re_scan
Search process memory for byte patterns, typed values, pointer targets, heap region chunking, cross-references, and string references, with configurable region and result limits.
Instructions
Search process memory. ops: pattern {signature,start?,size?,module_name?} (first match), pattern_all {signature,...,max_results?}, value {type,value,heap_only?,page_offset?,page_limit?}, ptr_to {target,heap_only?,page_offset?,page_limit?}, heap_regions {regions[],type,value,max_results?,alignment?,max_total_bytes?} (chunks all regions with overlap; alignment default=val_size), xrefs {target,start?,size?,module_name?}, string_refs {search_text} (whole-process). NOTE: pattern/xrefs with no module_name/start+size scan 256MB from process base. page_limit/max_results cap RETURNED results, not scan cost. Heavy scans have a caller-side 120s timeout; the AS loop is not cancelled.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| op | Yes | Operation | |
| size | No | pattern/xrefs: region size in hex | |
| type | No | value: scan type. heap_regions: u32|u64|pointer | |
| start | No | pattern/xrefs: start hex addr (default module base) | |
| value | No | value/heap_regions: hex string for u64/pointer, number for u32/float/double | |
| target | No | ptr_to/xrefs: target hex address | |
| regions | No | heap_regions: from get_vad_snapshot (re_vm vad) | |
| alignment | No | heap_regions: byte stride between value probes (1|2|4|8). Default = val_size (fast, aligned-only). Use 1 for unaligned hits (slow). | |
| heap_only | No | value/ptr_to: only heap regions (default false) | |
| signature | No | pattern/pattern_all: IDA-style e.g. '48 8B ?? ?? ?? 89' | |
| page_limit | No | value/ptr_to: max returned (default 100, max 5000) | |
| max_results | No | pattern_all/heap_regions: cap on matches (max 5000) | |
| max_strings | No | string_refs: max distinct string addrs to trace (default 20, max 100) | |
| module_name | No | Module to scan (default main) | |
| page_offset | No | value/ptr_to: skip N results (default 0) | |
| search_text | No | string_refs: text to find refs to | |
| max_total_refs | No | string_refs: hard cap on total refs returned (default 500, max 2000) | |
| max_total_bytes | No | heap_regions: total scan budget across all regions (default 4GB, max 16GB). Sets budget_exceeded:true if hit. | |
| max_refs_per_string | No | string_refs: max ptr refs per string (default 50, max 200) |