IDA - Searching for a pushed value - ida

How do I search for a pushed value in IDA?
I have a value that is pushed into a certain function.
I want to search for it like:
push 420
How do I that?

Make sure you have closed all remaining search result windows. Such windows are titled with "Occurences of: ...". This is necessary to get the right window.
Hit "Alt+t" to open a new text search window.
In the search field, enter 'push 420' without the '.
NB: You have to get the number of spaces right. I got them like this: I searched for "push" only at first. Then I right clicked on the result, copied it and inserted it into my new search. This gives you the right number of spaces.
Make sure you have selected "Find all occurences". Make sure you have not selected any Parameters (e.g. "Regular expression", ...)
Hit OK

Related

Visual Studio Code select same position above and below not the whole line before and after (see image)

I'm using visual studio code and run into a weird problem. I'm not sure how I got here - I could have accidently pressed a shortcut unknowingly.
I'm trying to select a phrase, link or anything that crosses multiple lines (whether the lines are true lines or due to word wrap). When I select multiple lines, it doesn't automatically select the text at the start and end between the two points. Rather, it just selects the length of text for that line and repeats it in the subsequent lines. See the image below to understand.
Image of issue
As you can see, I am trying to select the words from "the" to the end of "sub". Instead of selecting all the words between the two, it selects the text "the instru" and selects every line with the same amount of characters/length.
In order to show what I am expecting, I have pasted the text into Notepad and done the same thing.
What I am expecting
As you can see, all the words between "the" and "sub" are selected.
If anyone has any idea about how to fix this, I would be greatly appreciative.
Below is a copy of the text if the images don't display.
Follow the instructions below for a click guide to retire and/or add 'School'.
Best practice if there is a change in 'School' structure would be to 'retire' any existing school setup that is no longer required and add the new sub school information. The reason why we don't just edit existing school names (typically) is due to leaving historical data intact.
Try using ctrl+shift+P and typing "Toggle Column Selection Mode"

Microsoft Word->Field Code->{TC}

So I am having a problem. This is what I can create on one of my laptop:
On another, when I created something that has {TC} in it, the whole field code disappeared.
For the example above, if on the other computer, both are running Office 2010,
I can input the code to create the table of content from:
{TOC \f \h \z \f 1\t "Heading 1,1,Heading 2,2,Heading 3,3,Title,1}
to
{TC}
The moment I type in TC, the whole {} disappears.
Other field codes work just fine, except for {TC}. So my question is how do I get {TC} to show on my other laptop?
Thank you for your time.
Apparently, I found my answer.
When I searched google for my answer, most sites give this as a solution:
For Word 2010, go to File->Options->Advanced
Under Show document contents: Select "Show field code instead of their values"
This is the equivalent of pressing Alt+F9, which DID NOT solve my problem.
Apparently, the solution to get {TC} to show in your document is in:
go to File->Options->Display
and check to always show HIDDEN TEXT.
I hope this helps someone in the future.
Yeah, the disappearing TC code is annoying at first -- seems like it's broken. Other codes work, but why does that disappear, even if entering manually? Word instantly sets TC code to Hidden, even the field code itself.
To temporarily toggle this visible without permanently changing your display to show Hidden Text, you can use the normal Ctrl-Shift-8, which toggles display of spaces, paragraph marks, tabs, and Hidden Text, on and off. This is a good keyboard shortcut to have in your standard back of tricks anyway. It is frequent in Word that you need to toggle paragraph marks on and off, because paragraph formatting is attached to the Paragraph mark, and when they're hidden, it can be tricky to fix various formatting issues.
The original post was a few years ago, but I fear things have gotten worse since then, not better. I am using Word 365 v2201, which should be up to date. The other day, I wasted hours on trying to resolve this issue with TC field codes.
First I tried entering them using Insert > Quick Parts > Field. Word creates what looks like a field code, but it behaves as normal text. Messing around with the various controls to toggle field display and hidden text etc etc, has absolutely no effect. It is basically a faux field. And of course, it is completely ignored when compiling the TOC.
Next, I tried entering it manually, by using Ctrl + F9 to either create a blank field or convert some existing text into a field. Same result as above.
As with the original post, this seems to afflict only the TC field code. Other codes work fine, including TOC. And if I create a TOC field, then edit the code to TC, it immediately loses its properties as a field. If I then put the O back in, it immediately behaves as a field once again. Unlike in the original post, adjusting the settings for field display and/or hidden text, have no impact.
In the end, the only solution was to create the field using Alt + Shift + o to open the Mark Table of Contents Entry dialog box. And finally, this works!

Why is the enter key behaving like the tab key?

I have a "search" layout, which has several object boxes for the user to type in search queries. I have Set Tab Order... which works great. However, rather confusingly, pressing enter/return also has the same effect as pressing tab.
I have looked in the Inspector > Go to next object using and see that both the return and enter are unchecked.
What/where else could be causing this behaviour? Ideally I would like the return/enter key to perform a script/act like a button, is this possible?
Note: I am in Find Mode.
If there's no script trigger, try to double check that the enter/return is really off for the field in question. Maybe there are two or more fields stacked on top of each other (sometimes developers do that) and you checked the wrong one.
I was having the same issue. I checked the fields and there were no hidden scripts, triggers, conditional formatting or anything like that; however, the fields were either a drop-down list or a drop-down calendar so after selecting the criteria, the cursor would go to the next field.
I noticed that if I enter the finding criteria and double click the same field (to avoid going to any other field) and then click the return or enter keys, it works. So stay in the field when you click return or enter and it will perform the find.
Are you positive that you're in find mode when you're doing this? The default behavior in find mode is that the return key executes the find.
If the field you've selected has a dropdown list then CLICKING ON IT ONCE will bring the list down but not place the cursor in the field. Selecting the field a second time will place the cursor in the field. Once the cursor is actually visible in the field you will find that the TAB key works as you expect.
Otherwise, with the dropdown list down and the cursor not in the field, the RETURN key will move to the next field when in Find mode. This default behaviour sort of makes sense to me because the RETURN key can't act on the field until the cursor is actually in the field.
I had the same problem as you and it stumped me for a while too.

Searching in eclipse always fails first time, always succeeds seconds time with identical search string

I've noticed that if I search for something in Eclipse (using it for Android development thus has the Android plugin) then the first time I search for a search string it always says there are no matches, but if I immediatly report the same search, then there are matches.
Using: Search/Search/File Search - then enter something in the "Containing text:" box (Case sensitvie is off, regular expression is off, file name patterns are .).
It will report "'search term' - 0 matches in workspace(.).
If I search again it will fail again unless I retype the search term or copy and paste it (no, I'm not mistyping it, if I enter it the first time when it fails, then copy and paste the term for the next successful search its obviously an identical search term).
This happens 100% of the time. Why is it doing this? Its really bugging me, when I search something I have to enter it twice it in order to get the results which is irritating.
Check the search scope at the bottom and make sure the correct one is selected:
Workspace
Selected resources
Enclosing projects
Working set
If you have a project highlighted in your workspace when you open the search dialog, it will default to the selected resource, otherwise it will default to the workspace, so that may be why you are seeing different results the second time around.
Hope this helps.

Why would eclipse not show search results inside file in results list?

We have one installation of Eclipse which does not show the individual lines on which search results occur as do all other installations, as shown here:
How can we turn on this feature so that individual results in each line are shown?
I think it's a question of what tool you are using. If you do a text search, you get one line per hit. But if, say, you look for references to a Java method, you get one line per file.
Although it seems like a perfectly desirable thing, I can't find any way to get Java search to return one line per hit.
In the preferences of the Search window (usually button with triangle icon) choose "Show as List" item