5.10 Search in assembly

If you want to search for a certain type of opcodes, you can choose to grep for a string while disassembling the whole interest area or assemble the opcode and determine a binary mask to search for similar opcodes using the search '/' command.

To grep, the best way to do it is using the internal grep syntax '~'. Here's an example:

[0x08049AD0]> pd~call
0x08049aec, | call 0x804964c  ; 1 = imp.__libc_start_main
0x08049b38, | call dword near [eax*4+0x8060008]
0x08049b7f    call eax  ; 7 = 0x100a9b76
0x08049bb4,   call 0x805b560  ; 8 = 0x0805b560