+
+
+ Search And Replace
+
+ The search and replace feature allows to users to search for specific text sequences in
+ various Ghidra elements and replace that text sequence with a different text sequence. Using
+ this feature, many different elements in Ghidra can be renamed including labels, functions,
+ namespaces, parameters, datatypes, field elements, enum values, and others. This feature can
+ also be used to change comments placed on items such as instructions or data, structure field
+ element, or enum values.
+
+ By default, the search matches the text anywhere in an element ("contains"), but it has
+ full regular expression support where
+ users can easily perform a "starts with" or "ends with" search. Regular expression capture
+ groups are also supported which allows for complex replacing of disjoint strings. See the examples section below for details.
+
+ To initiate a search and replace operation, select Search 
Search and Replace from the main tool menu.
+
+ Search and Replace Dialog
+
+
+ The Search and Replace Dialog provides controls and options for performing and search
+ and replace operation.
+
+
+ 
+
+ Search and Replace Dialog
+
+
+ Find
+
+
+ This is a text field for entering the text to be searched for in the selected Ghidra
+ elements. Elements are either the names of things such as labels, functions, datatypes,
+ or a comment associated with some item such as an instruction comment or structure field
+ comment.
+
+ Ghidra will find all the elements that contain the given text. To perform a "starts
+ with" or "ends with" search, you must enter a regular expression here and select the
+ regular expression option below.
+
+ There is also a drop down list of recent searches for this Ghidra session.
+
+
+ Replace
+
+
+ This is a text field for entering the replacement text. This text will be used to
+ replace the text that matched the search text. For example, if a function was named
+ "startCat" and the goal was to change it to "startDog", you would enter "Cat" in the
+ Find field and "Dog" in this field.
+
+ This field also include a drop drow of the most recently enter replacement
+ strings.
+
+
+ Options
+
+
+ Regular Expression
+
+
+ If selected, the search text will be interpreted as a regular expression. This
+ allows for complex search and replace operations. See the general section on regular expressions for more information. If
+ you want to anything other than a "contains" search, you must use a regular expression.
+ See below for examples on how to do this.
+
+
+ Case Sensitive
+
+
+ If selected, the entered search text must match exactly. Otherwise, the entered
+ search text can match regardless of the case of the search text or the target text.
+
+
+ Whole Word
+
+
+ If selected, the target text must be an entire word. In other words it must be
+ surrounded by white space or must be the first or last word in a word sequence. So,
+ when applied to renaming elements, the search text must match the entire name of the
+ element since element names cannot contain whitespace. But for comments, the search
+ text must entirely match one word withing the comment.
+
+
+
+ Search For
+
+
+ This section contains a group of checkboxes used to turn on or off the type of Ghidra
+ elements to search. There are also buttons for selecting and deselecting all the element
+ checkboxes. At least one checkbox must be selected to perform a search.
+
+
+ - Classes - Search the names of classes.
+
+ - Comments - Search instruction or data comments. This includes pre-comments,
+ plate comments, end of line comments, post-comments, and repeatable comments.
+
+ - Datatype Categories - Search for the names of categories in the data types
+ tree.
+
+ - Datatype Comments - Search comments associated with datatypes. This includes
+ descriptions on enums and structures, datatype field comments, and enum value
+ comments.
+
+ - Datatype Fields - Search the names of structure or union field elements.
+
+ - Datatypes - Search the names of any nameable datatype (i.e., does
+ not search built-in datatypes such as byte, word, string, etc.)
+
+ - Enum Values - Search the names of enum values.
+
+ - Functions - Search the names of functions. (Note: This search does not
+ include external function names.)
+
+ - Labels - Search the names of labels. (Note: This search does not include
+ external labels.)
+
+ - Local Variables - Search the names of function local variables. (Note: This
+ does not include local variables derived by the decompiler that haven't been committed
+ to the database.)
+
+ - Memory Blocks - Search the names of Memory Blocks.
+
+ - Namespaces - Search the names of namespaces.
+
+ - Parameters - Search the names of function parameters.
+
+ - Program Trees - Search the names of modules and fragments defined in program
+ trees.
+
+
+
+
+
+ Results Window
+
+
+ After initiating a search and replace action, a results window will appear containing a
+ table showing each search match as an entry in the table. At this point, no changes have
+ been made to the program. This provides an opportunity to review the pending changes before
+ they are applied. The changes can now be applied all at once or individually.
+
+
+
+ 
Auto Updating Selection
+ by Location
There is also a popup toggle action
+ to turn on an option to auto delete applied entries from the table.