[FEATURE] Added string search option

pe-bear/base/threads/SignFinderThread.h

@@ -96,7 +96,7 @@ public:
 	bool loadSignature(const QString &label, const QString &text)
 	{
 		m_patternFinder.clear();
-		Signature *sign = Signature::loadFromByteStr("Searched", text.toStdString());
+		Signature* sign = Signature::loadFromByteStr(label.toStdString(), text.toStdString());
 		if (!sign) {
 			return false;
 		}

pe-bear/gui/windows/MainWindow.cpp

@@ -272,7 +272,7 @@ void MainWindow::createTreeActions()
 	this->saveAction = new ExeDependentAction(saveIco, tr("&Save the executable as..."), this);
 	connect(this->saveAction, SIGNAL(triggered(PeHandler*)), this, SLOT(savePE(PeHandler*)));
 	
-	this->searchSignature = new ExeDependentAction(QIcon(":/icons/Preview.ico"), tr("Find signature"), this);
+	this->searchSignature = new ExeDependentAction(QIcon(":/icons/Preview.ico"), tr("Find pattern"), this);
 	connect(this->searchSignature, SIGNAL(triggered(PeHandler*)), this, SLOT(searchPattern(PeHandler*)));
 
 	reloadAction = new ExeDependentAction(QIcon(":/icons/reload.ico"), tr("&Reload"), this);

pe-bear/gui/windows/PatternSearchWindow.cpp

@@ -14,18 +14,37 @@ PatternSearchWindow::PatternSearchWindow(QWidget *parent, PeHandler* peHndl)
 	startOffsetBox.setPrefix("0x");
 	startOffsetBox.setValue(0);
 
+	// Pattern search:
 	QRegularExpressionValidator *validator = new QRegularExpressionValidator(QRegularExpression("([0-9A-Fa-f\\?]{0,2} {0,1})*"), this);
 	patternEdit.setValidator(validator);
-	patternEdit.setToolTip(tr("Hexadecimal with wild characters, i.e.")+ "\"55 8B ?? 8B 45 0C\"");
-	patternLabel.setText(tr("Signature to search:"));
 
+	const QString signInfo = tr("Hexadecimal with wild characters, i.e.") + "\"55 8B ?? 8B 45 0C\"";
+	patternEdit.setToolTip(signInfo);
+	patternLabel.setText(tr("Signature to search:"));
+	patternEdit.setPlaceholderText(signInfo);
 	patternLabel.setBuddy(&patternEdit);
-	secPropertyLayout3.addWidget(&patternLabel);
-	secPropertyLayout3.addWidget(&patternEdit);
+
+	signatureTabLayout.addWidget(&patternLabel);
+	signatureTabLayout.addWidget(&patternEdit);
+	signatureTab.setLayout(&signatureTabLayout);
+
+	// String search
+	stringTabLayout.addWidget(&searchedStrLabel);
+	stringTabLayout.addWidget(&searchedStrEdit);
+
+	searchedStrLabel.setText(tr("String to search:"));
+	searchedStrLabel.setBuddy(&searchedStrEdit);
+	signatureTabLayout.addWidget(&searchedStrLabel);
+	signatureTabLayout.addWidget(&searchedStrEdit);
+	stringTab.setLayout(&stringTabLayout);
+
+	tabWidget.addTab(&signatureTab, tr("Signature"));
+	tabWidget.addTab(&stringTab, tr("String"));
+
 	secPropertyLayout4.addWidget(&progressBar);
 	
 	topLayout.addLayout(&secPropertyLayout2);
-	topLayout.addLayout(&secPropertyLayout3);
+	topLayout.addWidget(&tabWidget);
 	topLayout.addLayout(&secPropertyLayout4);
 	topLayout.addLayout(&buttonLayout);
 
@@ -40,18 +59,8 @@ PatternSearchWindow::PatternSearchWindow(QWidget *parent, PeHandler* peHndl)
 	patternEdit.setFocus();
 }
 
-QString PatternSearchWindow::fetchSignature()
-{
-	return patternEdit.text();
-}
-
 void PatternSearchWindow::onSearchClicked()
 {
-	QString text = fetchSignature();;
-	if (!text.length()) {
-		return;
-	}
-	
 	if (!this->m_peHndl) return;
 	MappedExe* exe = m_peHndl->getPe();
 	if (!exe) return;
@@ -62,10 +71,31 @@ void PatternSearchWindow::onSearchClicked()
 	const size_t fullSize = exe->getContentSize();
 	if (offset >= fullSize) return;
 	
+	QString text;
+	bool isBySign = false;
+	if (tabWidget.currentWidget() == &signatureTab) {
+		isBySign = true;
+		text = patternEdit.text();
+	}
+	else if (tabWidget.currentWidget() == &stringTab) {
+		isBySign = false;
+		text = searchedStrEdit.text();
+		if (text.length()) {
+			QByteArray utf8 = text.toUtf8();
+			QString hex = utf8.toHex().toUpper();
+			text = hex;
+		}
+	}
+	if (!text.length()) {
+		return;
+	}
+	
 	if (!this->threadMngr) {
 		threadMngr = new SignFinderThreadManager(exe);
 	}
+
 	threadMngr->setStartOffset(offset);
+
 	if (!threadMngr->loadSignature(tr("Searched"), text)) {
 		QMessageBox::information(this, tr("Info"), tr("Could not parse the signature!"), QMessageBox::Ok);
 		return;
@@ -97,13 +127,13 @@ void PatternSearchWindow::matchesFound(MatchesCollection *matches)
 	if (!threadMngr) return; //should never happen
 	
 	if (!matches || !matches->packerAtOffset.size()) {
-		QMessageBox::information(this, tr("Info"), tr("Signature not found!"), QMessageBox::Ok);
+		QMessageBox::information(this, tr("Info"), tr("Not found!"), QMessageBox::Ok);
 		threadMngr->stopThread();
 		return;
 	}
 	const QList<MatchedSign> &signAtOffset = matches->packerAtOffset;
 	if (!signAtOffset.size()) {
-		QMessageBox::information(this, tr("Info"), tr("Signature not found!"), QMessageBox::Ok);
+		QMessageBox::information(this, tr("Info"), tr("Not found!"), QMessageBox::Ok);
 		threadMngr->stopThread();
 		return;
 	}
@@ -113,12 +143,13 @@ void PatternSearchWindow::matchesFound(MatchesCollection *matches)
 	m_peHndl->setDisplayed(false, offset, signLen);
 	m_peHndl->setHilighted(offset, signLen);
 	startOffsetBox.setValue(offset);
-	if (QMessageBox::question(this, tr("Info"), tr("Signature found at:") + " 0x" + QString::number(offset, 16) + "\n"+ 
+	if (QMessageBox::question(this, tr("Info"), tr("Found at:") + " 0x" + QString::number(offset, 16) + "\n"+ 
 		tr("Search next?"), QMessageBox::Yes | QMessageBox::No) == QMessageBox::No)
 	{
 		threadMngr->stopThread();
 		return;
 	}
+
 	threadMngr->setStartOffset(offset + 1);
 	threadMngr->recreateThread();
 }

pe-bear/gui/windows/PatternSearchWindow.h

@@ -45,16 +45,24 @@ protected slots:
 	void onSearchStarted(bool isStarted);
 
 protected:
-	QString fetchSignature();
-
 	QVBoxLayout topLayout;
 	QHBoxLayout secPropertyLayout2;
-	QHBoxLayout secPropertyLayout3;
 	QHBoxLayout secPropertyLayout4;
 	QHBoxLayout buttonLayout;
 
+	// search options related:
+	QTabWidget tabWidget;
+
+	QWidget signatureTab;
+	QWidget stringTab;
+
+	QVBoxLayout signatureTabLayout;
+	QVBoxLayout stringTabLayout;
+
 	QLabel patternLabel;
 	QLineEdit patternEdit;
+	QLabel searchedStrLabel;
+	QLineEdit searchedStrEdit;
 
 	QLabel offsetLabel;
 	HexSpinBox startOffsetBox;