size can be determined using the PsRequestGetMaxSearchPatternSize function.

If StartAddress is greater than EndAddress, the search is performed backward.