When performing a search in IDA, it by default starts from the current position and continues up to the maximum address in the database (or to the minimal for searches “Up”). This works well enough for small to average files, but can get pretty slow for big ones, or especially in case of debugging where the database may include not just the input file but also multiple additional modules loaded at runtime.
To skip areas you’re not interested in and improve the speed, you can limit the search to an address range. For this, IDA relies on selection. For example, consider this disassembly snippet:
If you perform a binary search for the value 93, the instruction at 00000514 will be found:
Searching down CASE-INSENSITIVELY for binary pattern: 93 Search completed. Found at 00000514.
However, if you select a range which does not include that address before invoking the search, the search will fail:
Searching down CASE-INSENSITIVELY for binary pattern: 93 Search failed. Command "AskBinaryText" failed
Selecting large areas with the mouse or by holding Shift can be quite tedious, so it may be more convenient to use the anchor selection:
- Move to the start or end of the intended selection and invoke Edit > Begin selection (or press Alt–L ).
- Navigate to the other end of the selection using any means (cursor keys, Jump actions, Functions or Sgments window, Navigation bar etc.).
- Invoke the binary search command. The search will be performed in the selection only.