Searching

In Recaf under the “Search” menu item there are multiple kinds of searches. Each type of search is described below. All search kinds share common behavior:

1. Search input fields that are left empty are counted as “wildcard” search parameters. This means that they will match any value. Some examples of using wildcard searches will be outlined below as examples.
2. The match mode for text content can be changed. The supported modes are:
   • Contains: If the target text contains the input field text, match.
   • Equals: If the target text is an exact copy of the input field text from start to end, match.
   • Starts with: If the target text starts with the text of the input field, match.
   • Ends with: If the target text ends with the text of the input field, match.
   • Regex: If the target text matches the regular expression pattern of the input field, match.
3. Searches can be sped up if you choose to skip packages you are not interested in looking at in larger files

Search Modes

Strings

Finds defined string constants.

Examples

Description	String	Match Mode
Match URL strings like www.example.com or http://example.com	(www|http(s)?:|ftp:)+[^\s]+[\w]	Regex
Match common IPv4 address like 192.168.0.1	(\d{1,3}\.){3}\d{1,3}	Regex

Values

Finds defined numeric constants. The matched value type is determined by the suffix (or lack of suffix) of the value input text

• F will search for float values
• D will search for double values
• L will search for long values
• No suffix will search for int values

Accepted number formats are decimal numbers, floating point numbers, and hexadecimal numbers.

Examples

Description	Value
Search for HKEY_CURRENT_USER / HKEY_LOCAL_MACHINE (Windows registry)	0x80000001 / 0x80000002

Class references

Finds where types are referenced. This is not to be confused with member reference. This finds instantiations of the type in the following cases:

• Example.class
• new Example
• x instanceof Example
• Example myLocalVariable

Member references

Finds where members are referenced.

Examples

Description	Owner	Name	Descriptor	Match Mode
Search for all references to anything in the com/example package	com/example			Starts with
Search for all references of any member of the class com/example/Example	com/example/Example			Equals
Search for all references to any member named myExample		myExample		Equals
Search for all references to any int field			I	Equals
Search for all references to any method that returns an int			)I	Ends with

Wildcard searches are very flexible in this search category

Member declarations

Finds field and method definitions.

Examples

Description	Owner	Name	Descriptor	Match Mode
Search for all declared fields and methods of any class containing the text Block	Block			Contains
Search for all declared fields and methods named named isActivated		isActivated		Equals
Search for all declared int fields			I	Equals
Search for all declared methods that returns an int			)I	Ends with

Instructions

Finds instruction patterns based on disassembled methods.

Examples

Description	Text lines	Match Mode
Search for all constructor calls by matching the new Example() pattern	NEW DUP INVOKESPECIAL	Starts with