'Search for substrings of a given string/number in memory
Commonly used for ret2strcpy ROP exploit
Usage:
MYNAME "string" start end
MYNAME "string" [mapname] (default is search in current binary)'

def substr(self, *arg):

    (search, start, end) = normalize_argv(arg, 3)
    if (search is None):
        self._missing_argument()
    result = []
    search = arg[0]
    mapname = None
    if (start is None):
        mapname = 'binary'
    elif (end is None):
        mapname = start
    if mapname:
        msg(('Searching    for    sub    strings    of:    %s    in:    %s    ranges' % (repr(search), mapname)))
        maps = peda.get_vmmap(mapname)
        for (start, end, perm, _) in maps:
            if (perm == '---p'):
                continue
            result = peda.search_substr(start, end, search)
            if result:
                break
    else:
        msg(('Searching    for    sub    strings    of:    %s    in    range:    0x%x    -    0x%x' % (repr(search), start, end)))
        result = peda.search_substr(start, end, search)
    if result:
        msg('#    (address,    target_offset),    #    value    (address=0xffffffff    means    not    found)')
        offset = 0
        for (k, v) in result:
            msg(('(0x%x,    %d),    #    %s' % ((4294967295 if (v == (-1)) else v), offset, string_repr(k))))
            offset += len(k)
    else:
        msg('Not    found')
    return
