Struct Pattern 

pub struct Pattern<'db> { /* private fields */ }

A compiled binary search pattern that frees its kernel handle on Drop.

handle is a UniquePtr of CompiledBinpat, non-null by construction; cxx’s deleter frees the compiled_binpat_vec_t on drop. UniquePtr over an opaque type is !Send, so Pattern lives only on the kernel thread. It borrows &Database, so it can’t coexist with a write.

Implementations

impl<'db> Pattern<'db>

pub fn hex(db: &'db Database, pattern: impl AsRef<str>) -> Result<Self>

Compile an IDA-style hex signature.

Each whitespace-separated token is a hex byte (48), a byte wildcard (? or ??), or a nibble pattern with one wildcard half (4?, ?B). This grammar is parsed here, not by IDA, so a mistyped byte is a hard error rather than the silent ASCII fallback ida would give it.

Errors

Error::PatternRejected with PatternRejection::BadToken naming the first token that is none of these, or PatternRejection::NoAnchor if every byte is a wildcard.

Examples found in repository

examples/actor.rs (line 36)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let db = std::env::args().nth(1).expect("usage: actor <db.i64>");

    // `run` -> Err on kernel setup; the app closure -> Err on an operational failure.
    Ida::run(move |ida| -> Result<(), Error> {
        {
            let db = db;
            ida.call(move |idb| idb.open(&db).call())??;
        }

        let n = ida.call(|idb| idb.functions().count())?;
        let segs = ida.call(|idb| idb.segments().count())?;
        println!("[app] func_count={n}  segments={segs}");

        // Sig scan: build a hex pattern from the first function's opening bytes and count
        // how often that exact sequence recurs across the image. A `Pattern` borrows the
        // `Database`, so it is built, searched, and dropped inside a single kernel call.
        let hits = ida.call(|idb| {
            let Some(address) = idb.functions().next().map(|f| f.address()) else {
                return 0;
            };
            let sig = idb
                .bytes(address, 8)
                .iter()
                .map(|b| format!("{b:02X}"))
                .collect::<Vec<_>>()
                .join(" ");
            match Pattern::hex(idb, &sig) {
                Ok(pat) => idb.search(&pat).count(),
                Err(_) => 0,
            }
        })?;
        println!("[app] first function's opening 8 bytes recur {hits} time(s) in the image");

        // Sub-workers each hold a handle clone; their calls serialize onto the kernel.
        let mut hs = vec![];
        for t in 0..4usize {
            let ida = ida.clone();
            hs.push(thread::spawn(move || {
                let idx = t * 1000;
                let found = ida
                    .call(move |idb| idb.functions().nth(idx).map(|f| (f.address(), f.name())))
                    .expect("kernel call");
                let (address, name) = match found {
                    Some((address, name)) => (format!("{address:#012x}"), String::from(name)),
                    None => ("<none>".into(), "<unnamed>".into()),
                };
                println!("[worker {t}] function[{idx}] @ {address}  {name}");
            }));
        }
        for h in hs {
            h.join().unwrap();
        }

        ida.call(|idb| idb.close(false))?;
        Ok(())
    })??;

    println!("\nACTOR OK (kernel on its own thread; calls marshaled from app + 4 workers)");
    Ok(())
}

pub fn code_mask( db: &'db Database, code: &[u8], mask: impl AsRef<str>, ) -> Result<Self>

Compile from a code byte sequence and a parallel mask string.

x/X matches the byte and ?/. wildcards it, the \x..-plus-mask convention of shared sig dumps.

Errors

Error::PatternRejected with PatternRejection::BadMaskChar for a mask character outside that set, PatternRejection::MaskMismatch for a length mismatch, or PatternRejection::NoAnchor for an all-wildcard mask.

impl<'db> Pattern<'db>

pub fn bytes<'a>( db: &'db Database, data: &'a [u8], ) -> PatternBytesBuilder<'db, 'a>

Build a pattern from raw bytes.

Without mask, every byte must match. With one (same length), a mask byte is applied bitwise: 0xFF full byte, 0x00 wildcard, 0xF0 high nibble, 0x0F low nibble.

Errors

Error::PatternRejected on a length mismatch or an all-wildcard mask.

pub fn ida<I1>(db: &'db Database, pattern: I1) -> PatternIdaBuilder<'db, I1>

where I1: AsRef<str>,

Compile via IDA’s own parser: the full grammar ("..." string literals, 'c' char constants, radix-radix numbers) including its lenient ASCII fallback for bare tokens.

case_sensitive matches string literals exactly (default insensitive).

Errors

Error::PatternRejected with PatternRejection::Unparseable when IDA rejects it outright, or PatternRejection::NoAnchor when it compiles to only wildcards.

Trait Implementations

impl Debug for Pattern<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.