The Find Bar can be used to find a string, a set of hex bytes, or a number of different data types within a file. The Find Bar can be accessed from the 'Search > Find...' menu option, the Tool Bar, or by pressing Ctrl+F.
When performing a search, the Find Bar will be displayed at the bottom of the editor. Different data types may be searched by clicking the type name to the right of the Find label and choosing from the popup list. The following types are supported:
- ASCII String (a)
- UNICODE String (u)
- Hex Bytes (h)
- EBCDIC String (e)
- Signed Byte (i8)
- Unsigned Byte (ui8)
- Signed Short (i16)
- Unsigned Short (ui16)
- Signed Int (i32)
- Unsigned Int (ui32)
- Signed Quad (i64)
- Unsigned Quad (ui64)
- Float (f)
- Double (lf)
- Variable Name (n) - see Finding Variables below
- Variable Value (v) - see Finding Variables below
The value in brackets is the type specifier and can be used as a quick way to search for different data types (see below). Enter a string, value, or hex bytes to search for in the text field and the field will automatically be converted to hexadecimal bytes and displayed to the right of the Options button. Note that when converting numbers, the endian of the current file is used (see Introduction to Byte Ordering). Note also that the text field can be resized by dragging the line to the right of the Options button.
Clicking the icon will find the next occurrence of the value in the current file or clicking the icon will find the previous occurrence. Clicking the All button will find all instances of the target value in the file and display the results in the Output Window (see below). Pressing the Enter key in the text field has three different possible outcomes depending upon which options are set in the Options dialog: If the Find All Occurrences toggle is set, pressing Enter will perform a Find All operation but if it is not set, pressing Enter will either find the next occurrence of the find value if the Down toggle is selected, or find the previous occurrence if the Up toggle is selected. If no occurrences of the find value could be found, the find text field will be displayed in an orange color. Press the Esc key to hide the Find Bar and return to editing the file.
Different options for the dialog can be displayed by clicking the Options button. When the Find All Occurrences toggle is set, pressing the Enter key in the text field will find all occurrences of the target value. When this toggle is not set, pressing the Enter key will either search for the next or previous occurrence of the target value depending upon if the Down or Up toggle is set in the Direction box.
By default all find operations search the entire file but it is possible to limit finding to one part of the file by using the Range box. To limit the find, first select some bytes in the file and then click the Options button and then the Lock to Selection button. The Lock to Selection button will be disabled if no selection exists. After this button is clicked, all subsequent find operations will be limited to the selection and the limited area will be highlighted brown in the editor (see Color Options to change the color). To return to searching the whole file, click the Unlock Selection button or the icon.
When searching for strings, two options are available: If the Match Case toggle is enabled, the target string will only match if the bytes match exactly. When the toggle is disabled, characters that are not the same case will match. If the Match Whole Word toggle is set, the target string will not match partial words. When Match Case is enabled, the Options button will contain the 'C' character in brackets and when the Match Whole Word toggle is enabled, the Options button will contain the 'W' character in brackets.
When searching for strings or hex bytes, enable the Search with Wildcards toggle to allow the characters '*' and '?' to be used as wildcards in the text field. The '?' wildcard must match exactly one byte, and the '*' wildcard can match zero up to a certain maximum number of bytes. For example, the value 'adv*e?' would match both the strings 'advantages' and 'advised'. The maximum number of bytes for a match can be specified using the Advanced Options section as described below. When the Search with Wildcards toggle is turned on, the special syntax '\*' and '\?' can be used to literally search for the characters '*' (ASCII code 0x2A) or '?' (ASCII code 0x3F).
When searching for floats or doubles, the Float Find Tolerance field will be displayed. This field can be used to search for numbers that are very close to other numbers. Because of numerical precision, sometimes floating-point numbers are stored as 2.00000001 instead of 2. Enter a tolerance value in the Float Find Tolerance field. Numbers that are within the tolerance above or below the target value will match.
If the Allow Multiple Find Ranges toggle is enabled, 010 Editor can store the search results from a number of different queries and can optionally color each query by a different color in the Editor Window. When this toggle is enabled, each query that is performed will add another section of results to the Find tab of the Output Window (see Output Window below for more information). Also, the coloring of the file can be controlled with the Advanced Options section as discussed below.
Click the Advanced Options section to display further options for the find tool. By default, when searching for the next occurrence of a find value and no values are found, the search will start over at the beginning of the file or when searching up and no values are found, the search will start again at the bottom of the file. This is called wrapping and can be disabled by turning off the Allow Wrapping toggle. Clicking the Allow Type Specifiers toggle allows turning off the use of type specifiers (see below).
When the Search with Wildcards toggle is enabled, specify the maximum number of bytes that the wildcard character '*' can match in the Maximum Wildcard Match Length' (default of 24). If the Allow Multiple Find Ranges toggle is turned on, the Multiple Range Colors area controls the coloring that is applied to the bytes in the Editor Window. Choose the Use Default Find Color toggle to color the bytes by the color specified in the Color Options dialog, or the Custom Color toggle to color the bytes using the Fore and Back color boxes. The Fore color indicates the text color to be displayed, and the Back color indicates the background color behind the text.
When searching for all occurrences of a target value using the Find All button, the results are displayed in the Output Window. The top row will be a dark gray header line that indicates the search target and number of occurrences found. Each row of the table indicates a match with the target value. The starting address and value searched for are displayed in the Address and Value fields respectively. When searching within text files, the full line where the find occurrence was found is displayed in the Value field with the found value marked in bold. On the left side of the Output Window is a graph representing the file. Blue lines indicate the position of matches in the file. When a row is selected in the table, the corresponding line in the graph will be displayed as a yellow line. The number displayed below the graph indicates the number of matches that were found. Bytes in the main Editor Window will be colored blue if those bytes are part of a match. Selecting a row in the table will also select the bytes in the editor. The display format for each column can be set to hexadecimal or decimal by right-clicking on the Output Window and selecting 'Column Display Format'. The Size column, which displays the size of each find occurrence is hidden by default but can displayed by right-clicking on the table and selecting Show Size Column. Right-click the table and select 'Clear' to clear all find results, or press the Esc key to hide the Output Window.
If multiple searches were performed and the Allow Multiple Find Ranges toggle is enabled, each search will be displayed in the Output Window in a different section of the table separated by a dark gray header line. Click the '+' or '-' buttons beside the header, or double-click the header to hide or show the results from that search. Right-click the table and click the 'Expand All' or 'Shrink All' menu options to show or hide the search results for all queries.
Find Next/Find Previous
After a search has been made, the 'Find > Find Next' or 'Find > Find Previous' menu options can be used to step through the file, searching for the next or previous occurrences of the target value even when the Find Bar is not displayed.
A quick way exists in the find field to specify different find types without using the popup list of types. This can be done by placing a comma followed by a type specifier at the end of the value to find in the text field. For example, the value "453f,h" would search for the hex bytes 0x45 and 0x3f, the value "0x100,i32" would search for the integer 256, or the value "2.5,lf" would search for the double '2.5'. The full list of type specifiers is shown in the list at the top of this section. To disable the use of type specifiers, click the Allow Type Specifiers toggle in the Advanced Options section.
The Find Bar can also be used to find variable names or values within the Template Results panel. Set the type to search for as Variable Name or Variable Value to search for variables. When a variable is found that matches either the Name or Value, that variable will be highlighted within the Template Results. Note that find all and replace operations are not supported with finding variables.
NOTE: The Find Bar will be hidden automatically after a period of inactivity. To control the length of the period of inactivity before hiding see the General Options dialog.