Byte Pattern Matching

Search for raw byte patterns (hex sequences) in binary code.

When to use

• Find specific instruction sequences by their machine code bytes
• Locate code patterns when the raw opcode bytes are known
• Search for known vulnerability signatures by byte pattern
• Find UEFI-specific patterns like SMI handlers or protocol usage

Instructions

Using the VulHunt MCP tools, open the project (open_project) and run the following Lua query (query_project), adapting it as needed:

local result = project:search_code("<byte_pattern>")

if result then
  local entry = {
    function_address = tostring(result.function_address),
    start_address = tostring(result.start_address),
    end_address = tostring(result.end_address),
    instructions = {},
  }

  for _, insn in ipairs(result.insns) do
    table.insert(entry.instructions, {
      mnemonic = insn.mnemonic,
      address = tostring(insn.address),
    })
  end

  return entry
end

The byte pattern is a hex string (e.g., "554889e5................", where .. matches any byte).

Returns a JSON object containing:

• function_address - the address of the function containing the match
• start_address - the start address of the matched pattern
• end_address - the end address of the matched pattern
• instructions - list of matched instructions with their mnemonics and addresses

UEFI Platform

For UEFI targets, additional functions and options are available:

-- Search code within sw_smi_handlers
local result = project:search_code("<byte_pattern>", "sw_smi_handlers")

-- Search code within child_sw_smi_handlers
local result = project:search_code("<byte_pattern>", "child_sw_smi_handlers")

-- Search for a protocol GUID (returns a boolean)
local guid_found = project:search_guid("5B1B31A1-9562-11D2-8E3F-00A0C969723B", "EFI_LOADED_IMAGE_PROTOCOL_GUID")

-- Search for an NVRAM variable (returns a boolean)
local nvram_found = project:search_nvram("GetVariable", "PlatformLang", "8BE4DF61-93CA-11D2-AA0D-00E098032B8C") 

-- Search for a protocol (returns a boolean)
local protocol_found = project:search_protocol("LocateProtocol", "PCD_PROTOCOL_GUID", "11B34006-D85B-4D0A-A290-D5A571310EF7")

-- Search for a PPI (returns a boolean)
local ppi_found = project:search_ppi("LocatePpi", "PPIName", "9C21FD11-434A-12D3-D10D-109048052C8A")

NOTE: The architecture of the loaded binary can be obtained using project.architecture.

References

• instruction.md - All methods and fields for an instruction

URLs to additional documentation pages are available at https://vulhunt.re/llm.txt

Related Skills

• code-pattern-matching (/code-pattern-matching) - For higher-level semantic pattern matching in decompiled code, while byte-pattern-matching works at the raw instruction level
• decompiler (/decompiler) - Decompile matched code to understand what the byte pattern represents