{"action":"created","issue":{"url":"https://api.github.com/repos/corelan/mona/issues/11","labels_url":"https://api.github.com/repos/corelan/mona/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/corelan/mona/issues/11/comments","events_url":"https://api.github.com/repos/corelan/mona/issues/11/events","html_url":"https://github.com/corelan/mona/issues/11","id":119623794,"number":11,"title":"findwild command -type switch","user":{"login":"reider-roque","id":6162309,"avatar_url":"https://avatars.githubusercontent.com/u/6162309?v=3","gravatar_id":"","url":"https://api.github.com/users/reider-roque","html_url":"https://github.com/reider-roque","followers_url":"https://api.github.com/users/reider-roque/followers","following_url":"https://api.github.com/users/reider-roque/following{/other_user}","gists_url":"https://api.github.com/users/reider-roque/gists{/gist_id}","starred_url":"https://api.github.com/users/reider-roque/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reider-roque/subscriptions","organizations_url":"https://api.github.com/users/reider-roque/orgs","repos_url":"https://api.github.com/users/reider-roque/repos","events_url":"https://api.github.com/users/reider-roque/events{/privacy}","received_events_url":"https://api.github.com/users/reider-roque/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-01T01:59:06Z","updated_at":"2015-12-01T14:42:01Z","closed_at":"2015-12-01T06:15:10Z","body":"Hello Peter,\r\n\r\nI happened to dug into the implementation of the `findwild` command and discovered undocumented and unimplemented (functionality) `-type` switch. \r\n\r\nIf you don't plan to implement this feature then code associated with it can be safely removed (I pinned it in my local repository and can send a pull request if you approve).\r\n\r\nOn the other hand, if you plan to implement it how useful will be wildcard search for *bin* (opcode sequence) type? Is there a need to search for bytes, for example, like this -- `\\xFF?\\x24*\\x1C` -- with (*?*) representing single byte, and (<i>*</i>) representing any number of bytes? (I really don't know answer to this question since I'm just getting into the exploit development)."},"comment":{"url":"https://api.github.com/repos/corelan/mona/issues/comments/160986600","html_url":"https://github.com/corelan/mona/issues/11#issuecomment-160986600","issue_url":"https://api.github.com/repos/corelan/mona/issues/11","id":160986600,"user":{"login":"reider-roque","id":6162309,"avatar_url":"https://avatars.githubusercontent.com/u/6162309?v=3","gravatar_id":"","url":"https://api.github.com/users/reider-roque","html_url":"https://github.com/reider-roque","followers_url":"https://api.github.com/users/reider-roque/followers","following_url":"https://api.github.com/users/reider-roque/following{/other_user}","gists_url":"https://api.github.com/users/reider-roque/gists{/gist_id}","starred_url":"https://api.github.com/users/reider-roque/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reider-roque/subscriptions","organizations_url":"https://api.github.com/users/reider-roque/orgs","repos_url":"https://api.github.com/users/reider-roque/repos","events_url":"https://api.github.com/users/reider-roque/events{/privacy}","received_events_url":"https://api.github.com/users/reider-roque/received_events","type":"User","site_admin":false},"created_at":"2015-12-01T14:42:01Z","updated_at":"2015-12-01T14:42:01Z","body":"My playground setup: OS: Windows XP SP 3 Eng, program - Easy RM to MP3 Converter (from Exploit Writing Tutorial, part 1 on corelan.be), latest version of mona pulled from Github, Immunity Debugger v1.85\r\n\r\nThere are two instruction/byte sequence search commands implemented in mona: `find` and `findwild`. You can search for byte sequences with `find`, but not with `findwild`. The second one won't find anything if you supply byte sequence instead of instruction sequence. For example, `mona findwild -x * -s jmp esp` finds 3 cases, while `mona findwild -x * -s \\xff\\xe4` finds nothing. Even if you specify the type explicitly, as in `mona findwild -x * -type bin -s \\xff\\xe4` it stil won't find anything. That is because this functionality for that command is not implemented. I am fairly certain of this because I looked into the code. There is a check for the `-type` switch, there is a variable called `patterntype` set based on it's value, which is further passed to the `findPatternWild` function; but in `findPatternWild` function `patterntype` is not used for anything.\r\n\r\nAlso you said that you can already perform wildcard byte sequence search by providing \\x?? sequences to mona. Can you please give an example of such a command? Since `findwild` doesn't currently work with byte sequences, I was trying it with `find`, but it didn't work for me."}}