Rose::BinaryAnalysis::Strings::StringFilter Class Reference

Description

Filter strings by exact matches, substring matches, and regex matches.

StringFilter provides flexible string filtering with three types of matching criteria:

• Exact match: String must exactly match the filter string (case-sensitive)
• Substring match: String must contain the filter substring anywhere (case-sensitive)
• Regex match: String must match a regular expression pattern (with explicit case sensitivity)

Filters are specified using FilterSpecification objects which provide type-safe construction with explicit semantics. Multiple filters can be added to the same StringFilter instance, and a string matches if it satisfies any filter (OR logic).

Regex Support: Regular expressions use boost::regex with ECMAScript syntax. For regex filters, case sensitivity must be explicitly specified via FilterSpecification::CaseSensitivity. Both case-sensitive and case-insensitive regex patterns can coexist in the same StringFilter instance, allowing mixed matching strategies.

Performance: Regex patterns are compiled lazily on first match() call and cached for subsequent matches. Case-sensitive and case-insensitive patterns are compiled into separate regex objects for efficient matching.

Thread Safety: Not thread-safe. Each thread should use its own StringFilter instance.

Usage Examples:

using FSType = FilterSpecification::Type;
using FSCase = FilterSpecification::CaseSensitivity;
 
// Create a filter with multiple criteria
StringFilter filter;
 
// Add exact match for specific strings
filter.addFilter(FilterSpecification(FSType::EXACT_MATCH, "error"));
filter.addFilter(FilterSpecification(FSType::EXACT_MATCH, "warning"));
 
// Add substring match for library names
filter.addFilter(FilterSpecification(FSType::SUBSTRING, "libc"));
 
// Add case-insensitive regex for error codes (matches "ERR", "err", "Err", etc.)
filter.addFilter(FilterSpecification("err[0-9]+", FSCase::INSENSITIVE));
 
// Add case-sensitive regex for specific uppercase acronyms
filter.addFilter(FilterSpecification("^[A-Z]{2,}$", FSCase::SENSITIVE));
 
// Test strings against the filter
assert(filter.match("error"));        // true - exact match
assert(filter.match("libc.so.6"));    // true - substring match
assert(filter.match("ERR404"));       // true - case-insensitive regex
assert(filter.match("err500"));       // true - case-insensitive regex
assert(filter.match("HTTP"));         // true - case-sensitive regex
assert(filter.match("http"));         // false - case-sensitive regex requires uppercase
assert(filter.match("unrelated"));    // false - no matches
 
// Use with StringFinder
StringFinder finder;
finder.settings().filter = filter;
finder.find(map.require(MemoryMap::READABLE));
 
for (const EncodedString& str : finder.strings()) {
    // Process only strings that match the filter
}

See also

FilterSpecification

Definition at line 348 of file String.h.

#include <Rose/BinaryAnalysis/String.h>

Public Member Functions
void	addFilter (const FilterSpecification &spec)
	Add a filter specification.
bool	match (const std::string &str) const
	Test if a string matches any filter.

Member Function Documentation

addFilter()

void Rose::BinaryAnalysis::Strings::StringFilter::addFilter

(

const FilterSpecification &

spec

)

Add a filter specification.

Adds a filter criterion to this StringFilter. The filter can be an exact match, substring match, or regex match with explicit case sensitivity.

Parameters

spec	The filter specification to add

match()

bool Rose::BinaryAnalysis::Strings::StringFilter::match

(

const std::string &

str

)

const

Test if a string matches any filter.

Parameters

str	The string to test

Returns

true if string matches any filter, false otherwise

---

The documentation for this class was generated from the following file:

• String.h